The companies that handle data for Actorly, what each one does, what it receives and where. The list is public, so you do not need to ask for it.
Effective 2026-10-13. The same list is in the data processing agreement, the privacy policy and the security page. If they ever differ, this page is the one we update first.
Updated 2026-10-15 to add Cloudflare Web Analytics.
Updated 2026-10-16 to add GitHub, Inc., which runs the daily job that copies install, uninstall and subscription records from Shopify's Partner API.
Updated 2026-10-16 to add Anthropic, PBC, and to say which AI models write and translate our own public content.
1.1A subprocessor is a company that ONDUTYOPS LLC engages to help run Actorly and that handles data to do it. Each one works under a written agreement that asks it to protect the data to a standard no lower than the data processing agreement sets.
1.2Shopify is the platform Actorly runs inside and the source of the data. It is not our subprocessor. A webhook address a merchant chooses for alerts is the merchant's own and is not a subprocessor either.
Back to contents| Company | What it does for Actorly | What it receives | Where | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosts Actorly and stores its data: the app, each store's change history, saved copies of what Shopify sent, and Actorly's account records. Also serves this website. Also, only if a visitor allows analytics in the cookie banner, counts page views and page speed on this website with Cloudflare Web Analytics, without a cookie. | Everything described in the data table of the privacy policy. | Cloudflare's global network. Actorly does not restrict its data to a country or region. | EU Standard Contractual Clauses, incorporated into Cloudflare's own customer-facing addendum |
| PostHog | Counts product events about Actorly itself, for example that a plan was chosen. Not in use today: used only if product analytics is switched on, with notice first. | Nothing today. If switched on: the store's myshopify.com domain, the plan name and billing period, counts and durations. No customer data and no store content. | United States, by default, if switched on | EU Standard Contractual Clauses (Module Two) and the UK Addendum, in PostHog's data processing addendum |
| Slack | Delivers operational notices to Actorly's own team workspace, so the team sees when an install or an import needs attention. | The store's myshopify.com domain and a short status. No customer data and no store content. | United States | EU Standard Contractual Clauses in Slack's data processing addendum |
| Google Ireland Limited (Google Analytics 4) | Counts page views on this website, so we know which pages are worth keeping. Used only if a visitor allows analytics in the cookie banner. | A browser identifier in a cookie, the page address and title, the referrer and technical details of the visit such as browser and device. No store data, and nothing from the app. | European Union and United States | Google's data processing terms (business.safety.google/processorterms) |
| Meta Platforms Ireland Limited and Meta Platforms, Inc. (Meta Pixel and Conversions API), for website visitors only | Measures our advertising on Meta, by being told when a visitor views a page of this website, reads an article, searches the help center, opens the chat, or clicks Install free on Shopify or a link to email us. Used only if a visitor allows marketing in the cookie banner. The Meta company that receives it is Meta Platforms Ireland Limited for visitors in the European Union and the European Economic Area, and Meta Platforms, Inc. for visitors elsewhere. It receives website visitors' data and never merchant data. | From the Pixel in the visitor's browser: the full address of the page, including any query string, the page the visitor came from, the event (a page view; a view of a blog article, a help article or the pricing page, with the address name and topic of the article; that you read an article, meaning you scrolled through most of it and kept it open for about 30 seconds; a search in the help center, with the words you searched for, up to 80 characters; a press of the chat button; a click on Install free on Shopify, with the part of the page it was in; or a click on a link to email us), the _fbp and _fbc cookies and details of the browser. From our server's copy of the same event: the page address without its query string, the same event details, the visitor's IP address, browser user agent, the _fbp and _fbc cookies and an event id. The words you type into the help center search are sent to Meta, so please do not type personal details there. Nothing you type in the chat, and nothing you type into any other box, is sent to Meta. No store data and nothing from the app. | European Union and United States | Meta's own terms for the Pixel and the Conversions API |
| Crisp IM SAS | Live chat with visitors and merchants who start a chat. | What the person types, the page, browser details and, in the app, the store's name, myshopify.com domain, owner name, contact email and the owner's account email, Shopify plan, currency, Actorly plan with its billing interval, status, app version, language and install date, and app usage and account status details (the state of the history import, change and restore counts and dates, the last restore outcome, theme backup status, missing access, an open data request, days since install and labels made from these), never store content, customers or orders. | EU (Netherlands, Germany) | Crisp's data processing agreement |
