These are the companies MyVocalStudio uses to run the service. Each one is bound by data processing terms that limit what it may do with the information, and we remain responsible for how it handles studio records. The provider’s name links to its terms. How we handle information is described in our Privacy Policy, and our commitments to studios about their records are in our Data Processing Addendum.
1. Providers that may handle studio records
These may process the records studios keep about students, families and teachers. We email studio owners at least 14 days before we add or replace one, and update this page at the same time. If we must replace one urgently to keep the service running or secure, we tell studios as soon as we can.
| Provider | What it does and receives | Where, and how transfers are protected |
|---|---|---|
| Supabase, Inc. | Database, sign-in and file storage. Account information and studio records, including uploaded files. | United States (Amazon Web Services, Oregon). Standard Contractual Clauses, UK Addendum and Swiss adjustments in its DPA. |
| Vercel Inc. | Web hosting, server functions, and cookieless page-visit and page-speed counts. Every request to our website and app, including IP address and the data passing to and from the app. | United States (Portland, Oregon); worldwide edge network. EU-U.S. Data Privacy Framework (with UK and Swiss extensions); Standard Contractual Clauses in its DPA. |
| Anthropic, PBC | AI features: the assistant, support chat, import and receipt reading, and drafting. What someone types or uploads to an AI feature, and the studio records the feature needs. Not used for training; deleted within 30 days unless flagged for misuse (up to 2 years). | United States. Standard Contractual Clauses, UK Addendum and Swiss adjustments in its DPA. |
| Resend | Email delivery, for our own emails and the emails studios send. Recipient name and address, subject, content, delivery status, and open and click events. | United States. EU-U.S. Data Privacy Framework (with UK extension); Standard Contractual Clauses with Swiss adjustments in its DPA. |
| Telnyx LLC | Text messages studios send, replies, and STOP and START handling. Phone number, message text, delivery status and replies. Texts go only to US and Canadian numbers. | United States. EU-U.S. Data Privacy Framework (with UK and Swiss extensions); Standard Contractual Clauses in its DPA. |
| 650 Industries, Inc. (Expo), through Apple Push Notification service and Google Firebase Cloud Messaging | Notifications to the MyVocalStudio phone app. The phone’s push token and the notification’s title and text, which can include names and lesson times. | United States. EU-U.S. Data Privacy Framework (with UK and Swiss extensions). |
| Functional Software, Inc. (Sentry) | Error monitoring for the website and phone app. Error message, stack trace, page or screen, browser and device type, and a login id from the phone app. Set not to collect names, email addresses, cookies, request contents or AI inputs and outputs; no screen recording. | United States. EU-U.S. Data Privacy Framework (with UK and Swiss extensions); Standard Contractual Clauses in its DPA. |
| Slack Technologies, LLC | Alerts our support team to new support requests. The requester’s name, email address and message, which may mention students. | United States. EU-U.S. Data Privacy Framework through Salesforce, Inc. (with UK and Swiss extensions); Standard Contractual Clauses in its DPA. |
| Cloudflare, Inc. (Turnstile) | Checks that sign-ups, sign-ins and public forms, including a studio’s booking form, come from a person. IP address and browser signals, during the check. | Cloudflare’s worldwide network. EU-U.S. Data Privacy Framework (with UK and Swiss extensions); Standard Contractual Clauses in its DPA. |
2. Providers for our own account, billing and marketing
These handle information MyVocalStudio controls itself, such as logins, our own billing and measuring our ads. They do not receive studio records.
| Provider | What it does and receives | Where, and how transfers are protected |
|---|---|---|
| Stripe, LLC | Billing for MyVocalStudio’s paid plans. The account holder’s name, email address and billing details. Card details go straight to Stripe. | United States and Stripe’s global infrastructure. EU-U.S. Data Privacy Framework (with UK and Swiss extensions); Standard Contractual Clauses in its Data Transfers Addendum. |
| Twilio Inc. | Sign-in codes sent by text. The phone number used to sign in, and delivery status. | United States. EU-U.S. Data Privacy Framework (with UK and Swiss extensions); Binding Corporate Rules and Standard Contractual Clauses in its DPA. |
| Google LLC (Google Analytics) | Visit statistics for our public pages, and the sign-up steps our privacy policy describes. Cookie ids, pages, referrer, device and browser, and the sign-up step. | United States and Google’s global infrastructure. EU-U.S. Data Privacy Framework (with UK and Swiss extensions). |
| Meta Platforms, Inc. | Measures which of our ads lead to sign-ups and paid plans. Cookie ids, page and event from the browser; from our servers, a scrambled email address (and phone number), IP address, browser type and Meta’s cookie ids. | United States and Meta’s global infrastructure. EU-U.S. Data Privacy Framework (with Swiss extension). |
3. Address suggestions and maps
When someone types an address into MyVocalStudio, their browser sends what they type, with their IP address, to Google Maps Platform for address suggestions, and a teacher’s public profile may show a Google map of a teaching address. Google handles this under its own terms and privacy policy as an independent controller, not as our subprocessor.
4. Services a studio or user connects
When a studio or user connects Google Calendar, Zoom, its own Stripe account for taking payments, a calendar feed or a webhook, or signs in with Google or Apple, we send that service what the feature needs, and it then handles the information under its own agreement with the studio or user. These are not our subprocessors.