Language: EN
TürkçeTREnglishEN
Start Free
Start Free

Subprocessors and Data Recipients

The Company that provides Riseluc delivers the service with the providers below. This page is Annex 2 to the Data Processing Agreement; it shows what each provider does, the data it processes and where that data is located.

Last updated: 10 November 2026

On this page

1. Subprocessors

Subprocessors process data on the Company's behalf and on its instructions, only for the service listed.

  • Supabase, Inc.: database, authentication (sign-in) and file storage. Data processed: account, store, order, finance and billing records, encrypted access credentials and uploaded files. Location: European Union, Germany (Frankfurt).
  • Vercel Inc.: hosting of the website and dashboard, content delivery network. Data processed: session and request data, IP address and the account and store data the pages process. Location: server-side processing in the European Union, Germany (Frankfurt); content delivery network worldwide.
  • Railway Corporation: background jobs (marketplace sync, repricing, reports) and the job queue. Data processed: store, order and finance data while it is processed, and the access credentials needed to connect to the marketplace. Location: European Union, the Netherlands (Amsterdam).
  • OpenAI, L.L.C.: AI text: product text and translation, draft replies to customer questions, review analysis, supplier XML column matching and Lucy's answers. Data processed: product details, customer question and review text, messages written to Lucy and the store data read for the answer; the User's name, email, payment details and access credentials are not sent. OpenAI does not use API data to train its models and may keep it for up to 30 days for abuse monitoring. Location: United States.
  • Features and Labels, Inc. (fal.ai): product photo studio and product video. Data processed: product images the User sends and model photos uploaded for virtual try-on. Location: United States.
  • Resend, Inc.: sending account, notification and information emails. Data processed: email address, name and email content. Location: United States.
  • Functional Software, Inc. (Sentry): recording technical errors in background jobs. Data processed: technical details at the time of the error and internal record numbers (local variables and personal data fields are not sent). Location: United States.
  • Cloudflare, Inc. (Turnstile): bot check on the sign-in, sign-up and password reset forms. Data processed: IP address, browser and device signals. Location: United States (global network).
  • Scrape.do: reading public marketplace pages (reviews, store rating, search results). Data processed: public page addresses and content, including the reviewer name the marketplace shows; no account, store or access credentials are sent. Location: outside Türkiye (pages are read through exit points in Türkiye).

2. Independent data recipients

The recipients below process data in their own name and under their own terms, as separate data controllers. Data reaches them because of an action or choice by the User or a legal obligation.

  • İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico): payment, card storage, refunds and fraud review as a payment institution licensed under Law No. 6493 on Payment and Security Settlement Systems, Payment Services and Electronic Money Institutions. Data: name, email, mobile phone, billing address and IP address; card details are entered directly into iyzico's form; Turkish ID and tax numbers are not sent. Location: Türkiye.
  • Polar Software, Inc.: payment, invoice and refund handling for purchases where Polar is shown as the seller on the checkout page. Data: name, email and payment record. Location: United States.
  • Revenue Administration of Türkiye (Gelir İdaresi Başkanlığı): issuing e-Archive or e-Invoice documents (legal obligation). Data: invoice details: name or company name, address, tax or Turkish ID number, amount. Location: Türkiye.
  • European Commission (VIES): validating the VAT number of businesses in the European Union. Data: VAT number and country code. Location: European Union.
  • Marketplaces (Trendyol, Hepsiburada, n11, Amazon, eMAG): the price, stock, content, question answer, order, invoice and shipping actions the User turns on or approves through a connected store. Data: the User's store data and the content the User sends. Location: the marketplace's country.
  • The AI app the User connects (OpenAI ChatGPT, Anthropic Claude): answering the question the User asks in that app. Data: read data from the stores chosen on the consent screen (the buyer's name and address are not sent). Location: United States.
  • Google (Google Analytics and Sign in with Google): Analytics measures site use only with explicit consent; Sign in with Google works when the User chooses it. Data: cookie ID, page views, IP address and browser details; at sign-in, name, email and profile photo link. Location: United States and European Union (Ireland).
  • Meta (Meta Pixel): measuring advertising results, only with explicit consent. Data: cookie ID, page view and sign-up completion events, IP address. Location: United States and European Union (Ireland).
  • The browser's push notification service (for example Google, Mozilla, Apple): delivering the push notifications the User turns on to the device. Data: push subscription address; notification content travels encrypted. Location: the browser vendor's country.
  • WhatsApp (Meta Platforms Ireland Ltd.): messages for setup, support and offers, only if the User has given permission to be called and messaged on WhatsApp. Data: phone number and message content. Location: European Union (Ireland) and United States.
  • Partners (Partner, Partner Plus): earnings calculation and setup support for users who arrive through the partner's invitation link. Data: name, email, sign-up date, plan and subscription status, and whether a store has been connected. Location: Türkiye or the partner's country; the partnership is governed by a separate agreement.

3. Changes and objections

3.1. At least 30 days before adding a new subprocessor or replacing one, the Company updates this page and notifies account holders by email. A change that cannot be postponed for security reasons is notified no later than the day it is made.

3.2. Within 30 days of the notice, the User may object on reasonable data protection grounds by writing to info@riseluc.com. If the parties do not find a solution within 15 days of the objection, the User may terminate the subscription without penalty and is refunded the amount paid for the unused period.

3.3. The Company must ensure that subprocessors work under data protection obligations no less protective than those in the Data Processing Agreement, and it is liable to the User for their acts within this scope as for its own.

4. Transfers abroad

The location of each provider and recipient outside Türkiye is stated in its own line above. The Company must carry out these transfers in line with Article 9 of Law No. 6698 on the Protection of Personal Data; information for users is in the KVKK Privacy Notice and the Privacy Policy.