Subprocessors
Version 1.1, effective September 16, 2026
The companies that process data for Katching, what each one does, what it receives, where it operates, and how a change to this list is announced.
The companies we use
Each company below processes data for Katching, on our instructions, for the role described. Nobody else receives the data of your store or of your customers, except when the law requires it.
- Cloudflare, United States. Serves the Katching site and the storefronts of the stores, resolves their domain names, and carries through encrypted tunnels the traffic of each store to its backend and of the Katching site to its database. Receives: the traffic of the site and of the stores.
- Google Cloud, United States. Runs the backend, the database and the cache of each store, and the database of the Katching site, on Google Kubernetes Engine and Cloud SQL, and keeps their secrets in Secret Manager. Receives: everything a store holds, and the data of your Katching account.
- Stripe, United States. Bills your Katching subscription, and, when you connect a Stripe account or activate Katching Payments, processes the payments of your store. Receives: your billing identity, and the payment data of your customers.
- PayPal, United States. When you connect a PayPal account, processes the payments of your store. Receives: the payment data of your customers.
- TagadaPay, United States. When you connect a TagadaPay account, processes the payments of your store. Receives: the payment data of your customers.
- Resend, United States. Sends the emails of the Katching platform, and the emails of your store when its sending key is set, and receives the mail sent to our published addresses. Receives: email addresses, and the content of those messages.
- Google, United States. Signs you in when you choose to sign in with Google. Receives: the identifier of your Google account and your email address.
- Porkbun, United States. Registers the domain name you buy through Katching. Receives: the registration contact details the registry requires.
- Anthropic, United States. The only model provider the engines call, to draft replies and reports, to read images, and to extract facts from free text. Receives: the text needed for that work, which is the message of a customer and the facts of the order it concerns.
- Sentry, United States. Receives the error reports of the backend of a store when its error reporting is enabled. Receives: stack traces and the context of a request.
- PostHog, United States. Product analytics for the administration of a store, when it is enabled for that store. Receives: the events of that store.
- Twilio, United States. Sends the SMS messages that the engines of a store send to its customers. Receives: the phone number of a customer and the content of the message.
- Meta, United States. When you connect a Meta dataset to your store, receives its purchase events, to measure your ads. Receives: the order, and the contact details, IP address and browser identification of the customer it concerns, the contact details hashed before they leave the store.
- ntfy, United States. Delivers the operational notifications of a store, such as a new order, to the people who operate it, when they are enabled for that store. Receives: the content of the notification, which can include the amount of an order and the email address of a customer.
- GitHub and its container registry, United States. Hosts the source code of Katching and its build images. Receives: no data of a merchant and no data of a customer.
Model providers
Anthropic is the only model provider that the product calls. A model provider can be added only after it appears on this page, with thirty days of notice before it receives anything. What is sent to a model, and what a model is never allowed to decide, are in the AI policy.
Changes to this list
Katching tells you thirty days before it adds a subprocessor, by email to the address of your account and by a banner in your dashboard. If you do not accept the addition, you can close your store before it takes effect at no cost.
- September 16, 2026. Replaced: Railway by Google Cloud, as the host of the backend, the database and the cache of each store. Added to the published list, where the product already calls them when a store enables them: TagadaPay, Meta, ntfy. Cloudflare no longer stores files for the stores, and now carries their traffic to their backends.
- September 5, 2026. Added to the published list, where they were already in use: PostHog, Twilio, GitHub and its container registry. Removed: DeepSeek, which the product does not call, and with it the transfer to China that the previous list described.
- September 2, 2026. First publication of the list, inside the data processing document.
Version history
- Version 1.1, effective September 16, 2026Google Cloud replaces the previous host of each store, and TagadaPay, Meta and ntfy join the list.
- Version 1.0, effective September 5, 2026First publication as its own page.