List of Sub-processors

BengalCloud

Service: Cloud server hosting and object/file storage

Purpose:

BengalCloud provides cloud infrastructure used to host and operate CartShield’s application and related services. CartShield uses infrastructure located in both Jashore and Khulna, Bangladesh for redundancy and service reliability.

Data that may be processed:

Processing Location: Bangladesh

Services: DNS management, CDN, WAF, security, DDoS protection, and Cloudflare R2 object storage

Purpose:

Cloudflare provides network, DNS, content delivery, security, web application firewall, DDoS protection, and object storage services used to operate and protect CartShield.

Data that may be processed may include:

Processing Location: May vary depending on the Cloudflare service and infrastructure used.

Service: Database infrastructure

Purpose:

MongoDB provides database technology used to store and process information required for CartShield’s Services.

Data that may be processed:

Processing Location: May vary depending on the configured MongoDB infrastructure and service arrangement.

Service: SMS and OTP delivery

Purpose:

REVE SMS is used to deliver OTPs, verification messages, and other SMS communications initiated through CartShield.

Data that may be processed:

Processing Location: Bangladesh

Service: SMS and OTP delivery

Purpose:

RACE Online SMS may be used to deliver OTPs, verification messages, and other SMS communications initiated through CartShield.

Data that may be processed:

Processing Location: Bangladesh

Service: Payment processing

Purpose:

SSLCOMMERZ is used to facilitate payment processing for CartShield subscriptions, licenses, and related purchases.

Data that may be processed:

Payment card credentials and other sensitive payment information may be handled directly by the payment provider according to its own systems and security practices.

Processing Location: May vary depending on the payment service and infrastructure used.

Service: Email delivery

Purpose:

Mailgun is used to deliver transactional, service-related, verification, account, and other authorized email communications from CartShield.

Data that may be processed:

Processing Location: United States

Service: Business email and communications

Purpose:

Zoho Mail is used for CartShield’s business email and communication operations.

Data that may be processed:

Processing Location: United States

Service: Courier and delivery information API

Purpose:

CartShield may use Steadfast’s services to retrieve or verify courier and delivery-related information for fraud prevention, order analysis, and delivery-risk assessment.

Data that may be processed:

Processing Location: Bangladesh

Service: Courier and delivery information API

Purpose:

CartShield may use Pathao’s courier services or APIs to retrieve or verify delivery-related information for fraud prevention, order analysis, and delivery-risk assessment.

Data that may be processed:

Processing Location: Bangladesh

Service: Courier and delivery information API

Purpose:

CartShield may use Carrybee’s courier services or APIs to retrieve or verify delivery-related information for fraud prevention, order analysis, and delivery-risk assessment.

Data that may be processed:

Processing Location: Bangladesh

Service: Courier and delivery information API

Purpose:

CartShield may use RedX’s courier services or APIs to retrieve or verify delivery-related information for fraud prevention, order analysis, and delivery-risk assessment.

Data that may be processed:

Processing Location: Bangladesh

Service: Website analytics

Purpose:

Google Analytics may be used to understand how visitors interact with the CartShield website and to measure website performance and usage.

Data that may be processed may include:

Google Analytics is not used by CartShield to perform fraud analysis on merchant customer order data.

Processing Location: May vary depending on Google’s infrastructure and applicable service configuration.

Service: Website tag management

Purpose:

Google Tag Manager may be used to manage and deploy website tags and related technologies used on CartShield’s website.

Data that may be processed:

The information processed may depend on the tags configured through the service and the relevant website functionality.

CartShield does not use Google Tag Manager as a system for storing merchant customer order data.

Processing Location: May vary depending on Google’s infrastructure.

Service: Customer communication

Purpose:

CartShield may use the WhatsApp Business API to communicate with customers and merchants for support and service-related purposes.

Data that may be processed:

Processing Location: May vary depending on Meta’s infrastructure and service configuration.

Service: Business communication and centralized customer support

Purpose:

CartShield may use Meta Business tools together with WhatsApp Business functionality to centralize and manage customer support communications.

Data that may be processed:

Processing Location: May vary depending on Meta’s infrastructure and service configuration.

CartShield uses Pino, a Node.js logging package, for application logging.

Pino is self-hosted within CartShield’s own infrastructure and is not an independent third-party sub-processor.

Depending on the application component, internal logs may contain technical information, security events, request information, error information, and other operational data necessary to maintain and secure the Services.

CartShield uses internally managed authentication and license-management technologies.

These include:

These authentication mechanisms are operated as part of CartShield’s own infrastructure and are not independent third-party sub-processors.

CartShield uses GitHub for source code management and software development.

GitHub is not listed as a CartShield sub-processor for customer data.

CartShield does not intentionally host, store, or process merchant customer data or customer order data in GitHub repositories.

Production customer data is maintained separately from CartShield’s source code repositories.

CartShield uses its own intelligence and fraud analysis system for its fraud prevention functionality.

CartShield currently does not use external AI providers or third-party AI models to process customer order data.

Customer order information is not currently sent to external AI platforms for fraud analysis.

If this changes, CartShield will review the applicable privacy, security, contractual, and legal requirements before introducing such processing.

CartShield uses infrastructure and service providers in multiple locations.

Known processing locations include:

Processing locations may change as our infrastructure, service providers, or technical architecture evolves.

CartShield expects its sub-processors to:

CartShield remains responsible for managing its relationship with its sub-processors and for maintaining appropriate contractual and organizational controls where required.

We may add, remove, replace, or change sub-processors as our Services and infrastructure evolve.

We will notify CartShield users of material changes to this Sub-processor List.

Where appropriate, notification may be provided through:

The updated list will include the effective or last-updated date.

By continuing to use CartShield after a notified change becomes effective, users acknowledge the updated Sub-processor List to the extent permitted by applicable law and contractual arrangements.

If you have questions about a sub-processor, data processing location, or how CartShield handles personal data, please contact: