Subprocessors
Last updated
On this page
While Pleezpay delivers the service, the outside vendors listed here process personal data for its customers. Each one works under a written agreement with data protection terms and uses the data for the stated job and nothing else.
The vendors on the list
Each vendor here runs underneath the platform and is shared by every customer. Code hosting, build tooling and anything else that never handles customer personal data are left off.
| Vendor | What it does for us | Personal data it handles | Where |
|---|---|---|---|
| Railway | Runs our servers: the merchant dashboard, the hosted payment page, the developer docs, this site, and the platform API with its background workers. Also supplies the managed PostgreSQL databases, and the S3-compatible object storage behind our internal file library. | Everything the service stores: merchant accounts and their users, payment sessions and payments, records of webhooks, audits and support, and what applicants send us. | Whichever Railway regions the Pleezpay project is set to use. The internal file store sits in the Amsterdam region (EU West). |
| Cloudflare | Puts our site and APIs on the internet: DNS, TLS, content delivery, and a proxy in front of our hosts for web and API traffic. Also handles email routing on pleezpay.com. | Traffic crossing its network, including what that traffic contains, IP addresses, and metadata about each request and connection. Mail sent to any pleezpay.com address. | Edge network, worldwide. |
| Proton | Our business email, including the address given at the foot of this page. | Emails, and their attachments, exchanged with vendors, partners, payers and customers. | Switzerland: Proton AG has its seat in Geneva and is subject to Swiss law. |
| Resend | Sends our transactional email: alerts when someone applies or sends an enquiry through the website, confirmations of subscriptions, decisions on applications, account invitations and password emails. | Each recipient’s name and email address, any order or application reference, and what the message says. | European Union: we send through Resend’s EU region, in Ireland. |
Website analytics, only if you agree
This website’s marketing pages can run Google Analytics and Google Tag Manager (Google). Neither starts until you say yes to analytics, and neither ever loads on the hosted payment page. Once you accept, Google receives the pages you open and what you do on them, details of your browser and device, online identifiers, and a rough location derived from your IP address. The Cookie notice has the detail.
Payment providers
Pleezpay sits between a merchant’s checkout and the payment providers connected to it. The providers do the processing, acquiring, safeguarding and settling of payments, under their own terms, their own regulatory permissions and their own decisions about which merchants to take on.
Publicly, we name Airwallex, Mollie, PayPal, Stripe, Viva.com and Ziina. A customer’s configuration and agreement decide which of them handle its payments. If other acquirers or payment service providers carry a customer’s traffic, that customer’s agreement names them.
What a provider receives for each payment:
- the amount and the order reference;
- whatever payer details processing and screening the payment require, for example IP address, browser details, name, email address, billing address and phone number;
- the card details, when the card is typed into the hosted payment page. If the provider puts its own card fields on that page, the card number is typed into those fields and goes straight to the provider.
For how the pieces connect, see the Product page.
Your store platform
A merchant’s store software, WooCommerce for example, sends us order details when the merchant tells it to, and gets the order and payment status in return. Our WooCommerce plugin passes on the order reference, the amounts and items, and the shopper’s billing and shipping addresses, email address, phone number and name. The merchant picks, sets up and controls that software, so it is not one of our subprocessors; the merchant’s contracts with those platforms govern it instead.
Data that crosses borders
Pleezpay is a US company, and some of the vendors above process data in the US or elsewhere. Personal data about people in the EU, the UK or Switzerland moves under standard contractual clauses, or under another recognised mechanism for transfers, as our Data Processing Agreement explains.
Hearing about changes
When a vendor is added to this list or replaced, we update the page. If you have signed our Data Processing Agreement, we also tell you through the channel, and inside the period, that agreement fixes.
Anyone else who wants to be told about changes, or has a question about a vendor here, can email [email protected] with the subject “Subprocessor notice”. The Security page and the Privacy notice are worth reading alongside this one.
Questions about this page go to [email protected].