Draft — not legally effective
Counsel review is required before launch. Bracketed items are open decisions.
Subprocessors
These vendors process personal data for Open Commerce Online when you use the hosted control plane. Merchants remain responsible for processors they connect with their own API keys (for example their Stripe account).
| Vendor | Role | Typical data |
|---|---|---|
| Vercel (infrastructure on AWS) | Hosting, HTTPS, Functions, Cron, logs | Request metadata, env configuration, build artifacts |
| Supabase | Auth and Postgres | Operator accounts, tenant commerce rows |
| Stripe | Platform billing and (via Connect / Elements) card payments | Billing customer; card data stays with Stripe |
| Resend | Transactional email when enabled | Recipient email, message content |
| Sentry | Error reporting when a DSN is configured | Error stacks, truncated request context |
Cardholder data is not stored on OCO. Crypto private keys are not stored on OCO. See Privacy and Non-custodial policy.