Legal

Sub-processors

Last updated: September 3, 2026

Sprout Affiliate uses a small number of third parties to run the service. Under Article 28(2) of the GDPR these are our sub-processors, and this page is the notice of them. We keep the list short deliberately: every name here is one more company that can see a merchant's or an affiliate's data.

We will post changes here at least 30 days before a new sub-processor starts processing personal data, so a merchant has time to object. To be told by email when this page changes, write to support@sproutaffiliate.com and ask to be added to the sub-processor notice list.

Infrastructure

Fly.io (Fly.io, Inc.)

What it does: runs the application and the PostgreSQL database. All application data lives here.
Data: everything the app stores, including merchant settings, affiliate names, emails and payout details, and the commission ledger.
Location: Ashburn, Virginia, United States (region iad).

Payments

PayPal (PayPal Holdings, Inc.)

What it does: sends affiliate payouts when a merchant pays through PayPal.
Data: the affiliate's PayPal email address, the amount and the currency.
Location: United States, with PayPal's own global processing.
Note: a merchant who pays affiliates by another method never sends data here.

Email

Google Workspace (Google LLC / Google Ireland Ltd)

What it does: delivers transactional email: sign-in links, payout notices, application decisions and program invitations.
Data: recipient name and email address, and the content of those messages.
Location: United States and Google's global infrastructure.

Mobile push notifications

Only for merchants and affiliates who install a Sprout Affiliate mobile app and turn notifications on. If nobody installs an app, no data reaches either company.

Apple Push Notification service (Apple Inc.)

Data: a device push token and the notification text.
Location: United States.

Firebase Cloud Messaging (Google LLC)

Data: a device push token and the notification text, for Android devices.
Location: United States.

Safety checks

Google Safe Browsing (Google LLC)

What it does: checks destination links against Google's list of known malicious sites, so an affiliate program cannot be used to spread a harmful link.
Data: the URL being checked. These are store and product URLs, not personal data.

Not sub-processors

Shopify. Shopify is the source of the order data the app reads, under the merchant's own agreement with Shopify. It is not our sub-processor.
Exchange-rate services (open.er-api.com, api.frankfurter.dev). These receive currency codes only. No personal data is sent to them.
Web fonts. Sprout Affiliate serves all fonts from its own servers. No visitor's IP address is sent to a font CDN.

Questions

To object to a sub-processor, or to ask what any of them receives in your specific configuration, write to support@sproutaffiliate.com.