Sub-processors
Last updated: 26 October 2026
Vistura uses the providers below to run the Service. Each one processes personal data that our customers collect through their tours (enquiries, tour content and related technical data) only on our instructions, under a written data processing agreement. This list is Schedule C of the Data Processing Agreement.
| Provider | What it does for Vistura | Where the data is processed | Transfer safeguard |
|---|---|---|---|
| Supabase Pte. Ltd. and its affiliates | Database and sign-in | United States (us-east-1) | Standard Contractual Clauses |
| Railway Corporation | Application server | United States (US East) | EU-US Data Privacy Framework; Standard Contractual Clauses |
| Cloudflare, Inc. | Website delivery, network security, file storage (tour photos, floor plans, audio and video) and backups | Global network | EU-US Data Privacy Framework; Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend) | Email notifications about new enquiries | United States | Standard Contractual Clauses |
The exact contracting entity, region and transfer mechanism of each provider follow its own data processing terms.
Providers that are not sub-processors
Stripe handles payments and subscriptions. It processes the billing data of Vistura's customers for Vistura's own purposes, not data collected through tours, so it is described in the Privacy Policy rather than here.
Changes to this list
We tell customers at least 30 days before adding or replacing a sub-processor, by email to the account address or by a notice in the app, as set out in section 5 of the Data Processing Agreement. A customer may object within 15 days on reasonable data protection grounds by writing to legal@vistura.app.
| Date | Change |
|---|---|
| 18 October 2026 | First published list |
| 26 October 2026 | Tour files (photos, floor plans, audio and video) moved from Supabase to Cloudflare R2; both providers were already on the list |