Legal
Subprocessors
Snagr uses 8 third-party services to run the product. Each one is bound by a written agreement that limits it to our instructions and holds it to protections at least as strict as those in our own DPA.
Last updated 22 September 2026
Current subprocessors
| Subprocessor | What it does | Data it can access | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge network, and serverless compute. | Request traffic in transit, and ephemeral function logs. No customer database. | United States |
| PlanetScale, Inc. | Primary PostgreSQL database. | Merchant account records, connected-store data, checkout and order records, recovery email records. | United States |
| Upstash, Inc. | Redis cache and QStash scheduled-job queue that times email sends. | Job payloads containing recipient identifiers and sequence state; short-lived cache entries. | United States |
| Resend (Plus Five Five, Inc.) | Transactional and recovery email delivery, plus delivery/engagement webhooks. | Recipient email address, name, message subject and body, delivery and engagement events. | United States |
| Polar Software Inc. | Source of connected-store data, and Merchant of Record for Snagr's own subscription billing. | Store, product, checkout, order, subscription and customer records read from the merchant's own Polar organisation; Snagr's own billing details. | United States |
| PostHog, Inc. | Product analytics for the Snagr dashboard and marketing site. | Merchant account email as identifier, page views, feature-usage events. Session recording, surveys and dead-click capture are disabled in our client configuration. | United States (PostHog US Cloud) |
| UploadThing (Ping Labs, Inc.) | Storage for brand logos uploaded by merchants. | Uploaded image files and their metadata. | United States |
| Google LLC | Optional Google sign-in (OAuth) for merchant accounts. | Email address, name and profile image released by the merchant's Google account at sign-in. | United States |
1. Notice of changes
We update this page before a new subprocessor starts handling personal data. If you have an account, you can ask to be told in advance: email tejas@snagr.sh with the subject subprocessor notifications and we will add you to the list. We will give at least 30 days notice.
If you object to a new subprocessor on reasonable data-protection grounds, tell us within those 30 days. If we cannot offer a workable alternative you may terminate the affected part of the service and receive a pro-rata refund of any prepaid fees, as set out in the DPA.
2. What is not on this list
Polar appears above in two distinct roles, and it is worth separating them. As the source of your store data it acts as a subprocessor. As Merchant of Record for your Snagr subscription it is an independent controller of your billing relationship, and its own privacy policy governs that.
Ordinary business tools that never touch customer data — accounting software, our own email inbox, source control — are not listed, since they process no personal data belonging to your customers.