Last updated: 14 September 2026
These are the third parties involved in delivering NASST. We publish the list because Article 28(2) of the UK GDPR requires you to know who processes data on your behalf, and because Amazon's Data Protection Policy requires us to keep track of it.
We give 30 days' notice before adding a sub-processor. See §5.3.4 of the Data Processing Agreement for your right to object.
| What it does | The Selling Partner API. Everything NASST shows comes from here |
| Data it receives | Requests to your own Amazon account, authorised by you |
| Location | EU endpoints for UK and European marketplaces |
| Transfer basis | Not applicable — your own data, at your own provider, on your instruction |
Amazon is not a sub-processor in the ordinary sense. It is the source of the data and you already have a direct relationship with it. Listed for completeness.
| What it does | Delivers account emails — verification, password reset, security notices |
| Data it receives | Your email address and the content of the message |
| Location | France, with data centres in the European Union |
| Transfer basis | None required. Brevo is an EEA processor, so this is not a restricted transfer |
| Article 28 terms | Appendix 3 of Brevo's Terms of Service, accepted at sign-up |
Only transactional email. We do not send marketing. The domain's DKIM records are verified, so account email leaves under nasst.co.uk rather than from a consumer mailbox.
Until 2 September 2026 this role was performed by Google (Gmail SMTP) in the United States, relying on the UK extension to the EU-US Data Privacy Framework. Moving it to an EEA provider removed that transfer entirely.
| What it does | Receives the info@nasst.co.uk mailbox |
| Data it receives | Whatever you choose to send to that address, including a data subject request and any identity information sent with it |
| Location | Microsoft stores content in its UK or EU region under its residency terms; GoDaddy, which resells the service, is a United States company |
| Transfer basis | Mailbox content stays within Microsoft's UK or EU region, both adequate for UK transfers. For GoDaddy, the UK International Data Transfer Agreement is deemed executed within its Data Processing Addendum, with the Data Privacy Framework applying first where available |
Sending email and receiving email are different providers, and both belong on this list. Brevo sends; this mailbox receives.
| What it does | Looks up a barcode from a product name when Amazon's catalogue has none |
| Data it receives | A product name or barcode. Nothing else |
| Location | United States |
| Transfer basis | No personal data is transferred |
Worth being precise: UPCitemdb receives a search string such as a product title. It does not receive your email address, your account identifier, your IP address or any Amazon data about your business. It cannot tell that two lookups came from the same customer.
| What it does | The same job as UPCitemdb, on the "Barcode fallback" switch in Extract & Match: finds a barcode from a product name when a match fails without one |
| Data it receives | A product name or brand. Nothing else |
| Location | France. Both are run by Open Food Facts, a French non-profit association |
| Transfer basis | None required. France is in the EEA, so this is not a restricted transfer |
These are free, public, crowd-sourced product databases. The lookup is made by our server, not by your browser, so your IP address never reaches them, and the search string carries nothing about you or your Amazon account. A barcode found this way is treated as a hint: the Amazon listing it points at is still scored on its own merits before anything is shown to you.
The switch is on by default and can be turned off for any run. With it off, no product name leaves the app for these services at all.
| What it does | Price, sales-rank and offer-count history; the hourly deal feed; and looking up who a competing seller is |
| Data it receives | A product identifier (ASIN), a category, deal search filters, a competing seller's Amazon merchant ID, and our API key |
| Location | Kemnath, Germany — inside the EEA |
| Transfer basis | UK adequacy regulations for the EEA. No Standard Contractual Clauses required |
Keepa does not receive your email address, your account identifier, or your own Amazon credentials. It cannot tell that two lookups came from the same customer, or which customer — every request goes on one API key that is ours, not yours.
Two things Keepa now receives that it did not before, added 28 August 2026:
*Competing sellers' merchant IDs.* When you look at who else is selling a product, we ask Keepa to resolve those sellers' IDs into shop names. Those IDs identify other Amazon businesses, not you, and Amazon already publishes the names on the listing page. Keepa also returns a trading address, a VAT number and a company registration number, and the code discards all three before anything is stored or sent to a browser.
From 14 September 2026 the names are fetched automatically for the sellers already shown on your screen, rather than only when you ask for one. The reason is a practical one: a listing where the *brand itself* is one of the sellers is a listing worth walking away from, and that is invisible while the page shows merchant IDs.
A name resolved this way is kept for 90 days, and it is only the name — no address, no Buy Box share, no catalogue. Asking for a seller's full record, on the Seller Lookup, still returns the Buy Box share and what they sell, and that fuller answer is kept for 24 hours.
*Deal search filters.* The hourly deal sweep sends the categories and price ranges being watched. Those are search terms, not personal data, and the same query is run once for every customer watching it rather than once per customer.
