Data processing
For merchants who need to record that Stashed processes shopper data on their instructions.
Draft — not yet reviewed by a lawyer. Written to common practice for a hosted commerce platform and accurate about how Stashed actually works, but it should be reviewed before it is relied on.
Roles
For personal information about your shoppers, you are the controller and we are the processor. You decide what is collected and why; we process it to provide the platform, on your instructions.
For personal information about you as a merchant, we are the controller — see the privacy policy.
What we commit to
- To process shopper personal information only to provide the service, and on your documented instructions, unless the law requires otherwise.
- To keep it confidential and to bind our staff and contractors to confidentiality.
- To apply appropriate technical and organisational security measures.
- To engage sub-processors only under equivalent obligations, and to keep the list below current.
- To assist you, so far as is reasonable, with responding to individuals exercising their rights.
- To notify you without undue delay after becoming aware of a personal data breach affecting your shoppers.
- To delete or return the information at the end of the agreement, subject to retention the law requires.
Sub-processors
These are the third parties that may process personal information in the course of running the platform. We will give notice before adding one that materially changes the position.
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Application hosting, edge delivery, analytics | United States, global edge |
| Google Cloud / Firebase | Database, authentication, file storage | European Union, United States |
| Amazon Web Services | Object storage | United States |
| Stripe | Payment processing and merchant payouts | United States, Australia |
| Resend | Transactional and marketing email | Asia Pacific |
| EasyPost | Shipping rates, labels and tracking | United States |
| Alchemy | Blockchain data for wallet and token features | United States |
| Helius | Solana network access | United States |
| Crossmint | Card payment for blockchain-settled purchases | United States |
| Irys | Permanent storage for collectible metadata | Distributed |
Not every merchant’s shop engages every provider. Blockchain-related providers are involved only where a shop uses those features.
International transfers
The providers above process data outside Australia. Where personal information originating in the European Economic Area or the United Kingdom is transferred, it is done under the relevant standard contractual clauses or an equivalent lawful mechanism.
Signing a copy
If your own compliance requires a countersigned agreement, email legal@stashed.one and we will arrange one.
Akashi Labs — Melbourne, Victoria, Australia — legal@stashed.one