1. About this page
This page lists the third-party service providers (each, a "subprocessor") that Brave River Inc. d/b/a CommerceShip engages to process personal data on behalf of CommerceShip and its customers in connection with the Services. CommerceShip enters into written agreements with each subprocessor that include data-protection commitments substantially similar to those CommerceShip provides to its customers, including, where applicable, the European Commission's Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum for cross-border transfers.
Subprocessors are grouped into two sections: Section 2 lists service-provider subprocessors that are always engaged in the operation of the Services; Section 3 lists integration subprocessors that are engaged when a Customer activates an integration with a third-party system (e.g., a carrier, e-commerce store, marketplace, warehouse management system, or order management system). In both cases, the listed entities are subprocessors of CommerceShip; the distinction is operational (always-on vs. activated by Customer) rather than legal.
Customers entitled to advance notice of subprocessor changes under their Data Processing Addendum may subscribe to receive notifications by emailing privacy@commerceship.com. Where required, CommerceShip will provide notice of new subprocessors in accordance with the timing set out in the applicable Data Processing Addendum.
2. Service-provider subprocessors
The following subprocessors support the operation, security, and delivery of the Services and are engaged regardless of which integrations a Customer activates. Categories of personal data each subprocessor may process are described at a high level; specific data categories depend on Customer's use of the Services.
2.1 Infrastructure & Security
| Subprocessor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Google Cloud Platform | Primary cloud hosting and infrastructure for the Site and Services | All customer data and personal data processed through the Services | United States |
| Auth0 (Okta, Inc.) | User authentication, identity, and access management, including single sign-on, multi-factor authentication, and session management | Account identifiers, email addresses, authentication credentials, multi-factor enrollment data, session and login event data | United States |
| Sentry | Application error monitoring and performance telemetry | Error reports, stack traces, IP addresses, request metadata | United States |
2.2 Data, Analytics & Product Insights
| Subprocessor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Google Analytics | Website and product analytics | Usage data, IP addresses, device and browser metadata | United States |
2.3 AI / Generative Models
| Subprocessor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| OpenAI | Generative AI features within the Services | Inputs and outputs Customer submits to AI features (which may include shipment metadata and account context) | United States |
| Anthropic | Generative AI features within the Services | Inputs and outputs Customer submits to AI features (which may include shipment metadata and account context) | United States |
| Groq | Generative AI inference within the Services | Inputs and outputs Customer submits to AI features | United States |
| Cohere | Generative AI features within the Services | Inputs and outputs Customer submits to AI features | United States |
| Mistral AI | Generative AI features within the Services | Inputs and outputs Customer submits to AI features | European Union (France) |
| Hugging Face | Generative AI model hosting within the Services | Inputs and outputs Customer submits to AI features | United States |
| Google Gemini (Google LLC) | Generative AI features within the Services | Inputs and outputs Customer submits to AI features (which may include shipment metadata and account context) | United States |
| Meta Muse | Generative AI features within the Services | Inputs and outputs Customer submits to AI features (which may include shipment metadata and account context) | United States |
2.4 Communications
| Subprocessor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Mailgun | Transactional and marketing email delivery | Email addresses, message content, delivery and engagement metadata | United States |
| Twilio | SMS notifications and alerts | Mobile phone numbers, message content, delivery metadata | United States |
| Chatwoot | In-product chat, ticketing, and customer support | Account identifiers, contact information, support conversation content | United States (Hetzner, Hillsboro, OR) |
2.5 CRM & Sales
| Subprocessor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Twenty | Customer relationship management (CRM) and sales pipeline | Account identifiers, contact information, sales-conversation metadata for prospects and Customers | United States (Hetzner, Hillsboro, OR) |
2.6 Marketing & Advertising
| Subprocessor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Google Ads (Google LLC) | Online advertising and conversion measurement | Visitor identifiers (cookies), IP addresses, ad-interaction metadata, conversion data | United States |
| Google Marketing Platform (Google LLC) | Advertising campaign management, audience measurement, and attribution (formerly DoubleClick) | Visitor identifiers (cookies), IP addresses, ad-interaction metadata | United States |
| DittoFeed | Marketing automation, user segmentation, journey-based messaging, and campaign analytics | User identifiers, email addresses, behavioral event data, anonymous visitor IDs (DfAnonymousId), message delivery and engagement metadata | United States (Hetzner, Hillsboro, OR) |
| Listmonk | Newsletter and email list management, campaign sending, and subscriber engagement tracking | Email addresses, subscriber names, list memberships, campaign engagement data (opens, clicks), bounce data | United States (Hetzner, Hillsboro, OR) |
2.7 Payments
| Subprocessor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Stripe | Payment processing for fees, invoices, and Carrier Adjustments | Payment-card information, billing name and address, transaction details | United States |
| Increase | Banking and treasury infrastructure for ACH transfers, wires, and account management | Bank account details (account numbers and routing information), transaction details, and business and beneficial-owner identity information | United States |
2.8 Mapping & Address Validation
| Subprocessor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Google Maps Platform | Address validation, geocoding, and mapping features | Shipment addresses and approximate location | United States |
3. Integration subprocessors
The following subprocessors are engaged when a Customer activates an integration with a third-party system. The Customer authorizes data flow to or from each such system by enabling the integration; CommerceShip transmits personal data necessary to operate the integration. Each integration partner processes that data subject to its own privacy practices. Sub-sections below are organized by category; the Customer's use determines which integrations apply.
