Sub-Processors
Last updated:
VeloCMS uses the following third-party sub-processors to deliver its service. This is the list of every provider that currently receives customer or visitor data from the VeloCMS platform. Each processes that data only to provide its service to us, under the provider’s own published terms and data-protection commitments.
VeloCMS’s company registration in Sharjah, United Arab Emirates is in progress. The registered company name, licence number and address will be published here once incorporation is complete.
We will notify tenants at least 30 days before adding or removing a sub-processor. To object to a new sub-processor, contact [email protected].
Stripe
Stripe, Inc. / Stripe Payments UK, Ltd. / Stripe Payments Europe, Ltd.
- Jurisdiction
- USA / UK / Ireland
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- Payment processing, subscriptions, invoicing and tax calculation for VeloCMS plans, plugins and domains
- Data categories
- ·Name
- ·Payment card data
- ·Billing address
- ·Tax ID (if you provide one)
- ·Subscription status
Railway
Railway Corp.
- Jurisdiction
- USA
- Transfer mechanism
- SCCs
- Purpose of processing
- Cloud infrastructure: the Next.js application server, the PocketBase database and its volume snapshots
- Data categories
- ·All data stored on the VeloCMS platform (infrastructure-level access only)
Cloudflare
Cloudflare, Inc.
- Jurisdiction
- USA (global edge network)
- Transfer mechanism
- UK-US Data Bridge
- Purpose of processing
- CDN, DDoS protection, DNS and SSL/TLS certificates for custom tenant domains; R2 object storage for uploaded media, downloadable files and database backups; cache storage; Turnstile bot protection on sign-up, sign-in, comment and form submissions
- Data categories
- ·IP addresses and request metadata
- ·Domain names
- ·SSL certificate metadata
- ·Uploaded media and downloadable files
- ·Database backups
- ·Bot-check signals from the visitor's browser
Resend
Resend Inc.
- Jurisdiction
- USA
- Transfer mechanism
- SCCs
- Purpose of processing
- Email delivery: account and billing notifications, sign-in links, export links, GDPR confirmations, and the newsletters and notifications that site owners send to their own members and subscribers
- Data categories
- ·Email address
- ·Name (where used in a message)
- ·Email content
- ·Delivery and bounce events
Google (Gemini API)
Google LLC / Google Ireland Limited
- Jurisdiction
- USA / Ireland
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- AI features that run on the VeloCMS platform key instead of a site's own key: writing assistance, translation, image alt-text and onboarding drafts
- Data categories
- ·Prompts and post text you submit to an AI feature
- ·Images sent for alt-text
- ·Generated output
NVIDIA (NIM)
NVIDIA Corporation
- Jurisdiction
- USA
- Transfer mechanism
- As set out in the provider's own data-protection terms
- Purpose of processing
- Fallback image alt-text generation when the Gemini service cannot answer
- Data categories
- ·Images uploaded to the media library (sent for alt-text)
- ·Generated alt-text
Perplexity
Perplexity AI, Inc.
- Jurisdiction
- USA
- Transfer mechanism
- As set out in the provider's own data-protection terms
- Purpose of processing
- AI-visibility tracking, for sites whose owner turns it on: sends the prompts the owner configures and reads the answer to see whether the brand is mentioned
- Data categories
- ·Prompts configured by the site owner (brand and competitor names)
Apify
Apify Technologies s.r.o.
- Jurisdiction
- Czech Republic (EU)
- Transfer mechanism
- As set out in the provider's own data-protection terms
- Purpose of processing
- Importing public Instagram and YouTube content during onboarding or from the import tool, by running a scraper on the public profile you name
- Data categories
- ·The public profile handle or URL you enter
- ·Public posts retrieved from that profile
Porkbun
Porkbun LLC
- Jurisdiction
- USA
- Transfer mechanism
- As set out in the provider's own data-protection terms
- Purpose of processing
- Domain registration and DNS records, only if you buy a domain through VeloCMS
- Data categories
- ·The domain name you choose
- ·DNS records for that domain
- ·WHOIS privacy is switched on for every registration
Twilio
Twilio Inc.
- Jurisdiction
- USA
- Transfer mechanism
- As set out in the provider's own data-protection terms
- Purpose of processing
- Delivery of SMS reminders, only for sites that switch SMS on
- Data categories
- ·Recipient phone number
- ·Message text
- ·Delivery status
Sentry
Functional Software, Inc. (Sentry)
- Jurisdiction
- USA
- Transfer mechanism
- UK-US Data Bridge
- Purpose of processing
- Error tracking for errors raised on our servers and for uncaught errors in visitors' browsers. Session replay is not enabled, and no performance traces are recorded in browsers
- Data categories
- ·Error details and stack traces (secret keys are scrubbed before sending)
- ·Request details of the failing server request (page URL, browser and device type)
- ·Browser error details (stack trace, page URL, browser and device type, IP address at ingest)
- ·Performance traces
Google Analytics
Google LLC / Google Ireland Limited
- Jurisdiction
- USA / Ireland
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- Website analytics on velocms.org: cookieless pings before you choose, analytics cookies only after you accept
- Data categories
- ·Page address
- ·Referrer
- ·Language
- ·Screen size
- ·Browser type
- ·IP address (network request)
Microsoft Clarity
Microsoft Corporation
- Jurisdiction
- USA
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- Session analytics on velocms.org; loads only after you accept
- Data categories
- ·Clicks and scrolling
- ·How pages are displayed
- ·Browser and device type
- ·Page URLs
Google (PageSpeed Insights)
Google LLC / Google Ireland Limited
- Jurisdiction
- USA / Ireland
- Transfer mechanism
- UK-US Data Bridge + SCCs
- Purpose of processing
- Performance tests in the Site Audit tool
- Data categories
- ·The public URL submitted for an audit
DataForSEO
DataForSEO OÜ
- Jurisdiction
- Estonia (EU)
- Transfer mechanism
- As set out in the provider's own data-protection terms
- Purpose of processing
- Search ranking, backlink and domain-authority data for the SEO growth reports we run for client sites we manage. Only the site's domain is sent; it is not part of the self-serve Site Audit tool
- Data categories
- ·The public domain of the site being reported on (host name only, for example example.com)
- ·The search market for that site (country and language names, for example United Kingdom and English)
- ·No visitor, customer, account or other personal data is sent
Not on this list: services a site owner connects with their own account. Their own Stripe account, their own AI key (BYOK), plugins and integrations, and Google sign-in receive data under the owner’s own agreement with that provider, and VeloCMS sends them data only on the owner’s instruction.
Because Google, NVIDIA and Perplexity set their own rules for what they log and keep, we make no promise on their behalf. See the AI data processing section of our Privacy Policy.
This list is maintained by VeloCMS and updated when sub-processors are added, removed, or materially changed. Tenants who have signed a Data Processing Agreement (DPA) with VeloCMS will be notified by email of any changes.
Questions? [email protected]