Subprocessors.
Every third party that touches customer data on our behalf — what it does, what it sees, where it runs.
Last updated 2026-10-02
VOLUME Virtual uses the vendors below to run the service. Each one processes only the data needed for its role, under its own written data-processing terms (linked). This list is incorporated by reference into our Data Processing Addendum and sits behind the summary in the privacy policy.
| Vendor | Purpose | Data categories | Location | Terms |
|---|---|---|---|---|
| Vercel, Inc. | Application hosting, serverless functions, edge network, Blob storage for uploaded walkthrough video and tour files. | All application traffic in transit; uploaded videos, .ply tour files and poster frames at rest; environment secrets. | United States (multi-region edge) | Vercel DPA ↗ |
| Supabase, Inc. | Postgres database, authentication, primary storage. | Account records (name, email, hashed credentials, passkeys, TOTP secrets), workspaces, tour metadata, leads, analytics events, audit log, support messages. | Canada (AWS ca-central-1) | Supabase DPA ↗ |
| Stripe, Inc. | Payment processing, subscriptions, invoicing, tax calculation. | Billing name, email, billing address, card details (never touch VOLUME servers), invoice history, subscription state. | United States / Ireland | Stripe DPA ↗ |
| MakeSplat | Gaussian-splat reconstruction — converts the uploaded walkthrough video into the 3D tour. | Walkthrough video (the source footage) and the generated reconstruction; a job id tied to your workspace. No account or billing data. | United States | MakeSplat (vendor site; written terms on request) ↗ |
| Cloudflare, Inc. (R2) | Object storage used by MakeSplat to hold the source video and scan artifacts during and after reconstruction. | Walkthrough video and reconstruction artifacts, as handled by MakeSplat. | Global network; primary storage United States | Cloudflare customer DPA ↗ |
| Resend, Inc. | Transactional email — invites, lead notifications, password resets, support replies, billing alerts. | Recipient email address, name, the content of the email (which may include lead details or support messages). | United States | Resend DPA ↗ |
| Functional Software, Inc. (Sentry) | Error monitoring and performance telemetry. | Stack traces, request metadata, user id and email on errored requests, browser/device info. Session replays are privacy-masked (no input text, no media). | United States | Sentry DPA ↗ |
| Vercel, Inc. (Web Analytics) | Privacy-preserving page-view analytics for the marketing site and app. | Page path, referrer, coarse device/browser type, country derived from IP at the edge. No cookies; no cross-site identifiers; raw IP is not stored. | United States | Vercel Analytics privacy ↗ |
Changes to this list
Last updated 2026-10-02. We add a vendor here before it receives any customer data. Customers may subscribe to change notices by emailing hello@volumevirtual.com with the subject "Subscribe to subprocessor changes" — we will email at least 14 days before a new subprocessor goes live, and you may object on reasonable data-protection grounds in that window as set out in the DPA.
Not on this list
We do not use advertising networks, third-party ad cookies, data brokers, or any vendor that trains models on customer content. Your walkthrough video and tours are processed only to produce and host your tour.
Questions about this policy? Email hello@volumevirtual.com.