Subprocessors
Last Updated: July 24, 2026
A subprocessor is a company Affiliateo engages that may process personal data in the course of providing the platform. This page is the authoritative list. It is also reproduced in Section 5 of our Data Processing Agreement, which is the contractual version.
Current subprocessors
Supabase
United StatesDatabase, authentication, and storage.
Cloudflare
Global edge networkHosting, CDN, edge compute (Workers), DDoS and bot protection, R2 object storage, Turnstile bot challenge, and transactional email sending.
Stripe
United StatesPayment processing, merchant onboarding (Express accounts), and affiliate payouts. Stripe acts as a separate controller for some payment data.
Apple App Store / Google Play
United StatesIn-app purchase processing and server-to-server notifications for mobile-affiliate apps.
Engaged only when the relevant feature is turned on.
Amazon Web Services
United StatesOptional identity verification only, via Amazon Textract (identity-document reading) and Amazon Rekognition (one-to-one facial comparison). Applies to Affiliateo account holders who choose to verify, not to a customer’s end users. Images are processed transiently and are not retained by Affiliateo.
Engaged only when the relevant feature is turned on.
RevenueCat
United StatesMobile in-app purchase webhook relay, where the customer has connected a mobile-affiliate app to RevenueCat.
Engaged only when the relevant feature is turned on.
Paddle, Polar, Shopify, Whop, and WooCommerce
United States and European Union, by providerAlternative web commerce and payment providers. Each is used only where the customer connects that specific provider to an app, and only to receive the sale notifications needed to attribute a commission.
Engaged only when the relevant feature is turned on.
Advertising platforms
These are not subprocessors. They receive data from Affiliateo but process it for their own purposes under their own terms, which makes them independent controllers rather than parties acting only on our instructions. They are listed here because who receives data is the question this page exists to answer.
Meta Platforms, TikTok, and Google
United StatesServer-side conversion reporting into the customer’s own advertising account, so the customer can measure their advertising. Meta additionally receives data about visitors to affiliateo.com for Affiliateo’s own advertising, which is Affiliateo’s processing as a controller and does not involve customer data.
Engaged only when the relevant feature is turned on.
Apple (Apple Search Ads)
United StatesInstall attribution for a customer’s mobile apps, where the customer has connected an Apple Search Ads account.
Engaged only when the relevant feature is turned on.
Changes to this list
Affiliateo may engage additional or replacement subprocessors. Material changes are reflected on this page. If you are a merchant using Affiliateo to process visitor data, you may object to a new subprocessor on reasonable data-protection grounds by contacting us within 30 days of the change.
To be notified of changes, or to raise an objection, email support@affiliateo.com with the subject line "Subprocessor updates" and we will add you to the notification list.