Sub-Processors
Locally.com, Inc. ("Locally") engages a small set of third-party service providers — referred to as "Sub-Processors" — to help us deliver our Services to our brand and retailer customers. This page lists our current Sub-Processors and the role each one plays.
| Sub-Processor | Role | Country of Processing | Categories of Data Processed |
|---|---|---|---|
| Stripe, Inc. | Payment processing for Buy Online Pick-Up In-Store (BOPIS) and Reserve Online Pick-Up In-Store (ROPIS) transactions | United States | Payment card data, transaction amount and metadata, payer contact information |
| Google LLC (Google Cloud Platform) | Cloud infrastructure, server hosting, key management, and storage for the Locally platform | United States | All Customer Data and End User Data hosted on the Locally platform |
| Cloudflare, Inc. | Content delivery network, web application firewall, and DDoS protection | United States (global edge network) | Network-level metadata (IP addresses, request headers); brief in-transit caching of public content |
| Mailgun Technologies, Inc. / Sinch AB | Transactional email delivery (account confirmations, order notifications, support replies) | United States | Recipient email addresses, sender metadata, message body for transactional notifications |
| Twilio Inc. | Transactional SMS delivery | United States | Recipient mobile phone numbers, SMS message body, delivery metadata |
Notice of Changes
Locally provides at least thirty (30) days' advance notice of any addition or replacement of a Sub-Processor. Notice is provided by updating this page and by email to the Customer Account Manager on file for each of our brand and retailer customers. Customer rights to object to a new Sub-Processor are set forth in the applicable Master Agreement or Data Processing Addendum.
Questions
Questions about this Sub-Processor list, or about Locally's data protection practices generally, can be directed to privacy@locally.com.