Sub-processors
These are the third parties that process data on behalf of MANO PLATFORMS LTD when you use Mano. For each one: what it does, what personal data it touches, and where it runs.
This list is derived from what the application actually depends on at runtime, not from memory. If you need it as part of a vendor review, everything you need is on this page.
Who processes data for Mano
Shopify
The platform Mano integrates with. Source of every order, customer and return record, and the channel every webhook arrives on.
Personal dataCustomer name, email, phone, order and return data. Shopify is the origin, not a recipient.
WhereMerchant's own Shopify region
Transfer basisNot a transfer by Mano: the data originates in the merchant's own Shopify store, under the merchant's own agreement with Shopify.
Vercel
Application hosting, serverless compute and edge network. Every request passes through it.
Personal dataAll data in transit; request logs (IP, user agent, path).
WhereUS (primary), global edge
Transfer basisNot yet settled. The mechanism (standard contractual clauses, or the UK addendum to them) is with counsel; it is not described as settled before it is.
Neon
Managed PostgreSQL. The only place Mano stores data at rest, including customer personal data and the encrypted Shopify access token.
Personal dataEverything in the retention schedule.
WhereUS (AWS us-east-1)
Transfer basisNot yet settled. The mechanism (standard contractual clauses, or the UK addendum to them) is with counsel; it is not described as settled before it is.
Clerk
Authentication for merchant staff. Not shopper-facing.
Personal dataMerchant user email, session data, and the sign-in method chosen.
WhereUS
Transfer basisNot yet settled. The mechanism (standard contractual clauses, or the UK addendum to them) is with counsel; it is not described as settled before it is.
Resend
Transactional email: merchant notifications, the digest, and data-request acknowledgements.
Personal dataRecipient email address and message content.
WhereUS
Transfer basisNot yet settled. The mechanism (standard contractual clauses, or the UK addendum to them) is with counsel; it is not described as settled before it is.
Anthropic
AI-assisted reading of a merchant’s written returns policy. When a merchant asks Mano to analyse their policy, the policy text is sent to Anthropic’s API section by section, with Mano’s fixed extraction instructions, and the model proposes the three Policy V1 rules (return window, excluded items, return reasons not accepted) for the merchant to review. It proposes only: nothing becomes active until the merchant approves it.
Personal dataThe merchant-provided returns-policy text and Mano’s fixed instructions. No customer names, emails, phone numbers, orders, returns, addresses, Shopify or workspace tokens, or billing data are sent. Anthropic states that API inputs and outputs are deleted from its systems within 30 days by default; Mano does not currently hold a zero-data-retention agreement.
WhereUS
Transfer basisNot yet settled. The mechanism (standard contractual clauses, or the UK addendum to them) is with counsel; it is not described as settled before it is.
Sentry
Error monitoring and stack traces.
Personal dataIncidental only: whatever appears in an error context. Not a deliberate store of personal data, but it is not guaranteed free of it and is treated as in scope.
WhereUS
Transfer basisNot yet settled. The mechanism (standard contractual clauses, or the UK addendum to them) is with counsel; it is not described as settled before it is.
Named because people ask
These are third parties you might expect to find on the list. They are not on it, and this is why.
StripeNo longer used. Mano bills through Shopify (App Pricing): the merchant chooses and approves a plan on Shopify’s own hosted page, Shopify takes the payment, and Mano only reads the resulting subscription. Mano never sees or handles card details. The purchase and management rail was removed in August 2026, and the dormant remainder (a webhook endpoint, its client and the Stripe library) in October 2026, so no code reaches Stripe. Listed here rather than omitted because Stripe was previously named as the payment processor on this page, and a reader who checked before deserves to see what changed.
Google FontsFonts are self-hosted from Mano’s own origin: the font files are committed to Mano’s own repository and served by Mano. No request reaches Google at build time or at runtime, so no visitor data is shared with Google at any stage.
Cloudflare TurnstileNot used by Mano’s own code. It is the bot-protection widget Clerk can show on sign-in, so if it appears it is a sub-processor of Clerk rather than a direct relationship of Mano’s. It remains permitted in our content-security policy for that reason.
SlackUsed only when a merchant connects their own Slack channel. Mano posts counts there (how many signals need attention, or that a sync failed), never a customer’s name, e-mail or order, so no personal data reaches Slack.
ExchangeRate-APISupplies currency exchange rates. Mano asks for a rate by date and currency; nothing about a merchant or a customer is sent.
Royal Mail Click & DropNot active for labels. Today Mano only checks a merchant’s own credential with it, sending no shopper data. Before any carrier receives a shopper’s name and address to issue a label, it is added to this page.
GorgiasNot available to merchants yet. When it is, a merchant connects their own Gorgias account; this page will say how that connection is treated before it goes live.
Google (sign-in)Reachable only as a sign-in option offered by Clerk, and brokered by Clerk. A sub-processor of Clerk rather than a direct relationship of Mano’s, listed here for completeness.
Changes
2026-08-26Anthropic added, for AI-assisted reading of a merchant’s written returns policy. Disclosed before any policy text was sent.
2026-08-14Stripe removed. Mano bills through Shopify; Mano never handles card details.
2026-08-13The list first published: Shopify, Vercel, Neon, Clerk, Resend and Sentry.
When this list changes, the owners of every store are e-mailed what changed and when, with a link to this page. Questions or objections go to the address at the foot of the page.
What we do not yet promise
A standard data-processing agreement sets a notice period before a new sub-processor starts and a formal right to object. Those terms are not yet settled, so the e-mail above tells you about a change; it does not yet carry a notice period.
Every sub-processor above except Shopify is hosted in the United States. The formal transfer mechanism for that (standard contractual clauses or the UK addendum) is not yet settled, and we will not describe it as settled before it is.
Related
Privacy policy · Data processing agreement · Security
Questions about anything on this page: security@mano.help