Subprocessors
Last updated: 2026-06-02
This page lists the third-party subprocessors Forethought Studios uses to provide Kestori. Subprocessors process merchant data only to host, operate, secure, or deliver the Kestori Shopify inventory forecasting and low-stock digest service.
Current subprocessors
| Subprocessor | Purpose | Location | Data handled |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting, database hosting, storage, and backups. | Germany | Shopify sessions, product records, variant records, inventory snapshots, sales velocity source data, merchant settings, merchant email records, operational logs, and encrypted backups. |
| Amazon Web Services EMEA SARL | Amazon SES email delivery for transactional and daily digest email. | European Union | Recipient email addresses, message headers, delivery metadata, and the email content needed to deliver Kestori transactional messages and low-stock digests. |
| Cloudflare, Inc. | Authoritative DNS and reverse proxy / TLS termination for kestori.com and app.kestori.com. | United States (corporate), with traffic processed on Cloudflare's global edge network including EU points of presence. | Request and response metadata for traffic to Kestori, including client IP addresses, request headers, session cookies, and the request and response bodies exchanged with the embedded Shopify admin app. |
| Functional Software, Inc. dba Sentry | Application exception and error monitoring for the Kestori backend. | European Union (Sentry EU region, Frankfurt). | Error events, stack traces, runtime environment metadata, and the request context attached to a failing operation. Kestori does not deliberately send shopper personal data to Sentry; merchant shop domains and operator email addresses may appear in error context. |
Subprocessor controls
Forethought Studios uses subprocessors only under written data processing terms that protect merchant personal data and limit processing to the services listed above. Forethought Studios remains responsible for each subprocessor's performance of its data protection obligations.
Changes to this list
If Forethought Studios plans to add or replace a subprocessor that will process merchant personal data, we will update this page and provide notice at least 14 days before authorizing a new subprocessor. Merchants may object to a new subprocessor by emailing [email protected] from the shop owner email address on file and explaining the reasonable data protection basis for the objection.
Questions
Questions about Kestori subprocessors or GDPR processing terms can be sent to [email protected].