Published on 16 October 2026. Changes that are not in your favour apply to existing accounts from 19 November 2026; changes in your favour or required by law apply on publication. Every company that can touch personal data in the course of running vvault, what it does, where it processes, and under which transfer mechanism. This page is part of our Data Processing Agreement.
This document exists in French and in English. Both versions have the same value; in case of doubt, the interpretation most favourable to the consumer prevails.
1How to Read This Page
A sub-processor is a company we rely on to run vvault that may, in the course of providing its service to us, process personal data. This page lists every one of them, what it does, where it processes data, and, when that is outside the European Economic Area, the legal mechanism that makes the transfer lawful.
This list forms part of our Data Processing Agreement. We give at least thirty (30) days' notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds as described in Section 7 of the DPA.
Infrastructure sub-processors are engaged for the whole platform and cannot be declined individually while continuing to use vvault. Optional sub-processors are engaged only if you switch on the corresponding feature or give the corresponding consent, and declining them leaves the rest of the product fully usable.
2Infrastructure
Supabase: primary database, authentication, and object storage for cover art, licence documents and invoices. Processing location: European Union (AWS EU region). No transfer mechanism required for the storage itself; the vendor's own support operations may involve limited access from outside the EEA under the Standard Contractual Clauses.
Cloudflare (R2): storage and delivery of audio files. Processing location: Cloudflare's global network (the bucket is not restricted to the EU). Transfer mechanism: EU-US Data Privacy Framework and Standard Contractual Clauses.
Vercel: application hosting, edge delivery, and request and error logs. Processing location: European Union edge regions for request handling, with company operations in the United States. Transfer mechanism: Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supplemented by the vendor's technical measures.
Resend: delivery of transactional email (verification codes, password resets, receipts, security notices) and of the campaigns you send to your own contacts. Data processed: recipient email addresses, message content, and delivery and engagement events. Processing location: United States. Transfer mechanism: Standard Contractual Clauses.
Apple (push notifications): delivery of notifications to the iOS app through the Apple Push Notification service. Data processed: a device token and the notification content. Processing location: United States. Transfer mechanism: Standard Contractual Clauses.
3Payments
Stripe: card processing, subscriptions, marketplace checkout, seller onboarding and identity verification, payouts, and invoicing. Data processed: buyer name and email, billing address and country, payment method metadata, transaction records, and, for sellers, the identity and bank details required by anti-money-laundering law. Processing location: Ireland and the United States. Transfer mechanism: Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Stripe acts as an independent controller for parts of this processing, in particular fraud prevention and its own regulatory obligations.
Apple: in-app purchases made through the iOS app. Apple is the merchant of record for those purchases and acts as an independent controller in respect of the payment data it collects; we receive only the subscription status and transaction identifiers. Processing location: Ireland and the United States.
RevenueCat: subscription analytics for the iOS app. Data processed: App Store transaction data and your vvault user id. Processing location: United States. Transfer mechanism: EU-US Data Privacy Framework or Standard Contractual Clauses.
4Features
ACRCloud: audio recognition for WaveMatch. Data processed: an audio excerpt of the track you run WaveMatch on. Endpoint: identify-eu.acrcloud.com (EU). Transfer mechanism: Standard Contractual Clauses where data leaves the EEA.
GIPHY: GIF search in messages. Data processed: your search terms; the GIFs are then loaded from GIPHY's servers, which see your IP address. Processing location: United States. Transfer mechanism: Standard Contractual Clauses.
AppsFlyer (OneLink): app-store links that carry a creator's code. Data processed: the link clicked and technical device data. Processing location: Israel (adequacy decision) and the United States. Transfer mechanism: adequacy decision and Standard Contractual Clauses.
5Optional: Only If You Enable the Feature
Google (sign-in): if you choose to sign in with Google, Google processes your authentication request and returns your name, email address and profile image. Processing location: United States. Transfer mechanism: EU-US Data Privacy Framework.
Google (Gmail sending): if you connect a Gmail account to send campaigns from your own address, we store the tokens required to send on your instruction and Google processes the resulting messages. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Google (YouTube API Services): if you connect a YouTube channel, vvault uploads and schedules your videos, updates their details and reads their statistics through the YouTube API. Google's Privacy Policy applies to Google's processing (see the Privacy Policy, section 10).
Meta (Instagram API): if you connect an Instagram account, vvault accesses it through Meta's API only for the feature you use.
Google (Drive import) and Dropbox: if you import audio from either provider, you select the files in that provider's own picker and only the selected files are transferred into your library. For Google Drive we operate under the drive.file scope, which gives no access to the rest of your storage.
Google Analytics, and Vercel Analytics / Speed Insights (Vercel, United States, Standard Contractual Clauses): measurement of how the public pages and the product are used. Loaded only after you accept analytics cookies. Google processing location: United States. Transfer mechanism: EU-US Data Privacy Framework.
6Optional: Only With Your Consent to Advertising Cookies
Meta Platforms: measurement of the effectiveness of our advertising, through both the browser pixel and the server-side Conversions API. Data processed: a hashed email address, a hashed internal user identifier, IP address, user agent, and the event that occurred (for example: an account was created, a subscription was started).
This processing takes place only where you have accepted advertising cookies, and it stops for both the browser and the server-side path when you decline or withdraw that consent. Hashing reduces exposure but does not make the data anonymous: it remains personal data, because the entire purpose of sending it is to match it to an existing profile. We treat it accordingly.
Processing location: Ireland and the United States. Transfer mechanism: EU-US Data Privacy Framework. You can withdraw consent at any time with "Cookie settings" at the bottom of every page, with effect for the future.
Creators' pixels: on a creator's pages, and only with your consent, that creator's own Meta pixel or Google tag (Meta Platforms Ireland / Google Ireland). vvault and the creator are joint controllers for the collection (see the Privacy Policy, section 13A).
7What Is Not on This List
We do not sell personal data, and we do not share it with data brokers, advertising networks other than the ones named above, or any third party for their own marketing purposes.
Tools that never receive personal data (for example purely local build tooling, or the Spotify and SoundCloud catalogue searches our servers make without any personal data) are deliberately not listed, because listing them would make this page harder to check rather than more transparent.
If you believe a vendor is missing from this page, tell us at contact@vvault.app. We would rather be corrected than be quietly wrong.