Where your order data lives, and how it leaves.
Poppelo is hosted in the United States. This page says which region, which providers see your documents, how long we keep them, and how you get them back. It does not promise a residency option we do not have.
Hosting region
Documents, exports and audit exports are stored in AWS us-east-1 (Northern Virginia, United States). The API, the processing workers and the database run on Railway in the United States. The web application is served by Vercel from the United States. There is a single region; there is no EU or other in-region hosting option today, and we do not represent otherwise.
Model provider
Each document is read by Anthropic's Claude API in the United States. One call carries one document and only your own reference data; nothing from another customer is in the call. Your documents are not used to train models. We are confirming zero data retention on our Anthropic account and will say so here when it is confirmed.
Monitoring
Error reports go to Sentry. The Sentry project region is to be confirmed; until it is, treat it as the United States. Reports carry internal identifiers so support can find a failure; free text is scrubbed of email addresses, query strings and credential-shaped values before it leaves our servers, and document contents are not intentionally included.
Mail and sign-in providers
If you connect a Gmail or Microsoft 365 mailbox, Poppelo reads that mailbox through Google or Microsoft under their terms. Sign-in mail is sent through a transactional email provider. The subprocessor list names each one.
How long we keep data
Documents, extracted orders, exports and quarantined mail are kept for the retention window you set in Settings, from 1 to 84 months, 24 by default, and purged on a schedule. The audit log is kept for seven years. Learned sender addresses and extracted orders are retained with the account after offboarding, because they are the evidence behind past decisions; the privacy policy says so.
How data leaves
A full-tenant export (orders, documents, corrections, rules, profiles, reviews, invoices and the audit log) is available from Settings and the API. At offboarding the export runs first and the account is suspended, never hard-deleted. A Shopify store owner's customer data requests are honoured for that store.
Backups
The database is dumped nightly to object storage with a 35-day lifecycle, and a restore has been drilled at current size. Point-in-time recovery is not offered, so the recovery point is up to 24 hours. There is no contractual recovery objective yet.
Questions about this workflow
Can my data stay in the EU?
Not today. Poppelo runs in a single United States region and the model provider is in the United States. Transfers from the EEA or UK rely on the providers’ standard contractual clauses. Ask us if EU residency would decide your purchase; it is on the plan, without a date.
Who can see my documents?
Your own users, by role. Poppelo staff, only to resolve a support request you raise, and every access is in the audit log. The providers on the subprocessor list, only as far as the row says.
Ready to test the workflow?
Use your own orders during the trial, then review pricing and trial terms before you decide.