Subprocessors
Last updated: June 11, 2026
This page lists third-party providers that may process personal data for Vivus Tech LLC. It is a public summary of the internal DPA register and does not itself execute a DPA, approve a transfer mechanism, or authorize a new vendor. Rows marked pending require confirmation on file before they are treated as cleared.
Subprocessors and service providers
| Provider | Role | Data categories | Region | Status note |
|---|---|---|---|---|
| Supabase | Primary database, authentication, and storage | Tenant, account, workspace, fan, content, and financial-reference data | Current production primary is US; EU primary migration remains a separate approval gate | DPA / SCC evidence pending confirmation on file |
| Vercel | Application hosting, serverless compute, CDN/edge delivery, and logs | Request data in transit and any personal data present in application logs | Functions configured for Frankfurt; CDN/edge delivery remains global | DPA / logs posture pending confirmation on file |
| OpenRouter | AI gateway routing prompts to downstream model providers | Prompt content submitted to AI features, which may include contact, campaign, contract, or financial context | US and downstream-provider-specific regions | Standard DPA posture accepted for gating only; downstream Art. 28 chain remains pending |
| Downstream model providers | LLM inference through OpenRouter, including providers such as Anthropic, OpenAI, Google, and Meta where routed | Same prompt content routed through the AI gateway | Provider-specific | Provider-specific DPA/ZDR status pending |
| OpenAI | Direct audio transcription path | Audio recordings and transcripts submitted to transcription features | US unless separately configured | DPA and zero-retention / abuse-monitoring carve-out pending |
| Stripe | Payments and billing | Billing identity, subscription status, invoice metadata, and payment metadata | US | DPA confirmation and archive pending |
| Plaid | Bank-account linking and finance sync | Financial-account metadata, institution identity, balances, transactions, and token material | US | DPA / GLBA posture pending confirmation on file |
| Twilio | SMS and WhatsApp delivery | Fan phone numbers, message content, consent/unsubscribe evidence, and delivery metadata | US | DPA / SCC evidence pending confirmation on file |
| Resend | Transactional and outbound email delivery | Recipient email addresses, message content, and delivery metadata | US | DPA evidence pending confirmation on file |
| PostHog | Product analytics | Usage events, device identifiers, IP-derived diagnostics, and product telemetry | Code defaults to PostHog Cloud EU; provider dashboard confirmation pending | DPA / SCC evidence pending confirmation on file |
Controller-classified vendors
Some providers may process data as independent or joint controllers rather than subprocessors. Their own terms and privacy notices may apply to their controller-side processing.
| Provider | Surface | Classification |
|---|---|---|
| Meta | Fan-page pixel, conversions, advertising, and social-platform surfaces | Independent or joint controller depending on the enabled feature |
| TikTok | Fan-page pixel, events API, advertising, and social-platform surfaces | Independent or joint controller depending on the enabled feature |
| Google Analytics / Ads and artist-authorized Google integrations | Independent or joint controller for some advertising surfaces; artist-authorized data source for OAuth integrations |
Changes and questions
Vivus may update this list as providers, processing regions, or data categories change. Material changes are reflected here and in the Privacy Policy.
Questions: contact@releaseledger.com.