SetRoasFlowAll documents

SETROASFLOW — SUBPROCESSOR & RECIPIENT LIST

Version: Draft — 25 August 2026

IMPORTANT CLASSIFICATION NOTE

The following list identifies technical providers and third-party destinations used by SetRoasFlow. Inclusion in this list does not by itself establish that a provider is a “subprocessor” under applicable privacy law. Legal classification is maintained separately and requires vendor-by-vendor review.

A. INFRASTRUCTURE / SERVICE PROVIDERS

1. Cloudflare — Workers, D1, Durable Objects, KV and edge infrastructure.

2. Supabase — managed Postgres for merchant accounts, destination configurations, events and usage.

3. Contabo — VPS hosting for the SetRoasFlow dashboard.

4. Cloudflare Workers AI — on-demand merchant-entered text processing.

5. Anthropic — Claude Haiku fallback where configured.

B. ANALYTICS

6. Google Analytics 4 — configured event analytics and Consent Mode.

7. Mixpanel — pseudonymous distinct_id based on hashed external ID or session ID; no clear email.

C. ADVERTISING / AUDIENCE DESTINATIONS

8. Meta — Conversions API and Custom Audiences.

9. Google Ads — conversion and Customer Match functionality.

10. TikTok — Events API and audience.

11. Snapchat — advertising/audience activation.

12. Pinterest — advertising/audience activation.

13. Reddit — advertising/audience activation.

14. LinkedIn — audience/DMP segments using SHA-256 email.

15. X/Twitter — audience activation using SHA-256 email.

D. CRM DESTINATIONS

16. Klaviyo — may receive clear email/phone where configured and permitted.

17. HubSpot — may receive clear email/phone where configured and permitted.

18. Mailchimp — may receive clear email/phone where configured and permitted.

19. ActiveCampaign — may receive clear email/phone where configured and permitted.

E. MERCHANT-CONTROLLED DESTINATIONS

BigQuery, Snowflake, S3/R2 and signed webhook endpoints configured by the Merchant are exports to the Merchant's own infrastructure and are not SetRoasFlow subprocessors.

F. CHANGE MECHANISM

SetRoasFlow may add or replace providers as the Service evolves. The applicable legal documentation will be updated and, where required, affected Merchants will receive notice and any applicable opportunity to object.

For each provider, confirm:

  • legal role;
  • categories of data;
  • processing locations;
  • international transfer mechanism;
  • DPA status;
  • onward transfers;
  • deletion/retention;
  • whether it is a subprocessor, independent controller, joint controller or other recipient.