Vestry Sub-Processors
Last updated: June 25, 2026
This page lists the third-party service providers ("sub-processors") that Vestry uses to operate the Vestry service at getvestry.com. Each sub-processor has signed a contractual agreement with Vestry that requires them to protect personal data and use it only for the purposes Vestry authorizes.
For the broader description of how we collect, use, share, and protect your personal information, please read our Privacy Policy.
How We Choose Sub-Processors
Before engaging a sub-processor, Vestry evaluates:
- Security practices (encryption, access controls, incident response)
- Privacy posture (data-handling practices, retention defaults, regulatory certifications such as SOC 2 Type II, ISO 27001, or HIPAA where applicable)
- Data Processing Addendum / SCCs (contractual data-protection commitments, including for international transfers under GDPR Standard Contractual Clauses or the UK International Data Transfer Addendum)
- Operational fit for Vestry's actual use case
Sub-processors that do not meet our standards are not engaged.
Current Sub-Processors
The sub-processors below process personal data on Vestry's behalf to deliver the Service.
| Sub-Processor | Purpose | Region | DPA |
|---|---|---|---|
| Microsoft Clarity | Session-replay analytics for usability research | United States / global | Microsoft DPA |
| PostHog | Product analytics — feature usage, funnels, retention, and activation events (in-app surface only) | European Union (EU Cloud) | PostHog DPA |
| OpenAI | Embedding generation for song-similarity features (no LLM-generated content; embeddings only) | United States | OpenAI DPA |
| Sentry | Error tracking and performance monitoring | United States | Sentry DPA |
| Stripe | Payment processing, subscriptions, customer portal | United States | Stripe DPA |
| Supabase | Authentication, identity, OAuth, and primary database hosting (workspace data, services, prayer notes, song bank) | United States (AWS us-east-1, Northern Virginia) | Supabase DPA |
| Vercel | Application hosting, edge content delivery | United States (primary), global edge | Vercel DPA |
| Google Workspace | Email infrastructure for Vestry-operated email addresses (@getvestry.com) | Global | Google Workspace DPA |
| Resend | Transactional email delivery (trial reminders, billing receipts, support replies, security notifications) | United States | Resend DPA |
Browser-Direct Loaded Resources (Not Sub-Processors)
These services are loaded by your browser directly (via embedded iframes or external links) and Vestry does not transmit personal data to them on your behalf. Your interaction with these services is governed by their own privacy policies.
- Spotify (embedded iframe player and link-outs to Spotify track URLs) — Spotify Privacy Policy
- Google Maps Platform (address and church-name autocomplete during onboarding; your typed query and IP address are sent to Google by your browser) — Google Privacy Policy
- YouTube, Apple Music, Genius, PraiseCharts, MultiTracks, CCLI SongSelect — link-out destinations only
Updates to This List
We update this list within 30 days of any material change to our sub-processor relationships, including adding a new sub-processor or replacing an existing one in a way that materially changes how data is handled.
If you would like to be notified directly of sub-processor changes, customers with a signed Data Processing Addendum (DPA) will receive notifications as specified in that agreement. To request a DPA, contact privacy@getvestry.com.
Sub-Processors We Do Not Currently Use But May Add
The following sub-processors are referenced in our codebase but are not yet active in production:
- Planning Center — optional integration for churches that use Planning Center Online. OAuth-based; users explicitly authorize the integration. Will be added when feature ships.
We will update this page within 30 days of activating any of these.
Pipeline-Only Processors (Backend Catalog Enrichment)
Vestry's song catalog is enriched from public APIs that operate purely server-side and do not receive personal user data. These are not sub-processors of personal data and are listed here for transparency only.
- Spotify Web API (server-side song-metadata enrichment — no user identity transmitted)
- Supabase (Pipeline DB) — secondary read-only database for the song catalog (no user data)
Contact
For questions about this Sub-Processor List or to request a Data Processing Addendum:
- Email: privacy@getvestry.com
- Mail: Vestry LLC, 8401 Mayland Dr Ste A, Richmond, VA 23294-4648, United States