1 · Roles
For the shop data the plugin sends, you are the controller and Artificial Systems SRL is the processor. [full DPA text]
2 · Location
Processing and storage in the EU. Backups go to an EU target with 30-day retention.
3 · Security
Tenant data is isolated per account in the database. Click IDs and identifiers are stored as keyed hashes; credentials are sealed before they are stored. [technical and organisational measures annex]
4 · Sub-processors
See the subprocessor list.