Subprocessors | VulpineOS

What a subprocessor is

A subprocessor is a vendor we instruct to process data on our behalf — for example, our hosting provider or our database. We sign a data processing agreement (DPA) with each subprocessor that handles personal data and rely on appropriate safeguards for international transfers.

Current list

Vercel

Purpose: Hosting + CDN for vulpineos.com, auth.vulpineos.com, admin.vulpineos.com.
Data: Standard request metadata (IP, user-agent, request path, status). Some logs are retained for short periods for security and reliability.
Location: Global edge with primary region in the United States.

Supabase

Purpose: Postgres database for the waitlist, operator-console accounts, RenderLab research data, and admin-managed content (roadmap, changelog).
Data: Waitlist applicant data, operator account records, RenderLab consents and runs, content authored by admins.
Location: EU (Frankfurt) for the production project.

Google Analytics 4

Purpose: Page analytics — only loaded when you accept the cookie banner.
Data: Page views, session duration, traffic sources, GA cookie identifiers. Retention 26 months. No GA Signals or remarketing.
Location: United States.

Vercel Analytics

Purpose: Privacy-focused page-view counts for the marketing site.
Data: Aggregate page-view counts; no cross-site cookies.
Location: Vercel infrastructure (US / EU).

GitHub

Purpose: Open-source code hosting and content workflows that back the public roadmap and changelog publish path.
Data: Public commit metadata associated with the deploy account; profile data you make public on your own account.
Location: United States.

Notification of changes

When we add a new subprocessor, we update this page with the new entry and the "last updated" date at the top. Operator-console customers can subscribe to email notifications of subprocessor changes by emailing privacy@vulpineos.com.

Contact

Questions: privacy@vulpineos.com.