Does Judge.me Work in China? Review Data, PIPL & Where It's Stored
Judge.me stores your shoppers' reviews, names and emails on AWS in the United States, with no mainland-China region — so collecting reviews from Chinese customers ships their personal data offshore under PIPL. A compliance-first look at the cross-border data door and the storefront ICP it rides on.
Does Judge.me work in China?
Yes, the reviews widget loads — but that is the easy half. The compliance question is the data behind it: Judge.me stores your reviewers' and customers' personal information on its offshore AWS cloud, so collecting reviews from mainland shoppers moves their data across China's border.
Judge.me's own sub-processor list says it uses Amazon Web Services for "Cloud hosting services to host user-generated content that Judge.me collects on the Controller's behalf," and names the United States as the storage location — with review photos on Imgix and videos on Cloudflare, also offshore. You are that "Controller": the reviews, names, emails and order data you gather from your Chinese customers are personal information, and holding them abroad is a cross-border transfer PIPL governs (Articles 38–43). Judge.me operates no mainland-China region, so none of it can be kept in-country. The table below is Judge.me's own wording and the rule each line triggers.
This is a risk map, not a verdict — whether you owe a transfer mechanism, in-country storage, or both turns on what you collect, how much you hold and who your users are. Our China team can map your exposure with you →
Compliance snapshot
- ! Judge.me stores your reviewers' names, emails and reviews on AWS in the US — offshore
- ! Collecting reviews from mainland shoppers is a cross-border transfer — PIPL applies
- ! Photo and video reviews sit on offshore media hosts (Imgix, Cloudflare)
- ✕ Judge.me runs no mainland-China region, so China review data can't be localized
- ! ICP rides on your storefront — offshore on Google Cloud — not on the review app
What Judge.Me's own documentation says about China
| Fact | Primary source |
|---|---|
| Judge.me stores your shoppers' review data on AWS, offshore in the United States. Its own sub-processor list says it uses Amazon Web Services for "Cloud hosting services to host user-generated content that Judge.me collects on the Controller's behalf," and gives the storage location as the United States. That "user-generated content" is your customers' reviews — their names, email addresses and the review text — and "the Controller" is you, the merchant. None of it is held in mainland China. | Judge.me — List of Judge.me's sub-processors (judge.me), retrieved 2026-10-07 |
| Your customers' photo and video reviews are stored offshore too. The same list names Imgix for "Premium image hosting, allowing Judge.me to store and display images" — storage location "United States and Germany" — and Cloudflare for "Premium video hosting allowing Judge.me to store and display videos," across multiple countries. So the images and clips a mainland shopper attaches to a review leave China the moment Judge.me stores them. | Judge.me — List of Judge.me's sub-processors (judge.me), retrieved 2026-10-07 |
| Judge.me acknowledges the data crosses borders — under EU-style safeguards, not Chinese law. Its sub-processor page states, "When data is transferred internationally, we apply one of the following safeguards," then lists "standard contractual clauses for the transfer of personal data to third countries" and a UK Addendum. Those answer to the GDPR. Data collected from mainland users engages China's PIPL cross-border rules instead — notice, separate consent and a CAC transfer mechanism (Articles 38–43), plus in-country storage for a CIIO or large-volume handler (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). | Judge.me — List of Judge.me's sub-processors (judge.me), retrieved 2026-10-07; PIPL Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) |
| The ICP question belongs to your storefront, which the review app rides on. Judge.me runs inside a storefront — most often Shopify, which states in its own engineering blog that "Shopify is now building our Cloud with Google": an offshore platform with no mainland-China region. A public site served to mainland visitors needs an ICP filing tied to in-country hosting (State Council Order No. 292; MIIT Order No. 33) — an obligation on the store, not on the embedded review app. Judge.me adds personal-data weight on top; it carries no ICP of its own. | Shopify Engineering — Shopify's Infrastructure Collaboration with Google (shopify.engineering), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Judge.me is not whether its star ratings and review carousel render on the page — it is where the data behind those reviews is permitted to live. Judge.me sets that out in its own sub-processor list: the reviews it gathers for you, together with the names, emails and media attached to them, are stored offshore — on Amazon Web Services in the United States, with photos and videos on hosts in the US, Germany and beyond — and it operates no region inside mainland China. Reaching a shopper is never the hard part here. The exposure is that every review a Chinese customer leaves becomes personal information you have carried across the border, into jurisdictions China’s law counts as foreign. A widget that renders is the easy part; whether you may lawfully hold the data behind it is what actually settles the question.
