Subprocessor List
The infrastructure, payment, auth, AI, email, shipping and marketplace providers Makr3D uses to deliver the service.
Last updated
1. Scope
This Subprocessor List identifies the providers Makr3D uses to run the service. It is a register of providers in use, not a plan: a provider appears here only once it is live. We review vendor agreements, transfer terms and processing locations on an ongoing basis, and we update this register when a provider is added, changed or removed.
Where a provider is outside the UK, transfers are made under the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with the provider's own data-processing terms. Shopify is not a Makr3D subprocessor: it is the platform a merchant already uses and is an independent controller for its own purposes.
2. How to read this list
A subprocessor is a provider that may process personal data for Makr3D while delivering the platform. Some providers also act as independent controllers for limited purposes, such as payment compliance, fraud prevention, carrier services, platform security or legal obligations. Where that is the case, the provider's own terms and privacy notice may also apply.
3. Subprocessor register
| Provider | Purpose | Typical data | Region and transfer notes | When used |
|---|---|---|---|---|
| Clerk | Authentication, sessions, user management and access controls. | Seller account identifiers, email, auth events, session data and device/security metadata. | International processing likely. Transfers are covered by the provider's data-processing terms and appropriate safeguards. | Core platform service. |
| Railway | Application hosting, Postgres, Redis, deployments, logs and internal jobs. | Platform data, order data, account data, logs, database records and job metadata. | International processing likely. Transfers are covered by the provider's data-processing terms and appropriate safeguards. | Core platform service. |
| Tigris Data (S3-compatible object storage, provisioned through Railway) | Private storage for uploaded files, previews, production files, exports and related media. | Uploaded files, generated previews, STL/3MF/STEP/OBJ assets, order media and access logs. | International processing likely. Transfers are covered by the provider's data-processing terms and appropriate safeguards. | Core platform service. |
| Stripe | Payments, saved payment methods, subscriptions, refunds, disputes and invoicing support. | Seller billing details, payment references, charge status, invoices and fraud/security metadata. | International processing likely. Stripe may act as controller for some payment compliance purposes. | Used for paid orders and billing. |
| ShipStation | Shipping labels, carrier service selection, tracking and carrier claim support. | Recipient names, addresses, parcel details, order references, tracking and customs data where needed. | International processing likely. Carrier and destination-specific transfer paths may apply. | Used for label generation. |
| Carriers and postal operators | Parcel carriage, customs, delivery, tracking, loss and damage claims. | Recipient details, delivery address, phone/email where needed, parcel details and customs information. | Depends on destination and carrier route. Carriers often act under their own service terms. | Used per shipment. |
| Resend | Transactional email such as account, order, billing, support and security notices. | Email addresses, message content, delivery logs, support references and event metadata. | International processing likely. Transfers are covered by the provider's data-processing terms and appropriate safeguards. | Used for email delivery. |
| OpenAI | Print Intelligence analysis, assistant workflows and operational AI features. | Files, file-derived metadata, slicer outputs, prompts, support context and account/order references where needed. | International processing likely. Makr3D does not opt in to API-provider model training. | Feature-dependent. |
| Sentry | Error monitoring, diagnostics, performance traces and incident investigation. | Error logs, stack traces, URLs, user or seller identifiers where included, device and event metadata. | International processing likely. Transfers are covered by the provider's data-processing terms and appropriate safeguards. | Used for production monitoring. |
| Plausible | Privacy-friendly usage analytics and funnel measurement. | Aggregated page and event analytics, referrers, device class and coarse location data depending on configuration. | Transfers are covered by the provider's data-processing terms and appropriate safeguards. Configured without advertising pixels. | Used for analytics unless disabled. |
| Google Analytics | Site usage analytics, referrer reporting and funnel measurement. | Page views, events, referrers, device/browser metadata, coarse location signals and identifiers depending on Google tag configuration. | International processing likely. Transfers are covered by the provider's data-processing terms and appropriate safeguards. | Used for analytics unless disabled. |
| Campaign conversion measurement for creator and seller acquisition. | Page visits, sign-up conversion events, device/browser metadata and identifiers depending on pixel configuration. | International processing likely. Transfers are covered by the provider's data-processing terms and appropriate safeguards. | Used for marketing measurement unless disabled. | |
| Etsy | Optional order-source connection for sellers who authorise Etsy access. | Seller shop identifiers, OAuth tokens, order references, buyer delivery data and item data needed for fulfilment. | International processing likely. Etsy acts under its own marketplace terms for seller and buyer data. | Optional integration. |
| Connected order sources (Etsy, ShipStation, Veeqo, eBay, Amazon) | Order-source connections a seller chooses to enable. | Store identifiers, OAuth/API credentials, order references, buyer delivery data and item data. | Provider-specific. New order-source providers are added to this register before they are generally enabled. | Planned or seller-configured only. |
| Professional advisers, insurers and authorities | Legal advice, accounting, audit, claims, tax, regulatory and law-enforcement responses. | Limited account, order, payment, safety, IP, support or dispute records as needed. | UK by default where possible, with transfer safeguards where required. | Used only when needed. |
4. Changes to subprocessors
We may add, replace or remove subprocessors as the platform changes. Material changes will be reflected on this page and, where required, notified to sellers through the platform or by email. Sellers with a reasonable data-protection objection should contact [email protected] promptly.
5. Subprocessor safeguards
Makr3D uses provider contracts, data-processing agreements, access controls, transfer safeguards, logging and data minimisation appropriate to each provider's role. We review vendor agreements, processing regions, transfer terms, onward subprocessors and security documentation on an ongoing basis, and we update this register when subprocessors change.