Sub-processors

How to Read This Page

A sub-processor is a company we rely on to run vvault that may, in the course of providing its service to us, process personal data. This page lists every one of them, what it does, where it processes data, and - when that is outside the European Economic Area - the legal mechanism that makes the transfer lawful.

This list forms part of our Data Processing Agreement. We give at least thirty (30) days' notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds as described in Section 7 of the DPA.

Infrastructure sub-processors are engaged for the whole platform and cannot be declined individually while continuing to use vvault. Optional sub-processors are engaged only if you switch on the corresponding feature or give the corresponding consent, and declining them leaves the rest of the product fully usable.

Infrastructure

Supabase - primary database, authentication, and object storage for audio files, cover art, licence documents and invoices. Processing location: European Union (AWS EU region). No transfer mechanism required for the storage itself; the vendor's own support operations may involve limited access from outside the EEA under the Standard Contractual Clauses.

Vercel - application hosting, edge delivery, and request and error logs. Processing location: European Union edge regions for request handling, with company operations in the United States. Transfer mechanism: Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supplemented by the vendor's technical measures.

Resend - delivery of transactional email (verification codes, password resets, receipts, security notices) and of the campaigns you send to your own contacts. Data processed: recipient email addresses, message content, and delivery and engagement events. Processing location: United States. Transfer mechanism: Standard Contractual Clauses.

Payments

Stripe - card processing, subscriptions, marketplace checkout, seller onboarding and identity verification, payouts, and invoicing. Data processed: buyer name and email, billing address and country, payment method metadata, transaction records, and - for sellers - the identity and bank details required by anti-money-laundering law. Processing location: Ireland and the United States. Transfer mechanism: Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Stripe acts as an independent controller for parts of this processing, in particular fraud prevention and its own regulatory obligations.

Apple - in-app purchases made through the iOS app. Apple is the merchant of record for those purchases and acts as an independent controller in respect of the payment data it collects; we receive only the subscription status and transaction identifiers. Processing location: Ireland and the United States.

Optional - Only If You Enable the Feature

Google (sign-in) - if you choose to sign in with Google, Google processes your authentication request and returns your name, email address and profile image. Processing location: United States. Transfer mechanism: EU-US Data Privacy Framework.

Google (Gmail sending) - if you connect a Gmail account to send campaigns from your own address, we store the tokens required to send on your instruction and Google processes the resulting messages. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google (Drive import) and Dropbox - if you import audio from either provider, you select the files in that provider's own picker and only the selected files are transferred into your library. For Google Drive we operate under the drive.file scope, which gives no access to the rest of your storage.

Google Analytics - measurement of how the public pages and the product are used. Loaded only where you have accepted analytics cookies. Processing location: United States. Transfer mechanism: EU-US Data Privacy Framework.

Optional - Only With Your Consent to Marketing Cookies

Meta Platforms - measurement of the effectiveness of our advertising, through both the browser pixel and the server-side Conversions API. Data processed: a hashed email address, a hashed internal user identifier, IP address, user agent, and the event that occurred (for example: an account was created, a subscription was started).

This processing takes place only where you have accepted marketing cookies, and it stops for both the browser and the server-side path when you decline or withdraw that consent. Hashing reduces exposure but does not make the data anonymous: it remains personal data, because the entire purpose of sending it is to match it to an existing profile. We treat it accordingly.

Processing location: Ireland and the United States. Transfer mechanism: EU-US Data Privacy Framework. You can withdraw consent at any time through the cookie settings link, with effect for the future.

What Is Not on This List

We do not sell personal data, and we do not share it with data brokers, advertising networks other than the one named above, or any third party for their own marketing purposes.

Tools that never receive personal data - for example purely local build tooling - are deliberately not listed, because listing them would make this page harder to check rather than more transparent.

If you believe a vendor is missing from this page, tell us at privacy@vvault.app. We would rather be corrected than be quietly wrong.