Subprocessors
These are the service providers that process personal data to provide Aigen PackTrack (list version 1.2, facts checked on the providers' own pages on 17 October 2026). We announce changes at least 30 days in advance under the data processing agreement.
Providers
- Replit, Inc. (EU)
Purpose: The service's application and its production database, including user accounts (which we run ourselves with Better Auth) and uploaded files. The database and infrastructure are in the EU.
Data: All data stored in the service: user accounts, company details, packaging rows, uploads, billing details and the audit log.
Location: EU. PackTrack is hosted and its data stored on EU servers.
Transfer basis: No transfer outside the EU for hosting and storage. Transfers by the other providers listed below are described under each of them.
Sources: Replit Data Processing Agreement, Replit subprocessors - Stripe Payments Europe, Limited (Ireland)
Purpose: Payments, subscriptions, invoices and receipts, VAT calculation and VAT ID verification.
Data: The company's legal name, billing address, billing email, VAT ID and payment and subscription details. Card details are handled only by Stripe.
Location: Ireland; Stripe also transfers data to Stripe, LLC in the United States.
Transfer basis: Stripe's Data Transfers Addendum: the EU–US Data Privacy Framework or EU standard contractual clauses (Stripe Data Processing Agreement, sections 6 and 8).
Sources: Stripe Services Agreement, section 12 (contracting entity), Stripe Data Processing Agreement - Anthropic Ireland, Limited (Ireland)
Purpose: Material suggestions for uploaded rows (automatic classification) and answers to questions asked in the AI help chat about using the service.
Data: Classification: only each uploaded row's product code, description, packaging notes, supplier, quantity and unit weight. AI help chat: only the questions the user types, the earlier questions and answers of the same conversation, and the service's own public help texts. No company name, register data, user name or email, or billing data is sent. Anthropic may not train models on customer content (Commercial Terms, section B).
Location: Processing may take place outside the EEA.
Transfer basis: EU standard contractual clauses, modules 2 and 3 (Anthropic Data Processing Addendum, section I.1).
Retention: Anthropic deletes inputs and outputs sent through its API (classification and the AI help chat) within 30 days of receipt or generation, except where longer retention is required by law or to enforce Anthropic's Usage Policy (content flagged as violating it up to 2 years). Anthropic does not use API data to train models.
Used: Only when the service's Anthropic connection is enabled: for classification during an import (otherwise classification runs rule-based inside the service), and for the AI help chat only when the user sends a question.
Sources: Anthropic Commercial Terms of Service, Anthropic Data Processing Addendum, Anthropic Privacy Center: How long do you store my organization's data? (read 18 October 2026) - Scaleway SAS (8 rue de la Ville-l'Évêque, 75008 Paris; SIREN 433 115 904 RCS Paris) (France)
Purpose: Service email: invitations, email address verification and password reset.
Data: The recipient's email address and the message content.
Location: Paris, France (Transactional Email region fr-par).
Transfer basis: No transfers outside the EU.
Sources: Scaleway legal notice, Scaleway Transactional Email API (region fr-par) - Cloudflare, Inc. (United States)
Purpose: Bot check (Turnstile) on sign-up and password reset.
Data: IP address, TLS fingerprint, browser User-Agent and the site key and origin. Cloudflare does not use them to profile individuals.
Location: United States and Cloudflare's network.
Transfer basis: EU–US Data Privacy Framework; EU standard contractual clauses for other transfers (Cloudflare Data Processing Addendum, sections 6.2 and 6.4).
Sources: Cloudflare Turnstile privacy policy, Cloudflare Customer DPA - Google Ireland Limited (Ireland)
Purpose: Google Analytics visitor statistics on public pages.
Data: A random browser identifier in a cookie, pages viewed, browser and device information and approximate location. Signed-in pages and customer data are not sent to Google.
Location: Ireland; Google transfers data to Google LLC in the United States.
Transfer basis: EU–US Data Privacy Framework; EU standard contractual clauses where needed (Google's data transfer solutions).
Used: Only with the visitor's consent and only where analytics is enabled.
Sources: Google Analytics Terms of Service, Finland (contracting party Google Ireland Limited; section 7), Google data transfer solutions
Other recipients
- The European Commission's VIES service: Stripe checks the customer's VAT ID.
Change history
The current list (version 1.2) is in effect from 19 October 2026.
- 1.2 (19 October 2026): Replit, Inc.: the service is hosted and its data stored on EU servers. No provider was added or removed.
- 1.0 (17 October 2026): First published list.