Sub-processors

This page lists the third parties MaxInvent engages to process personal data on behalf of its customers, under clause 6 of the data processing agreement. Version 1.0.

It does not list the marketplaces, couriers, payment providers or accounting systems a customer connects. Those are not our sub-processors — each decides its own purposes for the data it receives and acts as an independent controller. Section 4 below explains why that distinction matters.

Infrastructure

Amazon Web Services (AWS)

Hosting for the application, its databases, file storage, encryption keys and background jobs. Receives all platform data.

Primary region: Europe (London), United Kingdom. Encrypted disaster-recovery database snapshots are held in Europe (Ireland). Ireland is covered by UK adequacy regulations, so that copy needs no additional transfer safeguard.

Transactional email provider

Delivery of invoices, order notifications, password resets and similar messages. Receives the recipient's name and email address, and the contents of the document or notification being sent.

Cloudflare, Inc.

Bot protection on login and registration, using Cloudflare Turnstile. Receives IP address and browser and device signals. Operates globally, including outside the United Kingdom.

Optional features

These process personal data only when a customer uses the feature concerned. A customer that does not use the feature has no data sent to the provider.

OpenAI, L.L.C.

Document extraction, listing generation, supplier import assistance and courier invoice reconciliation. Receives the text and images submitted to those features, which can include names and addresses where they appear in a supplier document, delivery note or courier invoice. United States; processed under a UK-approved transfer mechanism.

OpenStreetMap Foundation (Nominatim)

Converting delivery addresses into coordinates for delivery route optimisation. Receives the delivery address and postcode. United Kingdom and European Union.

This one is worth flagging rather than burying in a list: it is the only entry that receives a customer address at a public endpoint, and it is used only when the route optimisation feature is run. We are reviewing whether to move this to a provider under a dedicated contract.

Marketing content tools

The Service includes optional tools for producing product marketing content. These receive product images, product descriptions and script text. They do not receive customer, buyer or staff personal data, so they are not sub-processors of it, but we name them for completeness: ElevenLabs (speech synthesis, United States), remove.bg (product image background removal, Germany), and third-party video generation services.

Objecting to a sub-processor

We will give at least 30 days' notice before adding or replacing a sub-processor, by email to your notified contact and by updating this page. You may object on reasonable data protection grounds within that period.

We will discuss the objection with you and use reasonable efforts to provide the Service without that sub-processor or by another means. If that is not reasonably possible you may terminate the affected part of the Service, or the agreement, without penalty, and we will refund fees paid for any period after termination takes effect.

Where a replacement is urgently required to maintain security or continuity, we may appoint it immediately and will tell you as soon as we reasonably can.

To be notified of changes to this page, or to object, email support@maxinvent.uk.

Not sub-processors

The marketplaces you connect — including Amazon, eBay, TikTok Shop, Temu, Groupon, Magento, Shopify and ClearanceFood — each determine their own purposes for buyer data and act as independent controllers. Your relationship with each is governed by its own terms.

The same applies to the couriers you select, which receive the recipient's name, address and contact details in order to deliver; and to Stripe and Xero, which you connect with your own credentials.

We transmit personal data to all of these on your instruction, which you give by enabling the connection. We are not a party to your agreement with them, and we cannot control what they do with the data once they have it. Listing them here as our sub-processors would imply we appointed them and stand behind them, which would misdescribe the arrangement in a way that helps nobody.