Subprocessor List
This page names the third-party providers (Subprocessors) that Vexaro engages to help provide the Service and that may Process Personal Data for us. For each provider it gives the purpose, the Personal Data the provider receives, and the safeguard for processing outside the EEA. Section 4 explains how Vexaro tells Customers about changes.
1. Introduction
A Subprocessor is a third party that Vexaro engages to Process Personal Data in order to provide the Service. Subprocessors carry out specific supporting functions, such as server and relay hosting, edge delivery, payment processing, and email delivery, on Vexaro’s behalf and on Vexaro’s instructions.
Where Vexaro engages a Subprocessor, it imposes on that Subprocessor, by written contract, data-protection obligations equivalent in substance to those that apply to Vexaro under the Data Processing Addendum, and Vexaro remains responsible to the Customer for the Subprocessor’s performance of those obligations. Vexaro engages each Subprocessor only for the limited purpose and data categories described below.
Vexaro keeps this page current and lists its Subprocessors by name in Section 2. Under the general authorisation in the Data Processing Addendum, Vexaro notifies Customers of any new or replacement Subprocessor as described in Section 4, and the Customer may object on documented data-protection grounds.
This list complements the Privacy Notice, which explains the categories of data Vexaro Processes and the choices available to individuals. Defined terms used here have the meaning given in the Terms of Service.
2. Current Subprocessors
Vexaro engages the following Subprocessors to Process Personal Data in order to provide the Service. Each is engaged only for the limited purpose and data categories shown, under a written contract that imposes data-protection obligations equivalent in substance to the Data Processing Addendum. For Self-Hosted Deployments, see Section 3.
| Subprocessor | What it does | Personal Data it receives | Safeguard where processing is outside the EEA |
|---|---|---|---|
| NSP LLC | Hosting of the servers, operated by Vexaro, that run the Service and store its data | All Service data, including Recordings | Standard Contractual Clauses |
| Serverius | Hosting of Vexaro relay servers | IP addresses and connection metadata; relayed session data, end-to-end encrypted between Vexaro apps of version 0.2.13 or later and readable by the relay only for older versions, held in memory while the session lasts | Standard Contractual Clauses |
| OVHcloud | Hosting of Vexaro relay servers | IP addresses and connection metadata; relayed session data, end-to-end encrypted between Vexaro apps of version 0.2.13 or later and readable by the relay only for older versions, held in memory while the session lasts | Standard Contractual Clauses |
| Cloudflare, Inc. | DNS, TLS termination, edge delivery, bot protection (Turnstile), and DDoS protection for Vexaro’s websites and API | IP addresses, connection metadata, and HTTPS traffic to Vexaro’s websites, API, and browser viewer, which Cloudflare decrypts at its edge (including the session media of browser-viewed sessions) | EU-US Data Privacy Framework; Standard Contractual Clauses |
| Stripe (the Stripe entity with which Vexaro holds its Stripe account) | Card payment processing for purchases where Vexaro is the seller and merchant of the transaction | The organisation’s Vexaro reference, and the payment details the payer enters directly into Stripe’s checkout | Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend) | Sending Vexaro’s email (account, verification, security, billing, and support messages) and receiving mail sent to @vexaro.cloud addresses | Sender and recipient addresses, names where given, and message content | EU-US Data Privacy Framework; Standard Contractual Clauses |
| Google LLC (Gmail) | The mailbox in which Vexaro reads and answers mail sent to @vexaro.cloud addresses and messages sent from the contact forms on Vexaro’s websites | Sender addresses, names where given, and message content | EU-US Data Privacy Framework; Standard Contractual Clauses |
The Customer authorises these Subprocessors under the general authorisation in the Data Processing Addendum. On request to [email protected], Vexaro tells the Customer the countries in which each Subprocessor Processes its Personal Data.
Card payment data is handled by the applicable payment provider or Merchant of Record and is not stored by Vexaro. Whether your payment is processed by Vexaro directly or by an authorised reseller acting as Merchant of Record depends on the checkout method, and that provider’s buyer terms also apply to that purchase, as described in the Billing Terms. For card payment processing, Stripe acts as Vexaro’s processor for the payment data it handles on Vexaro’s behalf and may also act as an independent controller for its own fraud-prevention, financial-risk-management, and regulatory purposes, in each case under Stripe’s own published data-protection terms. Each Subprocessor’s published privacy or data-protection terms are available from the provider.
Independent parties (not Vexaro Subprocessors). Where a purchase is completed through a Merchant of Record, that provider sells to you as an independent seller and acts as an independent controller for that payment; it is not a Vexaro Subprocessor, and that provider’s own buyer terms apply to that purchase, as described in the Billing Terms. Vexaro does not currently engage a Merchant of Record: all card payments are processed by Stripe, as listed in Section 2, with Vexaro as the seller of the transaction.
3. Self-Hosted note
For a Self-Hosted Deployment, the Customer installs and operates the relevant Vexaro components on its own infrastructure. In that case, the Subprocessors listed in Section 2 may not apply: the Customer controls its own infrastructure, including hosting, storage, backups, relay, and connectivity, and is responsible for any third parties it chooses to engage. The division of responsibility for Self-Hosted Deployments is set out in the Self-Hosted Responsibility Matrix and in the Data Processing Addendum.
4. Change Notifications
When Vexaro adds or replaces a Subprocessor, it updates this list and notifies Customers through one or more of the following channels: the Legal Center, an account notice, or email to the account contact. The change takes effect when the updated list is published, and the “Last updated” date above shows when the list last changed.
The Customer may object to a new or replacement Subprocessor on documented data-protection grounds by writing to [email protected] within 14 days of the notice. The parties will work in good faith to address a reasonable objection. If it cannot be resolved, the Customer may stop using the affected part of the Service and terminate it in accordance with the Terms of Service, as described in the Data Processing Addendum.
5. Contact
Questions about this Subprocessor List, or requests to object to a new Subprocessor, may be directed to the Privacy Contact:
- Privacy / data-protection contact: [email protected]
Contracting and notice details are provided on invoices and Order Forms.
This document is part of the Vexaro Legal Center.