Sub-processors
FitMyType processes shopper and merchant data for merchants under a data processing agreement. These service providers (sub-processors) help us run the service. We announce every change here, and by email, at least 30 days before it takes effect.
Current sub-processors
| Vendor | What it does | Data it gets | Where data is processed | Transfer safeguard | Added |
|---|---|---|---|---|---|
| EU server hosting provider (to be confirmed: The provider's legal name and data-centre country are to be confirmed.) | Runs our servers: the API, the database, file storage and the back office. | All service data: shopper answers and body data (encrypted), events, product data and back-office accounts. | European Union | In the EU, no transfer | 2026-11-02 |
| EU backup storage provider (to be confirmed: The provider's legal name and data-centre country are to be confirmed.) | Keeps our encrypted nightly backups. | Backups of the database and files, encrypted on our servers before they leave (the provider cannot read them). | European Union | In the EU, no transfer | 2026-11-02 |
| Cloudflare, Inc. | DNS, content delivery and protection for our web addresses. | IP addresses and request details of traffic to our hosts while it passes through (no stored body data). | Global network; company in the United States | Outside the EU: Standard Contractual Clauses | 2026-11-02 |
| Resend, Inc. | Sends our emails: back-office invites, password resets, alerts and these change notices. | The recipient's email address and name, and the text of the email. No shopper data. | United States (moving to its EU region) | Outside the EU: Standard Contractual Clauses | 2026-11-02 |
Services the merchant controls
The widget can also send data to services that belong to the merchant. The merchant sets them up and is responsible for them: they are the merchant's own vendors, not FitMyType sub-processors.
- Klaviyo: The merchant's own Klaviyo account, called from the shop page. Only with analytics consent in the shop's cookie banner; body data only when the shopper also accepted marketing and the merchant turned profile sharing on.
- Mixpanel (EU): The merchant's own Mixpanel project, when the merchant asks us to forward widget events to it. Only when the merchant set it up with ops, and only events sent with analytics consent.
- Google Fonts: A font the merchant picked for the widget theme, loaded from Google. Only when the merchant's widget theme uses a Google font; the shopper's browser then asks Google for it.
Tools we run ourselves
- Bugsink (error tracking, through the Sentry SDK): Collects errors from our apps and the widget, on our own servers at errors.fitmytype.com. No data goes to the tool's maker.
Change log
No changes since the list was first published on 2026-11-02.
Get an email when this list changes
Each merchant's account owner gets these emails anyway. Anyone else can subscribe: we send a confirmation email first, and every change email has a one-click unsubscribe link. We use your address only for these emails and never show it anywhere.