1. Why this register exists
Voxa runs on a deliberately small number of providers. This page names every one of them, so you do not have to take a general statement about "trusted partners" on faith.
Where we are a controller, these companies are our processors. Where we are a researcher's processor (for studies built with our own task and survey tools), these same companies are that researcher's sub-processors, and we have given the general authorisation and change-notice commitments set out in the Voxa-Hosted Study Terms for Researchers.
Every provider is engaged under a written contract meeting the requirements of Article 28 of the UK and EU GDPR, is bound to process data only on our instructions, and is subject to confidentiality and security obligations.
2. The register
| Provider | Function | Data it receives | Role |
|---|---|---|---|
| Supabase | Managed PostgreSQL database holding all platform records, including Voxa-hosted study content and submissions. | All platform data described in the relevant privacy notice. | Processor |
| Vercel | Application hosting, content delivery, serverless execution and scheduled maintenance jobs. | Request data, technical logs and any personal data in transit through the application. | Processor |
| Resend | Delivery of transactional email such as verification, security, reward and notification messages. | Recipient email address, name and message content. | Processor |
| PayPal | Hosted checkout for researcher funding, verified linking of the PayPal account a participant is paid to, and payment of participant withdrawals. Voxa never receives PayPal sign-in details or raw card details. | Researcher funding: the amount, currency and a Voxa deposit reference, with PayPal returning order, capture and status references. Participant payouts: on linking, PayPal returns the PayPal account identifier, verified email address and verification status; for each withdrawal Voxa sends that email address, the amount, currency and a Voxa payout reference, and PayPal returns batch, item and status references. | Independent controller for its regulated payment activity; processor for the checkout, account-linking and payout data it returns to Voxa. |
| IPinfo | Optional classification of a public IP address as VPN, proxy, Tor or relay, to support fraud and duplicate-account review. Only active when configured. | A public IP address is sent for classification. Voxa stores the returned classification and a one-way hash, not the raw address. | Processor |
| Malware scanning endpoint | Optional scanning of identity documents and verification video before storage. Only active when configured. | The uploaded file, transmitted once and not retained by Voxa's application. | Processor |
3. Where processing happens
Our primary data store and our application compute are both in London. That is a deliberate choice: it keeps platform data, including identity evidence and study submissions, within the United Kingdom by default.
| Provider | Processing location | Transfer position |
|---|---|---|
| Supabase | Database instance hosted in the AWS eu-west-2 region (London, United Kingdom). | Primary platform data stays in the UK. Supabase's corporate support functions are in the United States; where support access to personal data occurs, it is covered by the safeguards in our International Data Transfers document. |
| Vercel | Application functions are pinned to the lhr1 region (London, United Kingdom), next to the database. | Static assets are served from a global edge network and contain no personal data. Vercel's corporate and support functions are in the United States, covered by the safeguards in our International Data Transfers document. |
| Resend | Email delivery infrastructure operated from the United States. | Transfer outside the UK. Covered by an approved safeguard. |
| PayPal | Payment and payout processing by the PayPal group entity that provides the relevant account, operated from the United Kingdom, the European Economic Area and the United States depending on the entity and transaction. | PayPal acts as an independent controller for its regulated payment activity and applies its own transfer safeguards. |
| IPinfo | Classification service operated from the United States. Not enabled unless configured. | Where enabled, receives a public IP address only. No account, profile or study data is sent. Covered by an approved safeguard. |
| Malware scanning endpoint | Determined by the endpoint configured for the deployment. Not enabled unless configured. | Where enabled, the contract must permit processing identity documents and verification video, and must be covered by an approved safeguard if outside the UK. |
4. What we deliberately do not use
If any of this changes, this page changes first, along with the relevant privacy notice and, where consent is required, a request for your consent before the provider is enabled.
- No advertising networks, ad exchanges or data brokers.
- No third-party analytics or session-replay tools in the current release.
- No external identity or biometric verification provider: identity checks are reviewed by our own trained staff.
- No general-purpose AI provider receives your account data, profile answers, study content or submissions, and none of that data is used to train third-party models.
- No data enrichment or lookalike-audience provider.
5. Researchers are not sub-processors
Researchers who recruit through Voxa are not our processors or sub-processors. They are separate controllers for the data they collect, and their own privacy notice governs it. They appear in this register nowhere, because we do not engage them to process data on our behalf.
The information a researcher receives from us is described in the Participant Privacy Notice, and the terms on which they may use it are in the Researcher Terms.
6. Keeping this current
This register is maintained alongside the application's own configuration, so that adding a provider to the product requires adding it here. If you believe a provider is missing, tell us through the Contact page.