Legal

Subprocessors

Third-party service providers TagTier engages to help deliver the service. Required disclosure under our Data Processing Addendum.

Last updated:

We engage a small number of third-party service providers ("Subprocessors") to help us deliver the TagTier service. Per our Data Processing Addendum, we require all Subprocessors to meet the same data-protection standards we follow internally.

Current Subprocessors

SubprocessorRoleData residency
Shopify Inc. App platform, Admin API, App Proxy, Billing API. Receives the same merchant + order data Shopify already holds for your store; TagTier's calls to Shopify run inside their infrastructure. Canada / global
IONOS Cloud VPS hosting for the TagTier backend, frontend, and database. All operational data (rules, audit log, customer/product references) is stored here. United States
Google LLC (Google Tag Manager + Google Analytics 4) Tag manager + anonymous site analytics for the marketing pages at tagtier.com (container GTM-NXX7J3NV). Opt-in only via the cookie banner; never receives merchant or in-app data. Consent Mode v2 gates all tags. United States / global
Microsoft Corporation (Clarity) Aggregate session-recording and heatmaps for the marketing pages at tagtier.com. Opt-in only; sensitive form fields are masked at capture; never used inside the in-app admin. United States / global
[Email provider — TBD] Transactional email (install confirmation, billing receipts, security notices). To be confirmed once the production sender is selected. [TBD]

Not on this list: our self-hosted Grafana instance for infrastructure monitoring. It runs on the same IONOS VPS as the application (no third party involved) and processes only first-party server logs, not merchant content.

Notification of changes

We post additions or replacements to this list at least 15 days before the change takes effect. Customers on a paid plan also receive an email notice.

To object to a new Subprocessor, contact privacy@tagtier.com.

Note: Google Analytics 4 and Microsoft Clarity are listed because they are scheduled for the marketing site. Both will load only after a visitor accepts cookies via the banner. Neither will run inside the Shopify admin app.