Instaflow Subprocessors
Last updated: 11 November 2026
This page lists the companies Instaflow uses to process personal data on behalf of our customers. That data is mainly the analytics we collect about visitors to the landing pages you publish, the Shopify order, checkout and refund data we use to attribute sales to your pages, and any personal data inside the content you give us. For each company we say what it does, what data it handles, where it handles it, and what legal mechanism protects data that leaves the EEA. You will also find how Shopify fits in, which other vendors we use that are not subprocessors, and how to get notified when this list changes. This page forms part of our Data Processing Agreement ("DPA").
1. About this list
1.1 Instaflow is operated by Propeller Digital Limited, a company registered in Ireland (784240, Unit 20, Platform 94, Mervue Business & Technology Park, Wellpark Road, Galway, H91 F9PX, Ireland). When we process personal data for you under the DPA, we are your processor and you, the Customer, are the controller.
1.2 A subprocessor is a third party we engage to process that Customer Personal Data (as defined in the DPA) for us. Each subprocessor:
- has signed a written contract with us that protects the data at least as well as our DPA does;
- may use the data only to provide its service to us, not for its own purposes;
- may not use the data to train or improve AI models; and
- is covered by a valid transfer mechanism if it processes the data outside the EEA.
1.3 This list does not cover data about you as an Instaflow account holder (Account Data). We are the controller of that data, and our Privacy Policy describes the vendors involved.
2. Our subprocessors
| Entity | Purpose | Customer Personal Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting your published pages (Workers), the Instaflow analytics script and event collection, receiving Shopify order webhooks, file storage (R2), custom domains for your pages, and reading public store and product pages for the AI (Browser Rendering) | Visitor requests to your pages (IP addresses are processed in transit at the edge and used only to derive country, region and city); Visitor analytics events before they are stored; Shopify order, checkout and refund webhooks before personal fields are removed; files in your team's file library (images, fonts and text files, kept in private storage); AI-generated page images (kept in public storage, because published pages display them); store overviews and product insights | Global edge network. Stored files: EU (R2 EU jurisdiction) | EU-U.S. DPF (Cloudflare, Inc. is certified); SCCs (Module 3) as a fallback |
| Tinybird (Tinybird, Inc.) | Analytics database for Visitor analytics and order attribution | Visitor analytics events (visitor and session IDs, page URL with UTM and click IDs, referrer, country, region and city, device, browser and OS, cart and checkout events); Shopify orders with hashed email and customer ID, order line items, checkouts, refunds and currency history | EU: AWS eu-central-1 (Frankfurt, Germany) | Data stored in the EU. For any access from outside the EEA: SCCs. Not certified under the EU-U.S. DPF |
| Render (Render Services, Inc.) | Hosting the Instaflow app and its main database | Your briefs, prompts and chat messages; information about generated pages; store and product data; Shopify privacy request payloads (encrypted), which can contain a Shopper's email, phone number and order IDs; application logs | United States (Oregon) | EU-U.S. DPF (certified); SCCs (Module 3) |
| OpenAI Ireland Ltd, with its affiliate OpenAI OpCo, LLC (US) | AI models that generate and edit your pages, copy and store analysis, web research for your briefs, and generating or editing page images | Your briefs, prompts, chat messages and files from your file library; product, store and brand data; page code and build output. To generate or edit page images, we send your product images and image prompts to OpenAI's image model. The images it returns are stored publicly in Cloudflare R2, because published pages display them. We don't send Visitor analytics or Shopify order data. Requests are sent with response storage turned off, and OpenAI does not train on them. OpenAI keeps prompts and outputs in its abuse-monitoring logs for up to 30 days | Ireland (contracting entity); processing in the United States | No DPF certification. SCCs between OpenAI Ireland Ltd and its US affiliates, with the UK Addendum |
| E2B (FoundryLabs, Inc.) | Isolated sandboxes that build and preview your pages | Your page code and content (which can include any personal data you put in the page), and store configuration for building (shop domain, product, and storefront access token for connected stores) | United States | SCCs (Module 3). Not certified under the EU-U.S. DPF |
| Langfuse (ClickHouse, Inc.) | Tracing and monitoring of AI requests, and prompt management | Trace metadata (Instaflow user and team IDs, shop domain, product and page IDs, token usage). For some steps also the prompt and output text: page titles, web research, and page planning and copy when your brief has no reference files. Code generation is traced without content | EU: Ireland (AWS eu-west-1), Langfuse EU cloud | Data stored in the EU. For any access from the US: EU-U.S. DPF (ClickHouse, Inc. is certified); SCCs as a fallback |
| Better Stack, Inc. | Error tracking, monitoring of the Instaflow app in the browser (including session replay) and AI pipeline logs | Server error reports. From the Better Stack script in the Instaflow app, only for users who accept it in the app's cookie banner: session replays of the app screen, which may show your Customer Content, plus browser errors, performance data, console logs, clicks and form submissions, and a browser fingerprint. Replays cover every session of users who accept, with text and form inputs masked. AI pipeline logs hold only IDs, status and timings, kept for 3 days | United States (us_west data region) | SCCs (Module 3) |
| Resend (Plus Five Five, Inc.) | Sending service emails from noreply@notifications.instaflow.ai | Email addresses and email content for service emails, including internal notices about Shopify privacy requests (shop and merchant contact details and deadlines). They never include Shopper data | United States (account data and logs in the US; sending through AWS us-east-1) | EU-U.S. DPF (certified); SCCs (Module 3) |
3. Shopify is not a subprocessor
3.1 Shopify (Shopify International Limited, Ireland, for merchants in the EEA) is not our subprocessor. It is an independent controller, and the e-commerce platform you use under your own agreement with Shopify.
