Legal
Sub-processors
The service providers LatchPay engages to process personal data, and the services a merchant connects. This page is Annex 3 of the Data Processing Agreement. Last changed 14 October 2026.
1. Sub-processors for your buyers' data
These providers process the personal data of your buyers that LatchPay handles for you. Each is bound by a written agreement with data protection terms. Where a provider is outside the European Economic Area, or can access data from outside it, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or the EU standard contractual clauses.
| Provider | What it does for LatchPay | Personal data | Location |
|---|---|---|---|
| Vercel | Hosts and runs the website, the dashboard, the checkout and the API; serves custom checkout domains; tells us the approximate location of a request for Live View. | Everything that passes through a request to LatchPay, including buyer data at checkout. | United States (company). The app runs on Vercel's network and in the function region set for LatchPay. |
| Supabase | Hosts LatchPay's database. | All data LatchPay stores, including buyer data. | Data stored in the EU (Ireland). Company in the United States. |
| Resend | Sends e-mail: the service e-mails of subscriptions to buyers on the merchant's behalf, the e-mail to a buyer whose subscription LatchPay Protect stopped, and LatchPay's e-mails to merchants. | The recipient's e-mail address and the e-mail's content (for buyers: the store's name, the items, amounts and links to their subscription). | United States (company). |
| Anthropic | When a merchant uses "Generate with AI" in the checkout editor: turns the screenshot and text the merchant gives into a draft checkout block. Also Claude, the AI assistant LatchPay's administrators use to build and run LatchPay, including to look things up in LatchPay's database. | For "Generate with AI": only the screenshot and text the merchant uploads. For the assistant: what an administrator looks up with it, which can include buyer data (fields LatchPay stores encrypted or as codes stay unreadable). | United States (company). |
2. Providers for LatchPay's own data
LatchPay also uses these providers for its own records about merchants (your account, plan and fees), as described in the privacy notice. They receive no buyer data from LatchPay. Vercel, Supabase, Resend and Anthropic above also process LatchPay's own data.
| Provider | What it does for LatchPay | Personal data | Location |
|---|---|---|---|
| Whop | LatchPay's own Whop business: the LatchPay membership, the weekly fee charges and affiliate payouts. Also "Continue with Whop" sign-in. | Merchant account and payment details on Whop, and fee amounts. No buyer data. | United States (company). |
| "Continue with Google" sign-in, when a merchant chooses it. | The Google account id, e-mail and name Google shares. No buyer data. | Google's infrastructure, including the United States. |
3. Services you connect (not our sub-processors)
When you connect one of these services or turn on a feature that uses it, LatchPay sends it the data the feature needs, on your instruction. You have your own agreement with each of them, and it is not LatchPay's sub-processor:
- Your payment provider: your own Whop business, Stripe account, Mollie account or Adyen merchant account. It charges your buyers, handles refunds and disputes, and receives dispute evidence. Through it, the card networks and the buyer's bank receive what a payment or a dispute needs. On Whop, Whop is the merchant of record of the charge; on Stripe, Mollie and Adyen you are.
- Your Shopify store: carts are quoted from it, paid orders, refunds and cancellations are written to it, and, when you switch on the abandoned-checkout export, abandoned checkouts go to its customer list. Apps you install in Shopify read those orders under your agreements with them.
- Your Klaviyo account, when you connect it: a "Checkout Started (LatchPay)" event with the buyer's e-mail address, the cart and a link back to the checkout, for your own abandoned-checkout flows.
- Your ad platforms, when you connect them on the Tracking page (Meta, TikTok, Google Analytics, Pinterest, Snapchat): checkout and purchase events from our server, and your own pixels in the buyer's browser.
- Google Fonts, when you choose a Google font for your checkout: the buyer's browser loads the font from Google.
4. Changes to this list
Before a new or replacement sub-processor in section 1 starts processing your buyers' data, we update this page and tell you at least 30 days in advance by e-mail to your LatchPay account's address or in the dashboard. You can object as section 6 of the DPA describes.
Change log: 14 October 2026, first published list.
Who we are
- Name
- LatchPay
- Legal form
- sole proprietorship (eenmanszaak)
- KvK number
- 74998129
- VAT number
- NL002373677B66
- Address
- Pinksterbloemweg 255, 1508 BT Zaandam, the Netherlands
- info@latchpay.io
- Contact
- Contact form; we answer by e-mail.