Account and security
Where is my data processed?
The database and the application run in the European Union, and the processors we use are listed by name in the privacy policy along with what each one does. That register is the authoritative version and it is kept current, which is why this answer points at it rather than repeating a list that could drift.
The practical shape: your store data lives in one European database, third-party tokens are encrypted at rest and only ever decrypted server-side at the moment of a call, and no service-role credential ever reaches your browser.
We hold no customer names, addresses or email addresses from your store, which keeps the surface small on purpose.
Did this answer it? If not, a person who knows the product will.