Legal
Subprocessors
The companies Grizzlee relies on to run the Service, what each one receives and where it processes data.
1. Current subprocessors
A subprocessor is a company that Grizzlee uses to provide the Service and that can receive personal data in the Service, whether our customers store it or Grizzlee controls it. Each is bound by a contract with data protection terms. This list is Annex III of the Standard Contractual Clauses in the data processing agreement.
| Provider | Purpose | Data | Location | Used |
|---|---|---|---|---|
| Amazon Web Services | Hosting. The application server, the PostgreSQL database and its backups, the store of runtime secrets, release files and server administration. | All data held in Grizzlee: account, company, partner, end customer and loyalty card holder data. | Canada, in the Canada (Central) region | Always |
| Supabase | Sign-in. Accounts, passwords, email confirmation, password resets and sessions for team members and partners who log in. | Name, email address, password, sign-in sessions and, for Google sign-in, the Google account's name and email. | Canada, in the Amazon Web Services Canada (Central) region in Montréal | Always |
| Resend | Email delivery. Sign-in emails sent for Supabase, partner emails and loyalty card links. | Recipient email address, the message content, which can include a name, company name, reward amounts and card links, and delivery status. | the United States, in the Amazon Web Services US East region in Virginia | Always for sign-in emails. Partner and card emails when sent. |
| Stripe | Billing for Grizzlee subscriptions, through Grizzlee's own Stripe account. Checkout, invoices, payment methods and the billing portal. | Company name, the email of the owner or admin who subscribes, the company ID, payment card details entered in Stripe, invoices and monthly usage counts. | United States and other countries where Stripe operates | When a company subscribes |
| Apple | Apple Wallet. Push notifications that tell a saved loyalty pass to update. | The device push token and the pass type. The pass itself goes from Grizzlee to the card holder's device. | United States and other countries where Apple operates | When a card holder saves a pass to Apple Wallet |
| Google Wallet. Creating and updating saved loyalty passes. | The card holder's first name, member code, balance, card design and text, company name and the map positions of the company's locations. | United States and other countries where Google operates | When a card holder saves a pass to Google Wallet |
2. Services you connect
Some services exchange data with Grizzlee because you connect your own account to it. They work for you under your own agreements, not for Grizzlee, so they are not Grizzlee's subprocessors:
- Your Stripe account, when you connect it to record charges, invoices and refunds, create promotion codes or send transfers to partners.
- Your Shopify store, when you connect it to record orders and create discount codes.
- The webhook endpoints you add, which receive events about your partners, customers and rewards.
- Google, when a person chooses to sign in with Google. Supabase handles that sign-in.
3. What Grizzlee does not use
Grizzlee uses no analytics, advertising, session recording or error tracking services, and no content delivery network. Fonts, QR codes, barcodes and images are produced on Grizzlee's own server.
4. Changes to this list
We will update this page and email the owner of each company at least 30 days before a new or replacement subprocessor starts receiving personal data. If an urgent change is needed to keep the Service running or secure, we will tell you as soon as we can. You can object under the data processing agreement. Questions go to privacy@grizzlee.ca. The privacy policy describes the data itself.