Service and product scope
This is the common subprocessor list for Bidson websites and apps. Each entry states which service or product uses the provider.
Mailgun Technologies, Inc. (Sinch Email)
- Affected services: Bidson public website contact form and Bidson CRM Sync support emails and import-completion notifications.
- Service: transactional email delivery and associated delivery logs. Data includes email addresses, contact details, messages, Shopify shop domain, CRM provider, technical support diagnostics and aggregate import results.
- Processing location: Mailgun EU region for message data; limited account information may be processed globally.
- Transfer safeguards: Sinch Email DPA, EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
Google LLC (Google Workspace)
- Affected services: Bidson website contact correspondence and Bidson CRM Sync support.
- Service: business email receiving and retaining contact and support correspondence, including replies to app notifications.
- Processing locations and transfer safeguards: as described in the applicable Google Workspace agreement, data-processing terms and service configuration.
Scope
This list identifies third parties engaged by the operator to process merchant personal data for the Service. The operator's legal identity must be completed before external production use. Last reviewed August 11, 2026.
Railway Corporation
- Affected products: Bidson CRM Sync.
- Service: application hosting, runtime, PostgreSQL database, networking and related infrastructure.
- Address: 548 Market St PMB 68956, San Francisco, California 94104, United States.
- Processing locations: European deployment region, with Railway's primary processing operations in the United States and possible access or processing by its authorized subprocessors in other countries.
- Transfer safeguards: Railway DPA, EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
Merchant-selected services
For Bidson CRM Sync, Shopify is the merchant's data source and the merchant-selected CRM is the destination. The merchant contracts with and configures those services directly. They are therefore described in the privacy policy and data flow but are not listed here as subprocessors appointed by the operator for that instructed transfer. The same assessment will be made separately for each future Bidson app.
Changes and objections
The operator will keep this list current and provide reasonable advance notice before appointing a new or replacement subprocessor. Merchants may object on documented data-protection grounds under the DPA. A reliable notification and subscription mechanism must be implemented before external production use.
Contact
Questions or objections can be sent to the support address below. Do not include customer records, access tokens or other unnecessary personal data.