This page lists the third-party service providers ("Sub-processors") that Particle Storm LLC engages to deliver the ShiftOS Services. It is referenced by our Privacy Policy and by the Data Processing Addendum (DPA) we enter into with our Customers.
For background on how Particle Storm processes personal information generally, see the ShiftOS Privacy Policy.
In this page, the following capitalised terms apply:
A vendor that does not process personal data is not a Sub-processor. For transparency we list a small number of such vendors separately in Section 4 below.
The following Sub-processors process Customer Personal Data in connection with the ShiftOS Services as of the "Last updated" date above.
| Sub-processor | Service provided | Categories of Customer Personal Data | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Stripe, Inc.DPA | Payment processing for End User transactions routed to the Customer's account; SaaS fee invoicing to the Customer. | Names, email addresses, billing addresses, payment method metadata (transaction IDs, card brand, last-4). Full card data is held by Stripe and never reaches Particle Storm. | United States | EU SCCs + UK Addendum; EU-US Data Privacy Framework (DPF) |
| Vercel Inc.DPA | Application hosting, edge network, and request logging for the ShiftOS and ShiftOps applications. | All Customer Personal Data transiting the application, including names, email addresses, IP addresses, booking and session data, and HTTP request logs. | United States (global edge) | EU SCCs + UK Addendum |
| Salesforce, Inc.(Heroku) · DPA | Hosting for the shiftos.app marketing website. | Website visitor server logs (IP address, user agent, request timestamps); contact form submissions (name, email, message content) from prospective Customers. | United States | EU SCCs + UK Addendum; EU-US Data Privacy Framework (DPF) |
| Vercel Blob Storage(Vercel Inc.), see DPA above | File storage for assets uploaded by Customers or generated by the platform (contracts, signed agreements, branding assets, exported reports). | Whatever the Customer uploads. May include names, signatures, and contract content. | United States | EU SCCs + UK Addendum |
| Amazon Web Services, Inc.(Amazon S3) · DPA | Object storage for database backups, system file exports, and platform assets. | Encrypted database backups and exported reports may contain any Customer Personal Data stored in our primary database. | United States | EU SCCs + UK Addendum; EU-US Data Privacy Framework (DPF) |
| Neon, Inc.DPA | Managed PostgreSQL database hosting all persistent Customer Personal Data for ShiftOS and ShiftOps. | The full database, including End User accounts, bookings, memberships, leaderboards, sessions, payment metadata, and Customer staff account data. (Neon runs on Amazon Web Services infrastructure.) | United States (AWS regions) | EU SCCs + UK Addendum |
| Twilio Inc.DPA | Transactional SMS messaging sent on the Customer's behalf to End Users (e.g., booking reminders, race notifications). | Recipient mobile phone number; message content. | United States | EU SCCs + UK Addendum; EU-US Data Privacy Framework (DPF) |
| Twilio SendGrid(Twilio Inc.), see DPA above | Transactional email sent on the Customer's behalf to End Users (e.g., booking confirmations, receipts, password resets, membership notifications). | Recipient email address; message content (including names and booking details). | United States | EU SCCs + UK Addendum; EU-US Data Privacy Framework (DPF) |
| Resend, Inc.DPA | Transactional email sent to Customer staff via the ShiftOps control plane (e.g., admin notifications, approval requests, system alerts). | Customer staff email addresses; notification content. | United States | EU SCCs + UK Addendum |
| HighLevel Inc.d/b/a GoHighLevel · DPA | CRM and customer engagement platform. Engaged only for Customers who have enabled the "Engage" tier and elected to sync contact data to GHL. | End User contact data (name, email, phone) and engagement metadata for participating Customers only. | United States | EU SCCs + UK Addendum |
| Anthropic, PBCDPA | AI text generation used to produce event marketing content (event descriptions, leaderboard recaps), knowledge-base articles, and training materials. | Event metadata; leaderboard data, including End User racer names, standings, and lap times where included in content prompts. Outputs are reviewed by Customer staff before publication. | United States | EU SCCs + UK Addendum; Anthropic Zero Data Retention (ZDR) policy applies. Prompts and outputs are not retained for model training. |
| Hostinger International Ltd.DPA | Virtual private server hosting for our self-managed n8n workflow automation instance, which executes background integrations (e.g., reservation sync, CRM sync, daily reports). | Workflows process Customer Personal Data in transit, typically End User names, email addresses, phone numbers, booking metadata, and revenue records. Data is processed transiently and is not persistently stored on the n8n instance. | European Union (Lithuania) | N/A for EU/UK Customers (intra-EEA); EU SCCs apply for non-EU Customer data routed to the instance |
The following providers support our operations but do not process Customer Personal Data. They are not Sub-processors. We list them here for transparency only:
| Provider | Purpose | Why it is not a Sub-processor |
|---|---|---|
| Doppler, Inc. | Secrets management. Stores API tokens, database connection strings, and environment variables used by ShiftOS and ShiftOps. | Stores secrets only. No personal data of any natural person is sent to or stored by Doppler. |
| GitHub, Inc. | Source code hosting and version control for the ShiftOS and ShiftOps codebases. | Stores source code only. Customer Personal Data is not stored in our repositories or issue tracker. |
| Square, Inc. | In-store point-of-sale used by some Customers for walk-in payments. ShiftOS reads back aggregated revenue totals (no individual transactions) for reporting. | The Customer's relationship with Square for processing cardholder data is direct and governed by the Customer's own agreement with Square. ShiftOS only receives aggregated revenue figures, which are not personal data. |
Particle Storm is a United States company, and most of our Sub-processors are also located in the United States. Personal data processed in the United States may be subject to US laws, including laws that permit US government authorities to access information held by US companies through lawful access requests (such as the CLOUD Act).
For transfers of personal data subject to the GDPR or UK GDPR from the European Economic Area, the United Kingdom, or Switzerland to Particle Storm (or onward to a US-based Sub-processor), the following transfer mechanisms apply:
Customers may request a copy of Particle Storm's executed transfer instruments by contacting privacy@shiftarcade.com.
For transfers of personal information of Canadian individuals, see Section 11 (Canadian users, PIPEDA) of the ShiftOS Privacy Policy, which addresses our obligations under PIPEDA and provincial privacy legislation including Quebec's Law 25.
Particle Storm does not "sell" or "share" personal information as those terms are defined under the California Consumer Privacy Act (CCPA) as amended by the CPRA. Personal information disclosed to the Sub-processors listed above is disclosed for the limited purposes set out in this page, under contractual restrictions consistent with the CCPA's definition of a "service provider".
We provide our Customers with at least 30 days' prior written notice before engaging a new Sub-processor that will process Customer Personal Data, or replacing an existing Sub-processor with one whose role would materially differ.
To receive Sub-processor change notifications by email, send a request to privacy@shiftarcade.com with the subject line "Subscribe to Sub-processor notifications" and the email address(es) you would like to register. We will add you to our notification list and confirm by reply.
If a Customer reasonably objects to a new Sub-processor on the grounds of data protection concerns within 30 days of receiving notice, the Customer should contact us at privacy@shiftarcade.com to describe the concern. We will work in good faith to address it. If we cannot reach a mutually acceptable resolution, the Customer may, as its sole remedy, terminate the affected portion of the ShiftOS Services without penalty by providing written notice during the objection period, in accordance with the terms of the applicable Order Form.
For questions about this Sub-processors page, to subscribe to change notifications, or to raise an objection:
Particle Storm LLC
Attn: Privacy Officer
1603 Capitol Ave, Suite 415 #698478
Cheyenne, WY 82001 USA
Email: privacy@shiftarcade.com