Sub-processors

Clubroom uses the following providers to process personal data about clubs' members on the clubs' behalf. This list is Appendix B to the data processing agreement. We notify clubs at least 30 days before we add or replace a sub-processor so they can object, see the data processing agreement.

Vercel

• Purpose: hosting of the app and site, server functions and operational logs.
• Entity: Vercel Inc., USA.
• Location: server functions run in Frankfurt, Germany (fra1). Static files and requests pass through Vercel's global network, and account data and operational logs may be processed in the USA.
• Transfer basis: the EU-U.S. Data Privacy Framework (Vercel is certified) and the European Commission's standard contractual clauses, under Vercel's data processing addendum.
• Source: vercel.com/legal/dpa, vercel.com/docs/functions/regions, vercel.com/kb/guide/is-vercel-certified-under-dpf

Supabase

• Purpose: database (PostgreSQL) holding all of the club's data.
• Entity: Supabase Inc., USA, running on Amazon Web Services.
• Location: EU, Frankfurt, Germany (eu-central-1). The database is in this region. Account data, support requests and operational data may be processed in the USA and Singapore.
• Transfer basis: the European Commission's standard contractual clauses (Modules Two and Three), under Supabase's data processing addendum.
• Source: supabase.com/legal/dpa, supabase.com/legal/privacy-resources/data-residency-and-transfers-faq

Cloudflare R2

• Purpose: file storage (today only images for Clubroom's own changelog; there are no member files yet) and the daily encrypted backups of the database.
• Entity: Cloudflare Inc., USA.
• Location: EU. The buckets are created with Cloudflare's EU jurisdiction, so the data is stored and processed inside the EU.
• Transfer basis: the EU-U.S. Data Privacy Framework (Cloudflare is certified) and the European Commission's standard contractual clauses, under Cloudflare's data processing addendum.
• Source: developers.cloudflare.com/r2/reference/data-location, cloudflare.com/cloudflare-customer-dpa

Resend

• Purpose: sending emails from the club to members (welcome, reminders, news, receipts) and from Clubroom to administrators.
• Entity: Resend (Plus Five Five, Inc.), USA.
• Location: emails are sent from Ireland (eu-west-1), the region selected for our sending domain mail.getclubroom.com. Account data, email metadata and logs are stored in the USA whatever the region.
• Transfer basis: the EU-U.S. Data Privacy Framework (Resend is certified) and the European Commission's standard contractual clauses (Modules Two and Three), under Resend's data processing addendum.
• Source: resend.com/docs/dashboard/domains/regions, resend.com/changelog/data-privacy-framework-certification, resend.com/legal/dpa

Sentry

• Purpose: error reports from the app and site, so we can find and fix faults. A report holds the error, where in the code it happened, the page address with any links' tokens removed, and internal ids (such as a member's or club's id). It is set up to leave out names, email addresses, IP addresses, cookies, request headers and form contents.
• Entity: Functional Software, Inc. (Sentry), USA.
• Location: error reports are stored in Sentry's EU region in Frankfurt, Germany. Account data and organisation settings are stored in the USA.
• Transfer basis: the EU-U.S. Data Privacy Framework (Sentry is certified) and the European Commission's standard contractual clauses (Modules Two and Three), under Sentry's data processing addendum.
• Source: docs.sentry.io/organization/data-storage-location, sentry.io/legal/dpa

Not sub-processors

Google (sign-in)

Administrators can sign in with their Google account. Google receives no member data and only processes details of the administrator's own sign-in. It does so as an independent controller under its own privacy policy (for users in the EU: Google Ireland Limited). Google LLC is certified under the EU-U.S. Data Privacy Framework. See policies.google.com/privacy.

The club's payment provider

Clubs can take online payments through a payment provider that the club itself chooses and contracts with directly. The agreement is between the club and the provider, and the money goes straight to the club's account. Clubroom never holds money and is not a party to that agreement. Depending on the provider's terms, the provider is either the club's own processor or an independent controller for the payment data; this follows from the club's agreement with the provider. When a payment starts, Clubroom sends the provider the amount, a payment reference, what is being paid for and the member's email address, and the provider sends the payment status back. The member pays on the provider's own payment page, and Clubroom never sees or stores card details. To start payments and receive their status, Clubroom stores the club's API keys for the provider, encrypted.

Enlist

Enlist runs the waiting list on Clubroom's home page. Enlist is another service run by Clubroom's owner, Mike Hagen Eggertsen, so no separate data processing agreement applies. Here Clubroom itself is the controller, and no member data is involved. See the privacy policy. Enlist's own providers are listed at enlist.dev/legal/subprocessors.

Changes

Changes to this list are reflected in the version date at the top.