ShortStack Subprocessors

Cloud infrastructure hosting the ShortStack platform. Holds the database, entrant-uploaded files, analytics events, the search index and exports.

Email delivery for campaign autoresponders and broadcast emails. Only applies to customers using ShortStack's email marketing features.

Error and performance monitoring used for quality assurance.

Application logging and performance monitoring. Receives request logs from ShortStack services, including request paths, IP addresses and request parameters, so information submitted through a campaign form may appear in them. Logs are retained for 30 days and then deleted automatically.

Real-time messaging used to notify browsers when asset processing completes — video transcoding, PDF thumbnails, embedded media updates — and to signal content refreshes. Carries notifications rather than campaign content.

Converts entrant-uploaded PDF files into preview thumbnails. Runs automatically on any PDF submitted through a campaign.

Bot protection on published campaign pages, enabled or disabled by the customer. Receives the visitor's IP address, browser characteristics and the site key in order to distinguish a person from an automated request.

Entry delivery to a customer's own Mailchimp audience where the customer enables the integration. Email address, opt-in status, tags and mapped merge fields.

Entry delivery to a customer's own HubSpot portal where the customer connects it.

Entry delivery to a customer's own Klaviyo account where the customer connects it. Email address, profile fields, location and custom properties.

Bot scoring on form submissions, Instant Win qualification and voting. Off by default — the customer enables it using their own Google account.

Address autocomplete in campaign address fields, using the customer's own Google API key.

Where a customer configures a webhook, the mapped entry is sent to a destination the customer supplies. ShortStack neither selects nor controls the recipient.

Page views, clicks, shares and form events sent to the customer's own analytics or advertising property using identifiers the customer enters.

Where a customer adds their own script to a campaign, that script can read what is on the page, including form contents. Both the script and its destination are supplied by the customer.

Privacy representative in the EU and the UK for data protection matters. (Only has information about customers' data subjects if data subject submits information to exercise their privacy rights.)