Orderlion Subprocessor List

Version 1.0 · Effective 1 October 2026

Orderlion GmbH, Himmelpfortgasse 17/7, 1010 Vienna, Austria Data protection contact: privacy@orderlion.com

This page lists the subprocessors Orderlion engages to process personal data on behalf of its customers under the Data Processing Agreement. It corresponds to Annex 2 of that agreement.

Vendors used solely for Orderlion's own internal operations are not subprocessors under the Data Processing Agreement and are not listed here.

Where an integration middleware or EDI provider is contracted by the customer rather than by Orderlion, that provider is the customer's own processor and does not appear on this list. Where Orderlion contracts one, it is listed and marked as applying only to those accounts whose integration uses it.

We inform customers of any intended addition or replacement of a subprocessor at least 30 days before it is engaged, by email to the customer's designated contact and by updating this page. Section 6 of the Data Processing Agreement sets out the notice and objection procedure.

Current subprocessors

Amazon Web Services

  • Legal entity and registered address: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
  • Role and purpose: Hosting of all production systems; inbound and outbound email via AWS SES; EU-hosted AI model serving via AWS Bedrock
  • Processing location: EU (Frankfurt, eu-central-1)
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: Controlled by Orderlion; data persists until deleted on instruction, no independent retention of content

MongoDB Atlas

  • Legal entity and registered address: MongoDB Limited, Building 2, Number One Ballsbridge, Shelbourne Road, Ballsbridge, Dublin 4, Ireland
  • Role and purpose: Operation of the application database
  • Processing location: EU (AWS Frankfurt)
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: Controlled by Orderlion; backup snapshots expire per configured schedule

Anthropic

  • Legal entity and registered address: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA
  • Role and purpose: Large language model provider for Inbox order extraction and AI assistant features
  • Processing location: United States by default. Where the customer activates the EU-only option, processing takes place exclusively via AWS Bedrock in the EU (Frankfurt) and no transfer occurs.
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback. Not applicable where the EU-only option is active.
  • Retention at the subprocessor: API inputs and outputs deleted within 30 days. Content flagged by automated abuse systems retained up to 2 years, classification scores up to 7 years. Under the EU option, retention follows the Bedrock configuration.

OpenAI

  • Legal entity and registered address: OpenAI Ireland Ltd, company registration 737350, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
  • Role and purpose: Large language model provider for Inbox order extraction and AI assistant features. Not used for accounts on the EU-only option.
  • Processing location: United States
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: API inputs and outputs retained up to 30 days for abuse monitoring, then deleted

Microsoft Azure

  • Legal entity and registered address: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
  • Role and purpose: Azure OpenAI Whisper speech-to-text, transcribing Inbox voice messages before extraction
  • Processing location: EU
  • Transfer mechanism: EU entity, no third-country transfer
  • Retention at the subprocessor: Abuse monitoring is enabled by default and cannot be disabled on Orderlion's plan. A sample of audio data and the corresponding transcriptions is retained for up to 30 days in an isolated store accessible only to authorised Microsoft reviewers, and is then deleted.

Mailgun

  • Legal entity and registered address: Mailgun Technologies, Inc. (Sinch group), 112 E Pecan St, Suite 1135, San Antonio, TX 78205, USA
  • Role and purpose: Receipt of inbound order emails and dispatch of outbound transactional email
  • Processing location: EU (Mailgun EU region)
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback. The data is held in the EU, but the contracting entity is a US company, so the mechanism is retained rather than reading "no transfer".
  • Retention at the subprocessor: Message bodies up to 30 days; event and log data up to 30 days

Google Firebase

  • Legal entity and registered address: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Role and purpose: Mobile push notifications for the Orderlion app and white-label apps
  • Processing location: Outside the EU (US)
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: Undelivered push messages expire after a maximum time-to-live of 4 weeks; delivered messages are not retained

ONLINECITY.IO (GatewayAPI)

  • Legal entity and registered address: ONLINECITY.IO ApS, Buchwaldsgade 50, 5000 Odense C, Denmark
  • Role and purpose: Dispatch of SMS messages: buyer user invitations triggered by the customer, containing the invitation link, the invitation code and the customer's name
  • Processing location: EU (Denmark)
  • Transfer mechanism: EU entity, no third-country transfer
  • Retention at the subprocessor: Recipient and sender numbers, message payload and delivery metadata retained a maximum of 30 days, then purged or irreversibly anonymised automatically

Stripe

  • Legal entity and registered address: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, D02 H210, Ireland
  • Role and purpose: Processing of in-platform order payments. Stripe acts partly as Orderlion's processor and partly as an independent controller for fraud prevention and financial-services regulation.
  • Processing location: Outside the EU (US)
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: Transaction records retained for the periods prescribed by financial-services, anti-money-laundering and counter-terrorism regulation

Zendesk

  • Legal entity and registered address: Zendesk International Limited, 55 Charlemont Place, Saint Kevin's, Dublin 2, D02 F002, Ireland
  • Role and purpose: Ticketing platform for support requests, which may contain customer personal data
  • Processing location: EU
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: Tickets archived 120 days after closure; permanent deletion 3 years after closure

Aircall

  • Legal entity and registered address: Aircall SAS, 11-15 rue Saint Georges, 75009 Paris, France
  • Role and purpose: Telephony platform for support and sales calls and for SMS
  • Processing location: EU
  • Transfer mechanism: EU entity, no third-country transfer
  • Retention at the subprocessor: Content deleted by scheduled quarterly purge at a 90-day threshold, giving a maximum age just under 6 months. Aircall retains data for a maximum of 30 days after account termination.

Datadog

  • Legal entity and registered address: Datadog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA
  • Role and purpose: Infrastructure and application monitoring and error tracking
  • Processing location: EU (datadoghq.eu site)
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: Logs retained 14 days as configured by Orderlion

Sentry

  • Legal entity and registered address: Functional Software, Inc. dba Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
  • Role and purpose: Client-side error tracking
  • Processing location: Outside the EU (US)
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: Error events retained 30 to 90 days depending on the data type

Mixpanel

  • Legal entity and registered address: Mixpanel, Inc., One Front Street, 28th Floor, San Francisco, CA 94111, USA
  • Role and purpose: Product analytics on pseudonymised platform usage events. A pseudonymous user identifier, feature usage and device information only; no names, contact details or order content are transmitted.
  • Processing location: Outside the EU (US)
  • Transfer mechanism: EU-US Data Privacy Framework, SCCs as fallback
  • Retention at the subprocessor: Event data retention configured at 2 years, after which data is deleted or anonymised

Change history

No changes since this list was first published on 17 August 2026.

Additions and removals will be recorded here with their dates.

Questions about this list: privacy@orderlion.com

‍