Pooch AI — Sub-processor List
Last updated: 15 July 2026
Pooch AI engages the third parties below to help deliver its service. Each is bound by data protection terms no less protective than those in our Data Processing Addendum, and Pooch remains fully liable to merchants for their performance.
This page is the authoritative list referred to in our Privacy Policy §7 and in Annex III of our Data Processing Addendum.
Current sub-processors
| Sub-processor | Purpose | Entity location | Processing location | Personal data processed |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, database, cache, object storage, content delivery, and merchant account authentication | United States | United States (us-east-1) | All categories — conversation data, identity data, order enquiry data, device and usage data, storefront analytics events, merchant account data |
| Shopify Inc. | The commerce platform on which the merchant's store runs; source of store content and order data; delivery of the storefront analytics pixel | Canada | Global | Order and customer data; storefront event data |
| OpenAI, L.L.C. | Generation of assistant replies from conversation content | United States | United States | Conversation data |
Notes
Access from outside the United States. Personal data is stored in the United States. Our own personnel access it from Pakistan. These are personnel of Pooch itself, not of a third party, and Pakistan is therefore listed here as a processing location rather than as a separate sub-processor.
<!-- CONFIRM BEFORE PUBLISHING — two points, both flagged by the operator as needing verification: 1. CORPORATE STRUCTURE. The statement above assumes ONE legal entity that is registered in both the United States and Pakistan, with the Pakistan-based personnel being its own employees. Verify this. A single company is not usually "registered in two countries" in the same sense — the common structures are a US parent with a Pakistani subsidiary, or a US entity with a registered foreign branch. The distinction matters here: if the Pakistan operation is a SEPARATE LEGAL ENTITY, it is an intra-group sub-processor and must be added to the table above by name, and named in DPA Annex III. If it is a branch of the same entity, the wording above is correct as drafted. 2. COMPLETENESS. Pakistan must be the only such country. See the equivalent note in the Privacy Policy §8. -->Vector search. Our semantic search index is self-hosted within our own Amazon Web Services environment. It is not a separate sub-processor and is covered by the Amazon Web Services entry above.
Embeddings. The model that converts store content into search vectors runs locally within our own infrastructure. Content is not sent to any third party for this purpose.
Model training. OpenAI does not use data submitted through its API to train its models. We do not use merchant or shopper data to train any model of our own.
Payments. Merchant subscriptions are billed through the Shopify Billing API. Payment card details are handled by Shopify and are never received or processed by Pooch.
Changes to this list
We give merchants at least 30 days' notice by email, sent to the address on the merchant's account, before adding or replacing a sub-processor that processes shopper personal data.
If a merchant reasonably objects to a new sub-processor on data protection grounds within that notice period, the parties will discuss the objection in good faith. If it cannot be resolved, the merchant may terminate the affected part of the service without penalty and with a pro-rata refund of prepaid fees. See our Data Processing Addendum, §3.