Last updated: October 16, 2026
JPGStudios LLC uses the subprocessors below to provide Privacy Desk and process personal data on behalf of Shopify merchants. Capitalized terms not defined on this page have the meanings given in the Privacy Desk Data Processing Addendum.
Authorized subprocessors
| Subprocessor | Service and purpose | Personal data processed | Primary processing location |
|---|---|---|---|
| Salesforce, Inc. (Heroku) | Application hosting, managed PostgreSQL database, application logs, backups, and scheduled retention jobs | Merchant Personal Data described in the DPA, Shopify shop and session data, application configuration, case records, activity records, and operational logs | European Union region selected for the Privacy Desk application and database; limited support, security, account, or ancillary processing may occur as described in Heroku and Salesforce terms |
| Mailgun Technologies, Inc., a Sinch company | Transactional acknowledgment-email delivery and delivery-event webhooks | Recipient name and email address, transactional message content, request reference, message identifiers, delivery status, and related message metadata | European Union region for the configured sending domain; limited account and ancillary processing may occur as described in Mailgun and Sinch terms |
These providers may engage their own infrastructure providers and subprocessors under their applicable agreements. Current provider documentation is available from Heroku and Mailgun.
Shopify
Shopify provides the commerce platform, app authentication, app proxy, and mandatory privacy-compliance webhook infrastructure under its direct agreement with each merchant. Shopify is the merchant’s platform provider and is not listed as a subprocessor appointed by JPGStudios LLC under the Privacy Desk DPA.
Changes to this list
JPGStudios LLC may update this list when a provider is added, replaced, or its role materially changes. We will provide merchants reasonable advance notice of a new subprocessor that will process Merchant Personal Data as described in the DPA.
A merchant may object to a new subprocessor on reasonable data-protection grounds by emailing privacy@jpgstudios.us within 15 days after notice. The parties will work in good faith to address the objection in accordance with the DPA.
Contact
Questions about subprocessors or data processing can be sent to:
JPGStudios LLC
201 Mountain Rest Road
New Paltz, NY 12561
United States
Email: privacy@jpgstudios.us