Judge.me in China at a glance
| What decides it | In Judge.me's own terms |
|---|---|
| Where your data lives | Judge.me's sub-processor list stores your user-generated content on Amazon Web Services, with the storage location recorded as the United States. No region sits inside mainland China. |
| What it collects | Per shopper: a name, an email, the written review, the order data behind each review request, and any photo or video uploaded — personal information, not anonymous metrics. |
| Media reviews | Images go to Imgix (“United States and Germany”) and videos to Cloudflare (across multiple countries) — both offshore from the mainland. |
| Crossing the border | Judge.me itself transfers data internationally under “standard contractual clauses” and a UK Addendum — GDPR instruments, not China's. For mainland data, PIPL's cross-border rules apply. |
| ICP & the storefront | ICP attaches to your storefront — typically Shopify, which runs on Google Cloud offshore — not to the Judge.me app. Judge.me adds data weight; it holds no ICP of its own. |
Judge.me keeps your review data offshore — and names where
Judge.me does not keep your reviews in mainland China, and it is open about where it does keep them. Its sub-processor list assigns your user-generated content to Amazon Web Services for “Cloud hosting services to host user-generated content that Judge.me collects on the Controller’s behalf,” with the storage location recorded as the United States. The photos shoppers attach go to Imgix — “Premium image hosting, allowing Judge.me to store and display images,” stored in the United States and Germany — and the videos to Cloudflare, “Premium video hosting allowing Judge.me to store and display videos.” Every one of those locations is outside the mainland.
The roles in that first sentence are the part that matters. Judge.me collects the content “on the Controller’s behalf,” and the Controller is you, the merchant. Judge.me processes the data; you are the party answerable for sending it abroad. “Our reviews app already works” does not close the question, because reaching a customer and lawfully holding that customer’s personal data are two separate tests — and only the second turns on where Judge.me’s servers sit.
A review is personal information, so collecting it from China is a transfer PIPL governs
A product review is built from exactly the data China’s law protects. What Judge.me stores for each shopper is not an anonymous score: it is a name, an email address, the written review itself, and — because review requests are triggered by orders — the order data behind that request, alongside any photo or video the customer uploads. All of it names, contacts and profiles a real person, which makes it personal information under China’s Personal Information Protection Law.
Because that information is collected from mainland users and then stored in the United States, Germany or elsewhere offshore, PIPL treats the flow as a cross-border transfer: the handler must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). Judge.me’s own answer to international transfer is “standard contractual clauses” and a UK Addendum, instruments written for the GDPR rather than for China. And if you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty a service hosted only in the US and Germany has no way to meet.
Reachable, but the door that decides it is the storefront’s ICP
Judge.me is not blocked in China. Its widget loads from offshore, and because it loads from offshore it can be slower or less dependable than an asset served from inside the mainland — yet a review carousel that appears on cue is still a carousel whose data lives in another country. How quickly the stars paint changes nothing about the compliance position.
It is just as important not to point at the wrong door. The ICP filing a public mainland site requires (State Council Order No. 292; MIIT Order No. 33) attaches to the storefront that serves your visitors — for most merchants Shopify, which says in its own engineering blog that “Shopify is now building our Cloud with Google” and runs no region inside mainland China. That filing is the store’s obligation, not the review app’s; Judge.me rides on the store and carries no ICP of its own. So the honest reading is this: Judge.me adds real personal-data weight, but it is a layer on a storefront whose ICP and cross-border position are the actual determinant. On the app itself, the live question is narrow and singular — where your review data is collected and where it ends up stored.
None of this is a verdict — it is a risk map. Whether your obligation is a transfer mechanism, in-country storage, or both comes down to what you collect, the volume you hold, and who your shoppers are, and that is a line to settle with counsel before you build on it.
Where 21YunBox fits — a compliant overlay, not a migration
You keep Judge.me exactly where it is. Reviews, ratings, and the photo and video testimonials your shoppers upload go on working, and nothing moves. The one piece an offshore reviews app cannot provide on its own is a lawful mainland footing — so that is what we add: ICP-filed delivery from inside the mainland, set in front of the origin you already run, with no rebuild and no parallel codebase. Our China team maps the PIPL cross-border and data-residency position of the personal data Judge.me holds for you, weighs it against your entity, your volumes and your users, and reviews the ICP standing of the storefront the app depends on — then stands up the in-country delivery and compliant data handling a lawful China presence requires, while your store and Judge.me stay right where they are.
Related reading:
Frequently Asked Questions
Does Judge.me need its own ICP filing in China?
No. An ICP filing attaches to the website that serves mainland visitors — your storefront, which for most merchants is Shopify — not to the Judge.me app embedded inside it. Judge.me runs as an add-on to that store, so the ICP obligation (State Council Order No. 292; MIIT Order No. 33) sits with the storefront layer. Treating the review app as if it needed its own filing would aim the assessment at the wrong layer. What Judge.me does add is cross-border personal-data exposure, and that is the question to focus on for the app itself.
Is it a problem that our reviews are stored outside China?
Treat it as a cross-border transfer to work through with counsel, not a simple yes or no. Judge.me's sub-processor list places your user-generated content on AWS in the United States, with photos and videos on Imgix and Cloudflare offshore. The reviews, names, emails and order data you collect from mainland shoppers are personal information, so moving them abroad engages PIPL's cross-border rules — notice, separate consent and a transfer mechanism (Articles 38–43). Whether in-country storage is also required depends on your role and your data volumes (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)).
Can 21YunBox help make our Judge.me setup work in China?
Yes. Our China team can map your exposure — assessing the PIPL cross-border and data-residency position of the personal data Judge.me collects for you, and the ICP status of the storefront it rides on — then stand up the ICP-filed, in-country delivery a compliant China presence needs, in front of the storefront and Judge.me stack you already run. Get in touch to work through your specific case.
