§1Current subprocessors
| Service | Purpose | Region | Notes |
|---|---|---|---|
| AI inference provider | AI inference for listing generation, vision tagging, and photo classification. | United States | Paid-API endpoints with no-training-on-inputs; zero-data-retention enrollment in progress. |
| eBay, Inc. | Marketplace integration: OAuth, publish, browse comps, taxonomy. | United States + global | User-authorized per OAuth scope. Once a listing is published, eBay becomes an independent controller for that record. |
| Cloud database hosting | Managed Postgres database hosting. | United States | DPA in place. Point-in-time recovery retention: 7 to 30 days. |
| Object storage, CDN & bot mitigation | Image storage, DNS, and bot-challenge protection. | Global edge | DPA in place. Storage buckets default to private. |
| Backend application hosting | Backend container hosting. | United States | DPA in place. Operational log retention: 7 to 30 days. |
| Frontend hosting & edge CDN | Marketing site and app frontend hosting. | Global | DPA in place. |
| Sold-comparable pricing data source | Sold-comparable pricing data. | United States | Operates as a data source; no personal information shared. |
| Transactional email provider | Transactional email (verification, deletion, support). | United States | DPA in place. SPF / DKIM / DMARC configured on piccull.com. |
| Payment processor | Payments, tax calculation, billing portal. | United States + global | DPA auto-applied. PCI DSS scope is SAQ-A; card data never touches PicCull servers. |
| Social sign-in providers | Optional single sign-on (Google, Apple). | United States | Per-user consent on first sign-in. No background API calls beyond identity. |
| Product analytics provider (when enabled) | Product analytics. | United States | DPA available. Events are de-identified after account deletion. |
| Error & uptime monitoring (when enabled) | Error tracking and uptime monitoring. | United States | DPA available. PII scrubber strips request bodies and auth headers. |
| Advertising & conversion measurement (when enabled) | Measuring account signups driven by advertising campaigns. | United States | Used only with consent. Aggregated ad-conversion measurement; no listing content shared. |
| Domain & email hosting | Domain registration and email hosting for piccull.com aliases. | United States | Standard provider DPAs. |
| Operational alerting (admin only) | Operational webhook notifications (admin only). | United States | No customer personal information sent; admin alerts and deploy notifications only. |
§2Notice of changes
We will email subscribed users at least 14 days before adding a subprocessor that processes personal data of registered users. You can object to a new subprocessor by closing your account or emailing privacy@piccull.com before the change date.
To subscribe to subprocessor-change notices independently of an account, email privacy@piccull.com with the subject line “Subprocessor notice subscribe”.