Legal

Sub-processors

Last updated: September 23, 2026

Sprout Affiliate uses a small number of third parties to run the service. Under Article 28(2) of the GDPR these are our sub-processors, and this page is the notice of them. We keep the list short deliberately: every name here is one more company that can see a merchant's or an affiliate's data.

We will post changes here at least 30 days before a new sub-processor starts processing personal data, so a merchant has time to object. To be told by email when this page changes, write to support@sproutaffiliate.com and ask to be added to the sub-processor notice list.

Infrastructure

Fly.io (Fly.io, Inc.)

What it does: runs the application and the PostgreSQL database. All application data lives here.
Data: everything the app stores, including merchant settings, affiliate names, emails and payout details, and the commission ledger.
Location: Ashburn, Virginia, United States (region iad).

Payments

PayPal (PayPal Holdings, Inc.)

What it does: sends affiliate payouts when a merchant pays through PayPal.
Data: the affiliate's PayPal email address, the amount and the currency.
Location: United States, with PayPal's own global processing.
Note: a merchant who pays affiliates by another method never sends data here.

Email

Postmark (AC PM, LLC)

What it does: delivers the email the app sends: sign-in and password links, commission and payout notices, application decisions, a store's announcements to its affiliates, and program invitations.
Data: recipient name and email address, and the content of those messages. Addresses that hard bounced or reported an email as spam are kept so that nothing is sent to them again, and an unsubscribe is recorded so that the mail it opted out of stops.
Location: United States: a data centre near Chicago, Illinois, and Amazon Web Services.
Started: September 22, 2026, the day Sprout Affiliate's mail moved off Google Workspace and onto Postmark. It was added to this page the following day, so this one was listed after it started rather than 30 days before.
Note: AC PM, LLC is the entity named in Postmark's terms of service and data processing addendum. It is part of ActiveCampaign, which bought Postmark from Wildbit in May 2022.

Google Workspace (Google LLC / Google Ireland Ltd)

What it does: hosts Sprout Affiliate's own mailboxes, support@sproutaffiliate.com among them, so it holds what you write to us and any reply sent to an address of ours. It stays wired up as a standby sending route, but it does not deliver the app's email.
Data: the name, email address, and message content of anyone who writes to us or replies to one of our emails.
Location: United States and Google's global infrastructure.

Mobile push notifications

Only for merchants and affiliates who install a Sprout Affiliate mobile app and turn notifications on. If nobody installs an app, no data reaches either company.

Apple Push Notification service (Apple Inc.)

Data: a device push token and the notification text.
Location: United States.

Firebase Cloud Messaging (Google LLC)

Data: a device push token and the notification text, for Android devices.
Location: United States.

Safety checks

Google Safe Browsing (Google LLC)

What it does: checks destination links against Google's list of known malicious sites, so an affiliate program cannot be used to spread a harmful link.
Data: the URL being checked. These are store and product URLs, not personal data.

Not sub-processors

Shopify. Shopify is the source of the order data the app reads, under the merchant's own agreement with Shopify. It is not our sub-processor.
Exchange-rate services (open.er-api.com, api.frankfurter.dev). These receive currency codes only. No personal data is sent to them.
Web fonts. Sprout Affiliate serves all fonts from its own servers. No visitor's IP address is sent to a font CDN.

Questions

To object to a sub-processor, or to ask what any of them receives in your specific configuration, write to support@sproutaffiliate.com.