Pricelyzer
Sign inSign up

LEGAL

Sub-processors

Last updated: July 20, 2026

1. Overview

Pricelyzer is operated by Lookfar Analytics Inc., a British Columbia corporation headquartered in Port Coquitlam, BC, Canada. This page lists the sub-processors that Lookfar Analytics Inc. engages to operate the Pricelyzer service. Sub-processor obligations are governed by our Data Processing Agreement. We notify customers at least 14 days before adding or replacing a sub-processor. To object to a new sub-processor, email privacy@pricelyzer.com.

2. Infrastructure and hosting

  • Hetzner Online GmbH
    Purpose: cloud compute (application and worker boxes).
    Region: Hillsboro, Oregon, USA (Hetzner us-west).
    HQ: Gunzenhausen, Germany.
    Certifications: ISO 27001.
    Transfer mechanism: EU Standard Contractual Clauses (Commission Decision 2021/914) where applicable.
  • Supabase, Inc.
    Purpose: managed Postgres (application data, encrypted at rest), authentication, connection pooling.
    Region: Toronto, Canada (ca-central-1).
    HQ: United States.
    Certifications: SOC 2 Type II.
    Transfer mechanism: EU→Canada flows rely on the European Commission's PIPEDA adequacy decision; transfers to US Supabase corporate operations rely on the EU SCCs.
  • Cloudflare, Inc.
    Purpose: DNS, CDN, TLS termination at the edge, WAF, DDoS mitigation.
    Region: global edge.
    HQ: United States.
    Transfer mechanism: EU SCCs.
  • Vercel, Inc.
    Purpose: Next.js application hosting for pricelyzer.com (marketing and cockpit).
    Region: Portland, Oregon (pdx1).
    HQ: United States.
    Transfer mechanism: EU SCCs.

3. Payments

  • Stripe, Inc.
    Purpose: payment processing, subscription management, invoicing, and renewal-failure retries.
    Data processed: billing email, name, card details (Stripe is PCI-DSS Level 1 — Pricelyzer never stores raw card data, only Stripe's opaque customer and subscription identifiers), billing address (where required for tax), and the country code used for tax determination.
    HQ: United States.
    Certifications: PCI-DSS Level 1.
    Transfer mechanism: EU SCCs.

4. Email delivery

  • Resend, Inc.
    Purpose: transactional email delivery (account confirmations, password resets, billing receipts, breach notifications).
    HQ: United States.
    Transfer mechanism: EU SCCs.

5. Monitoring and product analytics

  • Sentry (Functional Software, Inc.)
    Purpose: application error and performance monitoring.
    Data processed: crash stack traces, request paths, user-agent strings, authenticated user identifier on error. PII in error payloads is scrubbed where feasible.
    HQ: United States.
    Transfer mechanism: EU SCCs.
  • PostHog, Inc.
    Purpose: product analytics and session replay — anonymized reconstructions of on-page interactions and aggregate usage events, to diagnose errors and improve usability.
    Data processed: masked session recordings (typed text, form values, and prices are never captured), page views, interaction events, and a pseudonymous device identifier. Recording is suppressed on authentication, billing, account, administrator, and Amazon-seller pages; no Selling Partner API data is transmitted.
    Region: United States.
    HQ: United States.
    Legal basis: processed only with the visitor's consent (“analytics” cookie category); withdrawable at any time via the cookie banner.
    Transfer mechanism: EU SCCs.

6. Third-party data providers

  • Google LLC (Gemini API)
    Purpose: pack-size verification — Pricelyzer sends product titles and short descriptions to detect mismatches between an Amazon listing's pack size and a store's pack size.
    Data processed: product titles and short product descriptions. No customer personal data is transmitted to Google.
    HQ: United States.
  • Anthropic PBC
    Purpose: AI assistant responses — chat messages and product context are processed to generate answers.
    Data processed: assistant chat messages and the product context needed to answer them. No SP-API seller data is sent to Anthropic.
    HQ: United States.

7. Amazon Selling Partner API

  • Amazon.com Services LLC (SP-API)
    Purpose: read-only Amazon seller-data access under the seller's OAuth authorisation (fee estimation, pricing and current-offer data, listing-restrictions checks, and catalog data). Pricelyzer never writes to listings, repricing, orders, or customer data.
    HQ: United States.
    Pricelyzer is not affiliated with, endorsed by, or sponsored by Amazon.com, Inc.

8. Affiliate attribution

  • Affiliate attribution — not yet active. If affiliate attribution is enabled in the future, an attribution-data sub-processor may be added to this list (click-attribution on retailer domains via outbound redirect). No customer personal data is currently shared for affiliate attribution. We will email customers and update this page at least 14 days before any such sharing begins.

9. Changes to this list

We notify customers at least 14 days before adding or replacing a sub-processor. Material changes will be communicated by email and an in-app notice.

10. Contact

Sub-processor questions and objections: privacy@pricelyzer.com