Sub-processors
Effective November 1, 2026
Overview
Cast Hook LLC uses the service providers below to run Canora. Each receives only the data it needs to perform its function for us. What we collect and why is explained in our Privacy Policy.
Service providers
| Provider | Purpose | Location |
|---|---|---|
| OVHcloud | Hosting, databases and file storage | United States |
| Amazon Web Services | Encryption key management | United States |
| Cloudflare (R2) | Encrypted off-site copy of our database backups and stored files | North America |
| Shippo (Popout, Inc.) | Shipping rates, labels, address validation, tracking and returns Own-terms sub-processor. Processes partly under its own terms. Its Data Processing Addendum makes it a data controller when it uses the data for analytics, to develop and improve its products, and to share with selected partners for their own use. | United States |
| Stripe | Subscription billing and payments | United States |
| Postmark (AC PM LLC) | Transactional email, including shipping notifications to your shoppers | United States |
| Auth0 (Okta) | Sign-in and multi-factor authentication | United States |
| OpenRouter | AI processing of product information and images, routed with data collection turned off to the model providers OpenAI, Anthropic, Google, ByteDance and Alibaba | United States |
| Wiro AI | AI image generation Own-terms sub-processor. Processes under its own terms, not bound by our Data Processing Agreement. Its own policy calls it a data controller, its licence covers using your data to "improve the service", and the model hosts behind it (such as ByteDance/Seedream) receive the photos. | United States |
| Hive (Castle Global, Inc.) | Safety scan of AI-generated images | United States |
| OpenAI | AI image direction (reads product photos, product details and the appearance descriptions of your brand models, never their names or portraits) | United States |
| Grafana Cloud | Operator cluster metrics shipped by the Grafana Alloy collector, for the cluster operators only. No logs and no traces. | United States |
| Maps and web fonts | United States | |
| Brandfetch | Sales-channel logos (loaded by your browser) | Switzerland |
| Resend | Waitlist sign-ups and email for this website | United States |
To look up product details we also send barcodes or product categories, and nothing else, to product lookup services (UPCitemdb, eBay, DataForSEO and Serper). DataForSEO is based in Estonia.
If you track how your products appear in AI answers, we send the shopping questions you choose to track, and nothing else, to OpenAI, DataForSEO and Perplexity. Perplexity is based in the United States.
Locations are where each provider is based. Some providers, in particular AI model providers, may process data in other countries. The ByteDance and Alibaba models reached through OpenRouter are served from Singapore, and Alibaba may also process data in China.
Open data we use
Canora suggests product names, brands and categories from a copy of the Open Food Facts, Open Beauty Facts, Open Products Facts and Open Pet Food Facts databases, made available under the Open Database License (ODbL), with individual contents under the Database Contents License (DbCL). We keep an unmodified copy on our own servers, so a lookup sends nothing to these projects, and we do not alter their data. The databases are available from world.openfoodfacts.org/data. We do not use their images.
A suggestion built from this data says so where you review it: “Contains data from Open Food Facts, available under the Open Database License (ODbL).”
Changes to this list
When we add a provider, we email the owners and admins of every Canora workspace. Whenever the list changes, we update this page and its effective date. This page is the current record.
Contact
Questions about this list: Cast Hook LLC · trust@canora.ai