3.2 This is why:
- You chose Shopify, not us. Your store, your Shoppers' accounts, orders, carts, checkout and payments live on Shopify under your contract with Shopify.
- Data comes from Shopify. We receive store, product and order data from Shopify through its APIs and webhooks because you installed the Instaflow app. We don't send Customer Personal Data to Shopify for Shopify to process for us.
- Shopify's own features on your pages. Your published pages run Shopify's cart and checkout, Shopify's privacy banner and consent cookies, and Shopify's own analytics events. Shopify provides these to you directly, as it does on your store. We don't receive that data, except what reaches us through the webhooks described in Annex 1 of the DPA.
- Shopify's rules apply to us. As a Shopify app developer we are bound by Shopify's API Terms. These limit how we use Shopify data, require us to delete it within 30 days of your uninstall or of a privacy request, and forbid using it to train or improve AI without your consent.
3.3 Questions about how Shopify handles data should go to Shopify, under its privacy policy and your agreement with it.
4. Other vendors that don't process Customer personal data on our behalf
We also use these vendors. They don't process Customer Personal Data for us, so they are not subprocessors. Where they handle personal data, our Privacy Policy covers it.
- Stripe (Stripe Payments Europe, Limited / Stripe, LLC): processes payments for direct subscriptions. It is an independent controller for payment data and receives only your billing details, not your Shoppers' or Visitors' data.
- Cloudflare (Cloudflare, Inc.): also hosts our marketing website at instaflow.ai (Cloudflare Workers). For the website, it handles data about visitors to our website, not your pages.
- Loops (Astrodon Corporation dba Loops): sends our product and onboarding emails to Instaflow app users, marketing emails to users who opted in, and receives messages sent through the contact form on our website. It handles Account Data and website contact data for our own purposes, not Customer Personal Data.
- Google (Google Ireland Limited / Google LLC): Google sign-in, where you choose "Continue with Google" (Google acts as the identity provider and an independent controller); Google Workspace for our own email and documents; and Google Fonts on our marketing website. Our page template doesn't load Google Fonts from Google.
- GitHub (GitHub, Inc.): hosts our source code. Production Customer Personal Data is not stored there.
5. Getting notified of changes
5.1 We will give at least 15 days' notice before a new subprocessor starts processing Customer Personal Data, or before we replace one. We do this in two ways:
- By email. We email the owner(s) of every Instaflow team. Anyone else can ask to receive these notices by emailing privacy@instaflow.ai with the subject "Subscribe to subprocessor updates".
- On this page. We update this list, change the "Last updated" date, and record the change in the change log below.
5.2 Each notice gives the subprocessor's name, what it will do, what data it will process, where, and the transfer mechanism.
5.3 You may object within 15 days of a notice by emailing privacy@instaflow.ai with your reasons. Section 9 of the DPA explains what happens next. If we can't resolve your objection, you may terminate the affected Services.
5.4 In an emergency (for example, a security or legal reason to replace a vendor quickly), we may give shorter notice. We will explain why, and your right to object still applies.
Change log
| Date | Change |
|---|---|
| 11 November 2026 | First publication of this list |
6. Contact
Questions about this list: privacy@instaflow.ai.