Effective October 20, 2026
A "subprocessor" is a third-party service provider that processes personal information or Customer Data on our behalf in order to operate the Shako Stats service (the "Service"). This page lists providers used to deliver the Service, including optional features when enabled. It supplements our Privacy Policy and Terms of Service.
| Subprocessor | Purpose | Location | Data Processed |
|---|---|---|---|
| Google Cloud Platform (Google LLC) | Application hosting, database hosting, file storage (Google Cloud Storage), background job queue (Cloud Tasks), text-to-speech for product features | United States | All Service data, including account information and Customer Data |
| Stripe, Inc. | Payment processing (PCI DSS Level 1 certified) | United States | Customer name, email, billing address, payment method details (entered directly into Stripe and not stored by Shako Stats), invoices, subscription status |
| Resend, Inc. | Transactional and product email delivery | United States | Recipient email, name, email content (transactional notices, billing receipts, product updates) |
| Google LLC (OAuth) | Authentication via "Sign in with Google" | United States | OAuth identifier, email address, name, profile picture URL |
| Google LLC (Analytics 4 / Tag Manager) | Marketing-website usage analytics and tag management | United States | Aggregated page views, IP address (truncated by GA4), device and browser type, referrer, anonymous identifiers via cookies |
| Amplitude, Inc. | Website and application usage analytics; Session Replay for troubleshooting and product improvement, when enabled | United States | Page URLs and metadata, referrers, browser/device information, IP addresses, device/session identifiers, interaction events, and rendered page content, which may include Customer Data |
| ipapi.co | One-time country detection at signup based on the user's IP address | United States / European Union | Visitor IP address (used at signup only) |
When enabled, Amplitude Analytics uses autocapture, and our Session Replay configuration selects 100% of eligible sessions, subject to browser and SDK availability. Default replay settings mask form fields and text inputs; project privacy settings can override those defaults. Other displayed text, HTML attributes, and URLs may be collected. Collection excludes administrative, OAuth, account-verification, password-reset, development, and debugging routes. See our Cookie Policy for browser-storage details.
We update this page when we add, remove, or replace a subprocessor or materially change its processing purpose. For material changes, we will provide a prominent notice on the Service or notify affected account holders by email, as appropriate. Our Privacy Policy explains how policy updates take effect.
If a change does not meet your requirements, you may stop using the Service, terminate your subscription, and request deletion of your Customer Data under the Terms of Service. Contact us with questions about a subprocessor or its purpose.
Each subprocessor we use is bound by a written agreement that:
We periodically review our subprocessors' security and privacy practices.
Questions about subprocessors: info@shakostats.com