QueueFront subprocessor disclosure
Effective date: 2026-10-08
QueueFront is operated by AtlasFlare LLC. The providers below support its service. This disclosure describes the processing scope; it does not promise that every provider operates exclusively in the United States. Provider terms govern their own retention and processing separately from QueueFront’s application controls.
Service providers
| Provider | Purpose and information involved | Location and terms |
|---|---|---|
| Cloudflare | DNS/TLS, waiting-room Workers, Durable Objects, KV, rate limiting, Turnstile and encrypted R2 backups. Handles request/session identifiers, configuration, queue state, security signals and encrypted backup objects. Signup requests can transit the edge/proxy path. | Distributed services; no exclusive processing region is asserted. Data processing addendum and service subprocessors. |
| OVHcloud | Server/network hosting for the control plane, database and static website. Hosts tenant configuration, protected identifiers/order evidence, encrypted contact data, consent records and operational logs. | The QueueFront control-plane server is in US East/Vinthill, United States. This location does not describe every other provider. US data processing agreement. |
| RunCloud | Server management and monitoring. Processes service/deployment metadata, configuration and operational logs; its AI Monitoring path is described below. | RunCloud’s DPA identifies RunCloud Sdn Bhd in Malaysia; that does not establish one exclusive processing location. Privacy policy and DPA. |
| Fastmail | Business email hosting for QueueFront support and other monitored contact channels. Processes correspondence, sender/recipient details and attachments supplied in those exchanges. This is separate from automated shopper notifications. | Provider processing and retention follow the applicable Data Protection Agreement and privacy policy; no exclusive processing location is asserted. |
| Resend | Delivery for enabled Waiting List and Waiting Room emails. Processes recipient addresses, message content, delivery status and tracked-link activity. | The configured sending region is US East. Resend describes stored customer data as US-based regardless of sending region. DPA and storage/retention information. |
| Twilio — conditional SMS and carrier onboarding | Supports assisted toll-free SMS setup, carrier verification, message delivery and opt-out handling. Information can include merchant verification submissions sent directly to Twilio, bounded registration references, phone numbers, message content, delivery status and opt-out events. | SMS is subject to separate merchant verification and carrier/provider activation. No exclusive processing location or general SMS availability is asserted. Data protection addendum. |
Twilio has been used for development carrier onboarding; conditional availability does not mean it has never received registration data. Voice forwarding is not a generally available QueueFront service.
RunCloud AI Monitoring
AtlasFlare uses RunCloud AI Monitoring for internal server diagnostics. RunCloud’s published terms, reviewed October 6, 2026, describe operational logs and technical metadata analyzed with OpenAI as a downstream provider, a 30-day monitoring retention period, and no use of that data to train OpenAI foundation models. These are attributed provider terms, not an independent audit of each transfer. No exclusive processing region is asserted. See the AI Monitoring terms.
Email delivery and tracking
The managed email domain has click tracking enabled and open tracking disabled. Tracked links use a provider redirect. Resend click events can include the link, time, IP address and browser user agent; QueueFront retains the correlated event and first-click timestamp, not those raw click details or webhook bodies.
Resend’s published standard retention is 30 days for email/log data on Free, Pro and Scale plans, seven days for backups, and deletion of remaining customer data within 90 days after account termination. Enterprise arrangements can differ. These provider periods do not describe QueueFront’s own stored copies. See Resend’s retention explanation.
Merchant-selected Shopify platform
Shopify is the merchant-selected commerce platform and data source, rather than infrastructure appointed solely by QueueFront. The merchant’s Shopify agreement continues to apply.
Shopify also provides Sidekick. QueueFront’s setup-link integration receives structured suggestions when the merchant opens the link, validates them against the signed-in store, and prefills an ordinary form for merchant review and save. It does not request the full Sidekick conversation or add a separate QueueFront model provider for this feature.
Website and development tooling
The public website is static Astro output hosted through RunCloud/OVHcloud. The current Coming Soon page has no forms. Cloudflare can append its Web Analytics beacon to public website responses for page-view and performance measurement. See Cloudflare Web Analytics. This website measurement is separate from shopper admission and email link tracking. Local development and test assistants are not part of the production shopper-data processing path and must not receive live merchant or customer data.
Transfers and provider changes
The linked provider agreements describe their contractual safeguards, including transfer provisions where applicable. Their publication alone is not proof that every customer-specific transfer assessment or contractual step is complete. QueueFront must establish the applicable safeguards before broader processing that requires them; this disclosure does not assert that every merchant-specific transfer review or private annex has been completed.
A material new provider must be reviewed for purpose, access, security, retention, contractual safeguards and disclosure before receiving live customer data. Changes will be posted before they take effect when reasonably practicable. Merchants may raise a reasonable data-protection objection through [email protected], as described in the Merchant Data Agreement.