Subprocessors
Last updated
On this page
A subprocessor is a third party Pleezpay engages to process personal data for its customers while delivering the service. Each vendor below processes personal data only for the purpose stated, under a written agreement with data protection terms. We update this list when a subprocessor is added or replaced, and customers with a signed Data Processing Agreement are notified as that agreement sets out.
Infrastructure and platform subprocessors
These vendors host or support the platform for every customer.
| Subprocessor | Purpose | Categories of data | Location |
|---|---|---|---|
| Railway | Hosts the platform API and background workers, the hosted payment page, the merchant dashboard, the developer documentation and this website. Provides managed PostgreSQL databases and S3-compatible object storage for the internal file library. | The service data Pleezpay stores: merchant account and user records, payment session and payment records, webhook, audit and support records, and application details. | The Railway regions configured for the Pleezpay project. The internal file store is in Railway’s Amsterdam (EU West) region. |
| Cloudflare | DNS, TLS, content delivery and proxying of web and API traffic to Pleezpay’s hosts. Email routing for the pleezpay.com domain. | IP addresses, request and connection metadata, and the content of traffic that passes through its network. Mail addressed to pleezpay.com addresses. | Global edge network. |
| Proton | Business mailboxes, including the contact address on this page. | Correspondence with customers, partners, payers and vendors, and any attachments they send. | Switzerland. Proton AG is domiciled in Geneva and operates under Swiss law. |
| Resend | Transactional email: notifications for website enquiries and applications, subscription confirmations, application decision emails, and account invitation and password emails. | Recipient email address and name, order or application references, and the message content. | European Union. Sending is configured in Resend’s EU region in Ireland. |
Tools that don’t process customer personal data, such as source code hosting and build tooling, are not listed.
Connected payment providers
Pleezpay is the orchestration layer between a merchant’s checkout and its connected payment providers. Those providers carry out payment processing, acquiring, safeguarding and settlement under their own terms, regulatory permissions and merchant onboarding decisions. The providers we name publicly are PayPal, Stripe, Airwallex, Mollie, Ziina and Viva.com. Which providers handle a given customer’s payments depends on that customer’s configuration and agreement. Any other acquirers and payment service providers used for a customer’s traffic are disclosed to that customer in their agreement.
Card data entered on the hosted payment page goes to the connected provider that processes the payment. Where a provider places its own card fields on the page, the card number is typed into that provider’s fields and sent to that provider directly. The payer details needed to process and screen a payment — such as name, email address, phone number, billing address, IP address and browser details — are shared with the provider handling that payment, together with the order amount and reference. The Product page describes how the platform works.
Merchant systems
A merchant’s own store platform, such as WooCommerce, sends order details to Pleezpay on the merchant’s instruction and receives order and payment status back. The Pleezpay plugin for WooCommerce sends the order reference, amounts, items, and the shopper’s name, email address, phone number, and billing and shipping address. The merchant chooses, configures and controls these systems. They are not Pleezpay subprocessors, and the merchant’s own agreements with those platforms apply.
Analytics and website tools
Google Tag Manager and Google Analytics (Google) run on the marketing pages of this website only. They stay off until you accept analytics, and they never load on the hosted payment page. When they are on, Google receives online identifiers, device and browser details, an approximate location worked out from your IP address, the pages you view and your interactions, as the Cookie notice describes.
International transfers
Pleezpay is established in the United States, and some subprocessors process data in the United States or other countries. When personal data of residents of the European Union, the United Kingdom or Switzerland is transferred, the transfer relies on standard contractual clauses or another recognised transfer mechanism, as set out in the Data Processing Agreement.
Notice of changes and questions
To get notice of subprocessor changes, or to ask about a vendor on this list, email [email protected] with “Subprocessor notice” in the subject. Customers with a signed Data Processing Agreement get notice through the channel, and within the period, it sets out. Related reading: the Privacy notice and the Security page.
Questions about this page go to [email protected].