Paidback uses the third-party services below to operate. Each one is bound by a written data processing agreement with obligations no less protective than those we owe you under our Data Processing Addendum.
We give at least 30 days' notice before adding or replacing any subprocessor that processes customer personal data. Notice goes to the email address on your Shopify account. To be notified of changes, no action is required — you are already on the list.
| Subprocessor | Purpose | Data received | Region |
|---|---|---|---|
| Railway Corp. | Application hosting and compute | All data processed by the application in transit through the runtime | United States |
| Neon, Inc. | Managed PostgreSQL database | All stored merchant, dispute, and customer data | United States |
| Cloudflare, Inc. | DNS, CDN, TLS termination, bot protection, cookieless web analytics | Traffic metadata and IP addresses | Global edge network |
| Subprocessor | Purpose | Data received | Region |
|---|---|---|---|
| Anthropic, PBC | AI generation of dispute rebuttal evidence | Customer name, billing and shipping address, order contents and amounts, fulfillment and tracking data, IP address, dispute reason code | United States |
| EasyPost, Inc. | Shipment tracking and delivery confirmation | Tracking numbers, carrier, delivery status, destination address | United States |
| MaxMind, Inc. | IP geolocation for evidence corroboration | IP addresses associated with disputed orders | United States |
Anthropic does not use data submitted through its API to train its models.
| Subprocessor | Purpose | Data received | Region |
|---|---|---|---|
| Postmark (ActiveCampaign, LLC) | Transactional email to merchants | Merchant name and email address, dispute notification content | United States |
We send email to you. We do not send email to your customers.
| Subprocessor | Purpose | Data received | Region |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Application error and performance monitoring | Error diagnostics and dispute or shop identifiers. Filtered to exclude customer personal data. | United States |
We also use internal alerting channels to monitor service activity. These receive shop domains and aggregate counts only — no customer or merchant personal data — and are therefore not listed as subprocessors.
| Subprocessor | Purpose | Data received | Region |
|---|---|---|---|
| Shopify Inc. | Source platform, app distribution, and billing | Order, customer, fulfillment, and dispute data; billing records | Canada / United States |
Shopify is the source of the data we process and the channel through which fees are billed. Your relationship with Shopify is governed by Shopify's own terms and privacy policy.
| Date | Change |
|---|---|
| 2026-08-24 | Initial publication of standalone subprocessor list, including Railway, Neon, Cloudflare, and Sentry |
Questions about any subprocessor: support@paidback.io
Paidback Technologies, LLC · Delaware, United States