Keepa confirmed in writing on 11 August 2026 that displaying its data inside a commercial product is permitted under an ordinary paid subscription. We do not resell API access, which is the one thing their terms prohibit.
| What it does | Takes subscription payments and stores your card |
| Data it receives | Your email address, billing details and card details |
| Location | Ireland and the UK. The contracting entities are Stripe Payments Europe, Limited and Stripe Payments UK Ltd, with onward processing by Stripe, Inc. in the United States |
| Transfer basis | Stripe's Data Processing Agreement (https://stripe.com/legal/dpa), which incorporates Standard Contractual Clauses and the UK Addendum for onward transfers to Stripe entities outside the EEA |
Card details never reach our servers. Payment is handled on the provider's own hosted pages, so we hold an identifier for your subscription and nothing that could be used to charge a card.
| What it does | Runs the servers |
| Data it receives | Technically all of it, as the infrastructure it runs on |
| Location | Helsinki, Finland |
| Transfer basis | None required. Section 3 of the Data Processing Agreement concluded on 2 September 2026 commits Hetzner to processing exclusively within the EU or EEA, with any third-country transfer requiring our prior consent |
None. As of 2 September 2026 there are no content delivery networks, and no third party is contacted when you load any page of this service.
Until that date your browser fetched styling, JavaScript libraries, spreadsheet export code and typefaces from Tailwind CDN, unpkg, SheetJS CDN and Google Fonts. Those requests carried your IP address to four companies outside the United Kingdom before you had agreed to anything, simply as a consequence of opening the page.
Every one of those files is now served from our own servers in Finland. This is verifiable rather than asserted: load any page with your browser's network tools open, and every request goes to nasst.co.uk or app.nasst.co.uk.
This removed the last international transfer of personal data in this service.
Named because their absence is a meaningful commitment:
| Not used | What it would have meant |
|---|---|
| Analytics providers | Your behaviour in the app sent to a third party |
| Advertising networks | Tracking you across other websites |
| Error-reporting services | Crash data, sometimes including request contents, sent off-site |
| Customer-support widgets | A third-party script with access to the page you are on |
This changed on 28 August 2026. SerpApi previously appeared above as a provider we had removed. It is now available again, on a different footing: it runs on your own SerpApi account and your own API key, which you add yourself in Account and can remove at any time.
| What it does | Live retailer price comparison in Best Offers |
| Data it receives | A product name or search term, and your own API key. Nothing about you |
| Location | United States |
| Whose account | Yours. You hold the contract with SerpApi and the searches are billed to you |
| If you do not add a key | SerpApi is never called and receives nothing. Best Offers still works, using free search links |
Your key is encrypted before it is stored and is never sent back to any page — only its last four characters are ever shown, so you can tell which key is saved. Deleting your account deletes the key with everything else.
> For review before launch. Because the account and the contract are yours, > SerpApi is arguably not our sub-processor at all — we relay your search term > to a provider you chose, using your credentials. It is listed here anyway, > because a data flow the customer cannot see is worse than one described under > the wrong heading. Whether it belongs in 6.1 as a sub-processor, or in a > separate section as a customer-directed integration, is a question for the > solicitor rather than one to settle in code. SerpApi confirmed the > arrangement itself is permitted — see SUPPLIER_ANSWERS.md section 3.
Added 2026-08-28. This is the one feature where data reaches us from somewhere other than Amazon, so it is described separately rather than folded into the table above.
You browse a supplier's or retailer's website yourself. When you find a page worth checking, you press the extension's button (or Alt+Shift+S). That sends that one page's HTML to NASST, where the product names, prices and barcodes are pulled out and looked up on Amazon using your own Amazon connection.
| What we receive | The HTML of a page you explicitly chose to send |
| When | Only when you press the button. Never automatically, never in the background |
| What the extension can read | The page you are on at the moment you press it. It has no site list, no scheduled activity and no access to your browsing history |
| Where it goes | This app only. The extension will talk to no other address |
| How long we keep it | 24 hours, then the stored page is deleted automatically |
| Who can see it | You. Saved pages are recorded against your account and no other customer can list, read or delete them |
We do not crawl retailer websites. We do not fetch pages you have not sent. We do not follow links out of a page you send. Nothing about your browsing outside the moment you press that button reaches us.
A retailer's website has its own terms, and some of them restrict automated collection. You are the person visiting that site, using your own browser, on a page you chose. That relationship is between you and them, and it is your responsibility to stay inside their terms — sending a page to NASST does not change what you were allowed to do with it. We provide the tool; we cannot and do not agree those terms on your behalf.
It is downloaded from inside NASST and installed unpacked, which means you can read every line of it before you install it. It is six files: a manifest, one background script and three icons. Deleting the folder uninstalls it.
Products are matched to Amazon listings by barcode where the page gives one, and otherwise by comparing brand, name and size. The comparison is deliberately cautious — a candidate is rejected when its size or variant contradicts the source — but a match is still an inference. Check anything before you buy it. See document 2 §2.7 for what that means for liability.
We will email account holders at least 30 days before adding a sub-processor.