We engage a small number of third-party service providers ("Subprocessors") to help us deliver the TagTier service. Per our Data Processing Addendum, we require all Subprocessors to meet the same data-protection standards we follow internally.
Current Subprocessors
| Subprocessor | Role | Data residency |
|---|---|---|
| Shopify Inc. | App platform, Admin API, App Proxy, Billing API. Receives the same merchant + order data Shopify already holds for your store; TagTier's calls to Shopify run inside their infrastructure. | Canada / global |
| IONOS Cloud | VPS hosting for the TagTier backend, frontend, and database. All operational data (rules, audit log, customer/product references) is stored here. | United States |
| Google LLC (Google Tag Manager + Google Analytics 4) | Tag manager + anonymous site analytics for the marketing pages at tagtier.com (container GTM-NXX7J3NV). Opt-in only via the cookie banner; never receives merchant or in-app data. Consent Mode v2 gates all tags. |
United States / global |
| Microsoft Corporation (Clarity) | Aggregate session-recording and heatmaps for the marketing pages at tagtier.com. Opt-in only; sensitive form fields are masked at capture; never used inside the in-app admin. | United States / global |
| [Email provider — TBD] | Transactional email (install confirmation, billing receipts, security notices). To be confirmed once the production sender is selected. | [TBD] |
Not on this list: our self-hosted Grafana instance for infrastructure monitoring. It runs on the same IONOS VPS as the application (no third party involved) and processes only first-party server logs, not merchant content.
Notification of changes
We post additions or replacements to this list at least 15 days before the change takes effect. Customers on a paid plan also receive an email notice.
To object to a new Subprocessor, contact privacy@tagtier.com.