| Anthropic, PBC | Sorts a support chat by help topic. Anthropic's Claude Haiku model reads the redacted words and answers with two labels from fixed lists, a help topic and a kind of question. The topic is added as a tag on the chat for our support team and counted, so that we can see which help articles are missing. The article suggested to the team in a private note is found by Actorly's own keyword matching, not by Anthropic. From Anthropic's answer Actorly keeps only the two labels, and no reply from Anthropic is shown to the visitor. | The words a person typed in a support chat, after Actorly has taken out email addresses, phone numbers, web addresses (a bare domain only with the usual web endings), store domains, order numbers and Shopify ids, and the store name, owner name and contact details the chat's own session data holds. Only what the visitor typed, never our replies, and at most the first 1,500 characters. No store data, no customer data and nothing from the app. | United States | EU Standard Contractual Clauses (Module Two or Three), the UK Addendum and the Swiss Addendum, in Anthropic's data processing addendum |
| GitHub, Inc. | Runs the daily job that copies install, uninstall and subscription records from Shopify's Partner API into Actorly's own database, and builds and deploys the site. | While the job runs: the shop domain and name, the event and its date, the plan name and amount. Nothing is kept by us on GitHub after the run; the job logs no store names. | United States | EU Standard Contractual Clauses (Module Two or Three) and the UK Addendum, in GitHub's data protection agreement |
3.1Anthropic's Commercial Terms of Service (anthropic.com/legal/commercial-terms) say: "Anthropic may not train models on Customer Content from Services." The redacted text is sent through Anthropic's API, which those terms cover. Anthropic keeps what it receives under its own terms and data processing addendum.
3.2A support chat is the only thing Anthropic receives that can hold personal data, and it is redacted first. The removal is automatic and cannot catch every personal detail a person writes in their own words. Anthropic does not receive store data, customer data or anything else from the app.
3.3We also use AI models to write and translate our own public content, and none of it is personal data. Our blog is drafted with Google's Gemini model on Google Cloud's Vertex AI, and with Anthropic's Claude Haiku model when Gemini is unavailable. Our help articles are translated with Anthropic's Claude Haiku model. What is sent is our own product notes, our own articles and public web pages. No visitor's, merchant's or customer's data is sent, and Anthropic's Commercial Terms, which bar it from training on what we send, apply to what it receives.
3.4GitHub receives the shop domain and name only while the daily job runs, and only for the install, uninstall and subscription records of Actorly itself. It receives no store data and no customer data.
3.5PostHog and Slack never receive customer data, store content, or a customer's name, address, email address or phone number. Actorly does not currently send product analytics. If it were switched on, the service would send PostHog only the events and fields listed in a fixed table in its code, and would drop anything else before it is sent.
3.6The website sends page views to Google Analytics and Cloudflare Web Analytics only if you allow analytics in the cookie banner, and page views, article reads, help center searches, chat opens and clicks to Meta only if you allow marketing in the cookie banner. It sends nothing to Google, Cloudflare Web Analytics or Meta before then, as the cookie policy says. Meta never receives merchant data, store data or anything from the app.
Back to contents4.1Cloudflare states that its platform holds the certifications listed on the security page and the privacy policy, each as Cloudflare scopes it. Actorly itself holds no certification of its own.
Back to contents5.1When we add or replace a subprocessor, we update this page, the data processing agreement, the privacy policy and the security page, and we tell merchants in advance, in the app, through Shopify or by email to the store owner, before the new subprocessor starts to process data.
5.2A merchant with a reasonable objection on data protection grounds can write to team@actorly.app before the date in the notice. We will work with the merchant in good faith, which may include not routing its data to that subprocessor where that is technically possible or, if the objection cannot be resolved, letting the merchant end the affected part of the service without penalty.
5.3A merchant that does not object before that date is taken to have authorised the new subprocessor.
Back to contents6.1ONDUTYOPS LLC. Email: team@actorly.app. Postal address: Coastal Highway, Lewes, Delaware 19958, United States.
Back to contents