Legal · Version 2026-10 · Updated 25 October 2026

Sub-processors

The companies that help TryYourSize run the service, where they process data, and how transfers are protected.

Draft

Draft — requires review by counsel before publication. Written by an AI assistant, not a lawyer. Every "For counsel" note marks a point that needs legal judgement.

TryYourSize stores and processes data in the European Union. These companies process personal data for us. For brands, this page is Annex III of the Data Processing Agreement: we announce changes here and by email to organization owners at least 30 days before they apply.

Transfer shows whether data may leave the EEA (for example through access by the vendor's support staff in another country) and what protects it. SCCs are the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914); DPF is the EU-US Data Privacy Framework.

Sub-processor	Purpose	Data	Location	Transfer
Google Cloud (Google Cloud EMEA Ltd, Ireland)	Hosting: application servers, database, file storage, backups, logs, secrets	All service data, including shopper accounts and bodies	`europe-west1`, Belgium (EU)	Stored in the EU. Possible access by Google affiliates for support and security: Google Cloud Data Processing Addendum with SCCs; Google LLC is DPF-certified
Temporal Technologies, Inc. (USA)	Temporal Cloud: runs background jobs (body fitting, simulations, imports, scheduled clean-ups)	Job inputs and results (which can include measurements while a job runs), encrypted by us before they are sent (AES-256-GCM, keys held only by TryYourSize), so Temporal stores only ciphertext; kept 30 days	`gcp-europe-west3`, Frankfurt (EU)	Stored in the EU. US company: SCCs in Temporal's DPA [confirm DPF status]
Resend, Inc. (USA)	Sends emails: sign-in codes, export links, notifications	Email address, email content, delivery events	[Sending region to confirm: EU (Ireland) or US]	SCCs in Resend's DPA [confirm DPF status]
WorkOS, Inc. (USA)	Sign-in, single sign-on and directory sync for brand users (Studio)	Brand users' name, email, sign-in events, IP address. No shopper data	USA	DPF [confirm] and SCCs in WorkOS's DPA
Stripe Payments Europe, Ltd. (Ireland)	Billing of brands: subscriptions, invoices, payment methods	Billing contact, company and VAT details, payment data (held by Stripe)	EU, with processing by Stripe, Inc. (USA)	DPF and SCCs in Stripe's DPA. Stripe is an independent controller for payment processing and fraud prevention
Shopify (Shopify International Ltd., Ireland; Shopify Inc., Canada)	For brands that install through the Shopify App Store: installation, store data sync, billing through Shopify Billing, privacy webhooks	Store and product data; billing data for those brands; customer-redaction requests (no customer data is kept by us)	Canada, EU, USA	Canada: adequacy decision. USA: SCCs / DPF under Shopify's terms. Shopify acts mainly as an independent controller under its Partner terms
PostHog, Inc. (USA)	Product analytics and error tracking. In browsers (tryyoursize.com and Studio only) both run only after consent; our servers send error reports with personal data scrubbed, and aggregated shopper service statistics with no identifier (a new random ID per event, no IP, no person profiles)	Pseudonymous usage events, device and browser data; technical error data (message, stack trace, service, release), scrubbed of emails, keys, tokens and codes. Never body or measurement data	EU Cloud, Frankfurt (EU)	Stored in the EU. US company: SCCs in PostHog's DPA [confirm DPF status]
Cloudflare, Inc. (USA)	DNS for tryyoursize.com; forwarding of email sent to @tryyoursize.com addresses	DNS queries; content of emails sent to us (for example privacy requests)	Global network	DPF and SCCs in Cloudflare's DPA

For counsel: For each vendor confirm at the time of publication: the contracting entity, the signed DPA, DPF certification, SCC module (Module 3 when we act as processor; Module 2 when we act as controller, e.g. shopper accounts), and whether a transfer impact assessment is needed. Technical points: (1) Temporal job inputs and results are encrypted with a payload codec before they leave our services (doc 25), so Temporal Cloud holds only ciphertext; confirm this is enough to treat the Temporal transfer as low risk; (2) error tracking: errors are also written to our own server logs (Google Cloud Error Reporting, covered by Google Cloud above); PostHog receives them only as listed; (3) email to privacy@ is forwarded by Cloudflare to a single inbox, which must be a business mailbox covered by a DPA (not a consumer account), and that mailbox provider must be listed here.

Not sub-processors

Brands and retailers are not our sub-processors. When you use TryYourSize on a store, that store receives your size, never your measurements.
Fonts are served from our own servers. We do not load Google Fonts from Google.