Subprocessors
Effective date: October 29, 2026.
VolTrack, LLC uses the service providers below to run VolTrack. Each is bound by a written agreement to process data only to provide its service to us, except where the table says otherwise. Third parties that work under their own terms are listed separately. See also our Privacy Policy and Student Data & FERPA page.
Service providers
| Vendor | Purpose | Data | Location | How long it keeps data |
|---|---|---|---|---|
| Cloudflare | Network security, content delivery and DNS for voltrack.app; bot check (Turnstile) on self-sign-up pages | All traffic to voltrack.app in transit, including IP address and browser information. Turnstile: IP address and browser signals; Cloudflare also uses these to improve its bot detection. | Global | Traffic and security analytics: 31 days or more, depending on the dataset |
| Railway | Application hosting & logs | All app data in transit; request logs with IP address | US | Logs: 7 days |
| Supabase | Database & private file storage | All app data | US (California) | Encrypted backups: up to 30 days |
| Resend | Transactional email | Names, email addresses, message content | US | Email content and logs: 30 days; backups: 7 days. Open and click tracking are off. |
| Google (Workspace) | VolTrack's own email | Messages people send us, which may concern a student | Global | Until we delete them |
| Sentry | Error monitoring | Redacted error reports | US | Error events: 30 days; backups of event data: up to 90 days |
| Anthropic | AI services: the optional import assistant (column headings and placeholder values only) and help maintaining, supporting, debugging and securing the Service under our commercial API account | Only what each task needs | US | Deleted within 30 days (longer only where the law requires or safety systems flag content); never used for training |
| Stripe | Payments | Admin billing contact & payment data (card data never touches VolTrack) | US | Per Stripe's legal retention obligations |
Third parties under their own terms (not our subprocessors)
| Third party | Where | Data | Their terms |
|---|---|---|---|
| Google (Maps Platform) | Maps and address lookup in the Service for high-school, college and nonprofit organizations only; never for K–8 organizations or schools with a signed student data agreement | IP address and browser information, sent directly by your browser | Google acts as an independent controller under the Google Maps Platform terms |
| Google (Analytics) | Public marketing pages, only after you accept cookies | IP address, browser information, pages visited | Google's terms |
| Meta | Advertising pixel on public marketing pages, only after you accept cookies | IP address, browser information, pages visited, and form-submission events | Meta uses this information under its own terms, including for advertising |
We update this page before a new provider begins receiving student data. Schools with a signed agreement are notified as that agreement provides; unless it says otherwise, we notify them normally at least 30 days in advance, and sooner only where an urgent security or availability need requires it, never after.
Questions: [email protected] · 917-291-1527 · VolTrack, LLC, 7634 176th Street, Fresh Meadows, NY 11366.