Subprocessors
Velluto Last updated: 4 июня 2026 г.
To deliver the Services, Ilia Kazakov uses a limited number of trusted subprocessors. This page lists each subprocessor, the personal data they process, their location, and the transfer mechanism that applies.
We give at least thirty (30) days' prior notice of any addition or replacement of a subprocessor. To receive notice by email, subscribe at https://velluto.io/subprocessors-subscribe (or write to [email protected]).
Infrastructure
| Subprocessor | Purpose | Data processed | Region | Transfer mechanism |
|---|---|---|---|---|
| Vast.ai (or chosen GPU provider) | GPU compute for AI inference | Content (text, audio), generated Output, ephemeral processing logs | Variable (host server location) | SCCs Module 2 |
| Cloudflare, Inc. | CDN, DDoS protection, named tunnel, edge caching | IP addresses, request metadata, TLS termination | Global edge | SCCs Module 2 + DPF (Cloudflare is DPF-certified) |
| Hetzner Online GmbH (if used for storage / control plane) | Object storage, backups, control-plane VMs | Encrypted backups, account database snapshots | Germany, Finland | EEA — no Restricted Transfer |
| GitHub, Inc. | Application code repository, GitHub Releases auto-update channel | Account email if user opts in to update notifications | United States | SCCs Module 2 + DPF |
Payments
| Subprocessor | Purpose | Data processed | Region | Transfer mechanism |
|---|---|---|---|---|
| Lava.top | Card and supported payment methods (international + CIS) | Name, email, billing address, card brand and last 4 digits, IP, device fingerprint | Cyprus / EU | SCCs Module 2; independent controller for fraud-prevention purposes |
| CryptoCloud (Trybit) Ltd. | Cryptocurrency payments | Email (where provided), wallet address, transaction hash | International | Independent controller; transfer based on user consent for cryptocurrency settlement |
Communications
| Subprocessor | Purpose | Data processed | Region | Transfer mechanism |
|---|---|---|---|---|
| Resend, Inc. or Postmark (ActiveCampaign LLC) | Transactional email (signup confirmation, billing, security) | Name, email, message content | United States | SCCs Module 2 + DPF |
| Telegram FZ-LLC | Telegram-based login and support bot | Telegram user ID, username, account binding token | United Arab Emirates | SCCs Module 2 |
Analytics and observability
| Subprocessor | Purpose | Data processed | Region | Transfer mechanism |
|---|---|---|---|---|
| Plausible Insights OÜ or self-hosted PostHog | Privacy-conscious product analytics | Truncated IP, country, page URL, anonymous event data — no cross-site tracking | Estonia (Plausible) / Self-hosted (PostHog) | EEA — no Restricted Transfer; or no transfer if self-hosted |
| Functional Software, Inc. (Sentry) | Error reporting and crash diagnostics | Stack traces, OS, app version, anonymised user ID | United States | SCCs Module 2 + DPF |
Optional / future
The following may be added with prior notice per Section 6 of the DPA:
- An EU-based GPU provider once we exceed Vast.ai capacity (e.g., RunPod EU, Lambda Labs)
- A SOC 2 audited identity provider for enterprise SSO (e.g., WorkOS)
- A KYC vendor for high-risk transactions (e.g., Sumsub)
Notification of changes
We will notify subscribed Controllers at least 30 days before adding, replacing, or materially changing the role of any subprocessor. Subscribe by writing to [email protected].