Subprocessors
- Version
- 1.1
- Last updated
- 6 August 2026
Notice Draft pending legal review. This document is published for transparency and will be reviewed by counsel before it is relied upon.
These are the third parties that process data on ValoPal's behalf when an operator runs a stand on our software.
1.Current subprocessors
Stripe
- Purpose
- Card payment processing and payouts to the operator
- Data categories
- Card details entered on Stripe's hosted checkout, payment amount, ticket reference
- Region
- United States
Twilio
- Purpose
- SMS delivery of vehicle status messages
- Data categories
- Guest mobile number, message content
- Region
- United States
Supabase (cloud hosting and database)
- Purpose
- Runs the application and stores ticket, staff and reporting records
- Data categories
- All service data, including guest name, plate, timestamps and payment status
- Region
- United States
Object storage provider — not yet selected
- Purpose
- Will store vehicle condition photographs
- Data categories
- Photographs and their ticket reference
- Region
- Not yet selected. This page will be updated before any guest data is processed.
Apple
- Purpose
- Apple Wallet pass issuance and lock-screen status updates
- Data categories
- Pass contents: ticket reference, vehicle description, status
- Region
- United States
AI vision provider — not yet selected
- Purpose
- Will analyse drop-off photographs for possible existing damage
- Data categories
- Vehicle photographs; findings returned to the ticket
- Region
- Not yet selected. This page will be updated before any guest data is processed.
Plausible Analytics
- Purpose
- Aggregate, cookieless analytics for this website only
- Data categories
- Page URL, referrer, country, device type
- Region
- European Union
Google
- Purpose
- Web font delivery for this website only
- Data categories
- IP address and user agent of the visiting browser
- Region
- United States
2.Changes and notification
We notify operators before adding or replacing a subprocessor that processes guest or staff personal information, so an operator has time to raise an objection. Notice goes to the operator's account contact, and this page is updated with a new version number on the same day the change takes effect.
3.Diligence
Where a subprocessor is engaged, it is under a written agreement requiring confidentiality, appropriate security measures, processing only on our instructions, and an onward-transfer safeguard where one is required. Providers listed by function are not yet contracted and process no guest data today.