Data processing
Subprocessors
Last updated 26 August 2026
This page identifies third parties Marvello authorises to process personal data on its behalf when providing Merge Me. Actual processing depends on the environment and features enabled for a Merchant.
| Provider | Purpose | Processing location |
|---|---|---|
| Google Cloud Platform / Google Cloud Australia Pty Ltd and relevant Google contracting entities | Application compute, database, encrypted storage and backups, secrets, logging, monitoring and operational infrastructure | Primary application resources are configured for Australia (Sydney / australia-southeast1); limited support, security and service metadata may be processed globally under Google’s terms |
| Cloudflare, Inc. and relevant Cloudflare contracting entities | DNS, TLS, network delivery, threat protection, public website hosting/proxying and protected support-console access | Global network; request and security data may be processed in Australia, the United States and other routing or support locations |
Shopify platform
Shopify provides the commerce platform from which Merchant Data originates and to which Merge Me returns permitted results. The Merchant contracts independently with Shopify. Depending on the processing context, Shopify may act as the Merchant’s independent provider rather than Marvello’s subprocessor. Shopify is therefore disclosed here for transparency but is not designated a Merge Me subprocessor for every data flow.
Merchant-selected providers
A fulfilment provider, 3PL, carrier or other app selected and configured by the Merchant is not automatically Marvello’s subprocessor. The Merchant is responsible for its agreement, instructions and legal basis with that provider. Merge Me will identify a provider here before appointing it as Marvello’s own subprocessor for customer personal data.
Changes and objections
We may add or replace a subprocessor to operate or improve the Service. We will post the change here and, where required by the DPA, give reasonable advance notice of a new subprocessor that will process customer personal data. A Merchant may object on reasonable data-protection grounds during the notified period. We will work in good faith on a reasonable solution; if none is available, either party may terminate the affected Service without penalty for future periods.
Contact
Questions or objection notices may be sent to help@mergeme.app with “Subprocessor” in the subject.