Vercel
Hosting- Purpose
- Frontend application hosting and content delivery
- Data
- HTTP request metadata, IP addresses, authenticated session cookies, form submissions
Legal · Register
Eleven companies touch your data - here is exactly what each one does
We list every sub-processor by name, the data they handle, the region they operate in, and a direct link to their DPA. Material changes are notified at least 30 days in advance.
VoucherGrid uses the following third-party sub-processors to deliver the service. This register is maintained in accordance with our obligations under the Data Processing Agreement.
Active sub-processors 11 total
Global edge / Sydney
Render
Hosting- Purpose
- Application hosting and PostgreSQL database
- Data
- All application data (encrypted at rest and in transit)
Cloudflare
Storage- Purpose
- Object storage (R2, including voucher assets and one-time partner-export archives on cancellation) and bot protection (Turnstile)
- Data
- Uploaded files; partner final-export archives (ZIP, retained for 7 days via a signed URL); user interaction signals for bot detection
Stripe
Payments- Purpose
- Payment processing and subscription billing
- Data
- Payment card details, billing address, transaction history
Resend
Email- Purpose
- Transactional email delivery
- Data
- Recipient name, email address, email content
Twilio
Identity- Purpose
- Phone verification (SMS OTP) and Phone Sales payment-link SMS delivery
- Data
- Phone number, verification codes, payment-link SMS delivery metadata
Sentry
Errors- Purpose
- Error monitoring and application performance
- Data
- Error traces, browser metadata, session replay (with consent)
PostHog
Analytics- Purpose
- Product analytics (with consent)
- Data
- Usage events, session data, device metadata
Google Cloud
AI- Purpose
- AI image generation (Imagen) and prompt refinement (Gemini)
- Data
- Design prompts, generated images
Xero
Accounting- Purpose
- Accounting integration (when enabled by merchant)
- Data
- Voucher financial data, journal entry amounts and dates
QuickBooks Online
Accounting- Purpose
- Accounting integration (when enabled by merchant)
- Data
- Voucher financial data, journal entry amounts and dates
Quick summary by region
| Feature | Region | Sub-processors | What they hold |
|---|---|---|---|
| AU / NZ | Xero | Voucher financial data, journal entries (when integration enabled) | |
| Singapore | Render | Application hosting and PostgreSQL database | |
| United States | Stripe, Resend, PostHog, Sentry, QuickBooks, Twilio, Google Cloud | Payments, transactional email, analytics, errors, OTP, AI prompts | |
| Global edge | Cloudflare, Vercel | Frontend hosting and request handling (Vercel); R2 object storage, bot protection signals, partner-export archives (Cloudflare) |
How we manage changes
Adding a sub-processor
Before any new sub-processor begins handling Controller data, this register is updated and affected merchants are notified by email. The notice includes the sub-processor’s name, role, region, and a link to their DPA. Customers have at least 30 days to object before the change takes effect.
Removing or replacing a sub-processor
When a sub-processor is removed or replaced, the register is updated on the same day the change takes effect. Where the replacement materially changes data location or scope, the 30-day prior notice applies.
Objecting to a change
If you object to a new sub-processor and we cannot accommodate your objection (for example, by routing your data through a different provider), you may terminate the affected portion of the service without penalty for the remainder of your billing period. Email privacy@vouchergrid.com with your tenant subdomain and the sub-processor in question.
VoucherGrid PTY LTD as The Trustee for VoucherGrid Discretionary Trust trading as VoucherGrid