Sub-processors

Version 1.2 — 09/16/2026

This page lists the sub-processors authorized to process Customer Data and End Customer Data in the delivery of the Maestra Services, as referenced in Exhibit C (Information Security and Data Processing Policy) to the Software as a Service Agreement, §8 and §10.3, the Data Processing Agreement (https://maestra.io/legal/dpa, Annex IV), and the Shopify App Privacy Policy and Terms of Service.

Maestra operates through two contracting entities: Maestra.io LLC (Delaware, United States) for customers on the US Software as a Service Agreement, and Maestra B.V. (the Netherlands) for customers on the EU Software as a Service Agreement. Where personal data originating under the EU/UK agreements is transferred outside the EEA or the UK, the transfer is carried out under the safeguards set out in the Data Processing Agreement (Annex IV) and described in Maestra's privacy policies: Standard Contractual Clauses or, where a sub-processor is covered by one, an adequacy decision (such as the EU–US Data Privacy Framework).

Hosting and infrastructure

¹ Engaged during the 2026 hosting transition described in Exhibit C §8; hosting consolidates to the United States providers upon its completion.

² For customers whose Agreement was in force before version 1.0 of this page, the providers added since the list agreed under their Agreement were notified under the sub-processor provisions of the Data Processing Agreement then in force; from 10/23/2026 the Data Processing Agreement version 2.0 (Clause 20) governs every customer's notice and objection rights.

³ Each Maestra entity is a sub-processor for customers contracting with the other Maestra entity, as set out in the Data Processing Agreement (Annex IV, item 2); for its own customers it is the contracting entity, not a sub-processor.

Service delivery

Destinations you connect are not Maestra sub-processors. Where you configure the Services to send data to third parties — advertising platforms, webhook endpoints, third-party AI agents, or other integrations — those recipients act on your instructions under your own arrangements with them.

Corporate service providers that process Maestra's own business data (account, billing, and contact information — for example, accounting, CRM, and e-signature tools) are listed in the US Privacy Policy and the EU Personal Data Policy.

Updates to this list

Maestra updates this page when sub-processors are added, replaced, or removed. An addition or replacement is notified to every customer at least thirty (30) calendar days before it takes effect — by email to the address for legal notices in the customer's Order Form and to any additional address the customer registers by email to dpo@maestra.io or, where available, through the form on this page — and is published here with the date on which it takes effect; a customer may object as set out in Clause 20 of the Data Processing Agreement. Removals and corrections to a listed provider's location or purpose are published here without a notice period. Each change increments the version number, and prior versions remain available at the archive link below.

Notices of changes to this list — to register additional addresses for these notices, write to dpo@maestra.io.

Change log — Version 1.2: Maestra B.V. added; OpenAI, L.L.C. and Anthropic, PBC added; Cloudflare, Inc. purpose extended to database backups; Amazon Web Services, Inc. removed (Amazon Web Services EMEA SARL remains for the hosting transition); Data Act information added. Published on 09/16/2026; customers with Agreements in force before that date are notified by email; effective on 10/23/2026 for those Agreements and from their Effective Date for Agreements concluded on or after 09/16/2026.

Data Act information (Regulation (EU) 2023/2854, Article 28). The ICT infrastructure used for the Services is subject to the jurisdiction of the United States (the hosting providers listed above) and, during the 2026 hosting transition, of Germany and Luxembourg. To prevent international governmental access to, or transfer of, non-personal data held in the Union where such access or transfer would conflict with Union law or the law of a Member State, Maestra maintains internal policies under which it does not disclose such data to a public authority of a third country except on a binding legal request enforceable under applicable law, reviews such requests against Union and Member State law and challenges those that conflict with it, and informs the customer of a request where legally permitted. The information on switching and porting, and the register of the data structures and formats in which exportable data are available, is published in the Documentation.

Prior versions: Version 1.0, in force until 07/29/2026

Version 1.1, published until 09/16/2026 (for Agreements in effect before that date, in force until 10/23/2026)

Questions: dpo@maestra.io