Sub-processors
Last updated: 26 October 2026
flareOps (operated by its founder, Israel) uses the service providers below to run the service. When they process store data on our behalf, they are our sub-processors under the Data Processing Agreement. Each one is bound by data processing terms that protect the data at least as well as our DPA.
We send AI providers only product data and shopping questions, never shopper data and never data we receive from Google APIs. We use AI providers through their paid APIs, not their consumer apps.
Current sub-processors
| Entity | Country | Purpose | Data | Transfer basis |
|---|---|---|---|---|
| Cloudflare, Inc. | USA (global network) | Hosting of the flareOps app and API; database (D1); file storage (R2); queues; email routing | All data the service holds: store and product data, bot request logs including IP addresses, pseudonymised order references, encrypted tokens and secrets, account data, support emails in transit | EU-US Data Privacy Framework; Standard Contractual Clauses in Cloudflare's data processing terms |
| Google LLC | USA | Merchant API (product listings in the merchant's own Merchant Center account, via the merchant's own Google authorisation); Search Console API (read-only search data); Site Verification API; Google Cloud Run in us-central1 (a relay for Bing requests, which stores no store data); Gmail (support email) | Product data and store settings sent to Merchant Center, and product status read back; the store's site address and its search data; Bing requests in transit; support emails | EU-US Data Privacy Framework; Standard Contractual Clauses in Google's data processing terms |
| Microsoft Corporation | USA | Bing Webmaster API (read-only search data); IndexNow (notifying search engines of changed pages) | The store's site address and its search data; addresses of changed pages. URLs submitted to IndexNow are shared with the search engines that take part in IndexNow. | EU-US Data Privacy Framework; Standard Contractual Clauses in Microsoft's data processing terms |
| Anthropic PBC | USA | AI suggestions for product names, brands, descriptions and FAQs; generating the list of shopping questions for the weekly check | Product data (such as titles, descriptions, brands, categories and attributes) and the store's country and language | Standard Contractual Clauses in Anthropic's data processing terms |
| OpenAI, L.L.C. | USA | Weekly shopping-question check (asking ChatGPT shopping questions and reading which products and brands it mentions) | Shopping questions, which may include product categories, brand names and the country | Standard Contractual Clauses in OpenAI's data processing terms |
| Perplexity AI, Inc. | USA | Weekly shopping-question check (asking Perplexity shopping questions and reading which products and brands it mentions) | Shopping questions, which may include product categories, brand names and the country | Standard Contractual Clauses in Perplexity's data processing terms |
How transfers are protected
- flareOps is operated from Israel. Transfers from the EU and the UK to Israel rely on the adequacy decisions for Israel (EU Decision 2011/61/EU, reaffirmed on 15 January 2024, and the UK's adequacy regulations).
- Onward transfers to providers in the United States rely on the EU-US Data Privacy Framework (and its UK Extension) where the provider is certified, and otherwise on the Standard Contractual Clauses (with the UK Addendum) in that provider's data processing terms.
- Transfers out of Israel also meet the Israeli transfer regulations, through written commitments in each provider's terms to protect the data and limit onward transfers.
Changes to this list
We give at least 30 days' notice before we add or replace a sub-processor. We update this page and email the store owners of connected stores. If you object on reasonable data protection grounds, tell us within the notice period and we will try to find a solution. If we cannot, you may stop using the affected part of the service or end your use of flareOps, and we will delete your store's data as set out in the DPA.
Get updates
Anyone can subscribe to notices of changes, for example your privacy team: email hello@flareops.ai with the subject "Sub-processor updates".