3.1 Carriers
| Service | Purpose | Location |
|---|---|---|
| United States Postal Service (USPS) | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | United States |
| United Parcel Service (UPS) | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | United States |
| FedEx | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | United States |
| DHL | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | Global |
| ShipEngine | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | United States |
| Freightos | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | United States / Global |
| Coyote Logistics | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | United States |
| XPO Logistics | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | United States |
| DAT Freight & Analytics | Shipment fulfillment, label generation, rate retrieval, tracking, and related carrier services | United States |
3.2 Stores
| Service | Purpose | Location |
|---|---|---|
| Shopify | E-commerce platform integration; order, customer, and fulfillment data exchange | United States |
3.3 Marketplaces
(Specific integrations within this category will be added as the Services expand. Customers with executed Data Processing Addenda will be notified of additions as set out in those agreements.)
3.4 Warehouse Management Systems (WMS)
(Specific integrations within this category will be added as the Services expand. Customers with executed Data Processing Addenda will be notified of additions as set out in those agreements.)
3.5 Order Management Systems (OMS)
(Specific integrations within this category will be added as the Services expand. Customers with executed Data Processing Addenda will be notified of additions as set out in those agreements.)
3.6 Third-Party Logistics (3PL)
(Specific integrations within this category will be added as the Services expand. Customers with executed Data Processing Addenda will be notified of additions as set out in those agreements.)
3.7 Enterprise Resource Planning (ERP)
(Specific integrations within this category will be added as the Services expand. Customers with executed Data Processing Addenda will be notified of additions as set out in those agreements.)
3.8 Transportation Management Systems (TMS)
(Specific integrations within this category will be added as the Services expand. Customers with executed Data Processing Addenda will be notified of additions as set out in those agreements.)
3.9 Operations & IoT
| Service | Purpose | Location |
|---|---|---|
| Samsara | Fleet telematics, vehicle monitoring, and connected-operations integration; device telemetry and vehicle metadata when used by Customer | United States |
3.10 Productivity
(Specific integrations within this category will be added as the Services expand. Customers with executed Data Processing Addenda will be notified of additions as set out in those agreements.)
3.11 Communications & Notifications
| Service | Purpose | Location |
|---|---|---|
| Slack (customer-activated) | Optional integration that delivers app notifications to the Customer's own Slack workspace; CommerceShip transmits notification metadata only when the Customer activates this integration | United States |
CommerceShip adds and removes integration subprocessors from time to time as the Services expand and as Customers request new integrations. The lists above will be updated to reflect each addition or removal.
4. Cross-border transfer mechanisms
CommerceShip's primary infrastructure and operations are located in the United States. Where a subprocessor listed above operates outside the United States, or where Customer is established in a jurisdiction requiring a transfer mechanism for personal data processed in the United States, the parties rely on the European Commission's Standard Contractual Clauses (and the United Kingdom International Data Transfer Addendum, where applicable), together with any supplementary measures reasonably required, as set out in the Data Processing Addendum available at https://www.commerceship.com/legal/dpa.
5. Subscribe to changes
To subscribe to notifications of additions or material changes to this subprocessor list, please email privacy@commerceship.com with the subject line "Subscribe to subprocessor updates" and the email address on which you would like to receive notice. Customers with executed Data Processing Addenda receive notice as set out in those agreements.
6. Contact
Questions about subprocessors, transfer mechanisms, or this page may be directed to:
Brave River Inc. d/b/a CommerceShip
Privacy Team
1314 22nd Ave #22024
San Francisco, CA 94122
United States
Email: privacy@commerceship.com