Sub-processors

i.Always — the platform itself

These apply to every merchant, because they are what Graymat runs on. Named individually in the list we send on request; described here by what each one does and where it holds data, which is what determines your obligations.

• Managed database and file storage — holds your operational data. Sees everything in your database. Cloud infrastructure, Asia Pacific (Tokyo) — for brands whose database has not yet moved to Graymat’s own servers (application hosting, below).
• Object storage — holds files your team uploads: team-chat attachments, return-damage photos (including those taken in the mobile app), content and meeting recordings. Sees those files. Asia Pacific (Tokyo); for databases moved to Graymat’s own servers, the content-delivery provider’s storage (below). Listed here 8 October 2026; it was in use before that date and was missing from this page.
• Application hosting and compute — runs the application and its scheduled jobs and, since 28 October 2026, Graymat’s own database servers: they hold Elyscents’ data, the account registry, website sign-in and the website waitlist, and every brand’s database is moving to them. Sees data in transit while a page or job runs, and the data on those servers. Singapore.
• Identity and access management — sign-in for the Graymat mobile app, and the team accounts created before 16 October 2026. Since that date, sign-in on the web runs on Graymat’s own servers (application hosting, above) and records each session’s IP address and device, nothing more. Sees your staff’s names, emails and sign-in activity, including each session’s IP address and the approximate location it implies — not your customers. United States.
• Content delivery, DNS and encrypted backup storage — serves this website, holds independent encrypted backups and, for databases moved to Graymat’s own servers, the files your team uploads. Sees encrypted backup files and those files. Global.
• AI language processing — drafts and analyses text on request. Sees only the text a feature sends it. Your data is not used to train any model. United States.

ii.Only if you connect it — messaging and stores

• Meta (WhatsApp Business Cloud API) — sends and receives your customer messages. Sees phone numbers and full message content.
• Meta (Graph API / Ads) — reads your advertising performance.
• Shopify — mirrors your orders and writes back tags and edits. Sees your orders and customers, in both directions.
• Google Ads and TikTok Ads — read your advertising performance.
• An advertising data connector — a third party that relays advertising metrics from one of the platforms above. Metrics only, no customer data. Being retired.

iii.Only if you connect it — couriers

A courier necessarily sees the customer’s name, phone, address and the amount to collect — that is what a delivery is. You choose which you use.

• PostEx · Leopards Courier · TCS — Pakistan
• CityMail — United Arab Emirates
• Nuport — Bangladesh
• Deliveryman · Motorspeed · Boxleo — Kenya
• 3S Logistics — Saudi Arabia
• Daraz — where you sell on the marketplace

iv.Only if you use that feature — everything else

• Additional AI providers — some drafting, image and analysis features use a provider other than the one above. Each sees only what that feature sends it.
• Email delivery — sends your team’s notification and setup emails, if email notifications are used. Sees recipient addresses and the email text, not your customer lists. United States.
• Video meetings — carries live audio, video and screen sharing for Rooms meetings, if you use Rooms; recordings are kept in the object storage in section i. Sees what is said and shown while a meeting runs.
• Payment links — only if you switch on pay-before-delivery. The payment provider for that market receives the order number and amount (in Pakistan also the customer’s phone number and email); the customer enters their card on the provider’s own page. Pakistan; United Arab Emirates.
• Card payment for Graymat plans — only if you pay Graymat by card. Receives the plan, the amount, your workspace’s ID and what you enter on its payment page.
• Web page capture — capturing competitor and store pages. Public web pages only, no customer data.
• Federal Board of Revenue (Pakistan) — fiscal receipts, if you use the retail point of sale. Invoice totals and tax, as the law requires.

v.Only if your team uses the mobile app

These apply only once your team chooses to install the Graymat app for Android or iPhone — like connecting an integration. Listed 8 October 2026.

• Push-notification relay — the service the app is built on for notifications. Receives each phone’s push address and an installation identifier, and the title and text of every team alert it relays, which can include the start of a team-chat message, a teammate’s name, a task title, the day’s figures, or a customer’s name or phone number when a customer conversation is handed to someone. United States.
• Apple Push Notification service (iPhone) and Google Firebase Cloud Messaging (Android) — deliver those alerts to the phone. See the alert’s title and text, including any customer name or phone number in it.
• Google ML Kit (Android barcode reader) — reads barcodes on the phone. Sends Google basic usage and performance figures; no images.

vi.Changes to this list

30 days’ email notice before we add or replace a sub-processor, and you may object on data-protection grounds within those 30 days — the mechanism is clause v of the Data Processing Agreement. To request the named list, or to be told when it changes, email privacy@graymat.ai.