Sub-processors
ClubTitan is built on a deliberately small set of service providers. This page is the sub-processor list referenced by the club data-processing agreement and the privacy notice: who each provider is, what they do for the platform, what data they touch, and where they process it. Each is bound by written terms no less protective than our DPA.
The list
| Provider | What they do | Data touched | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage — the platform’s core data store | All platform data, including member and club records | UK — AWS eu-west-2 (London) |
| Vercel | Hosting for the web application and club websites | Data in transit through the app; server logs | US company; the server code of the web app runs in London (lhr1), and pages are delivered through the Vercel global network |
| Stripe | Card and Bacs payment processing (the club’s own Stripe account) | Payment and transaction data; card details are held by Stripe, never by us | UK/EU and US, under Stripe’s own certified safeguards |
| GoCardless | Bank payments — Direct Debit and pay-by-bank | Bank payment data (account holder, mandate, payment amounts) | UK |
| Anthropic | AI drafting and assistance (see the AI transparency statement) | Prompt content — the most sensitive data classes are excluded by our data-class controls | US |
| Meta (WhatsApp Business) | WhatsApp message delivery where a club uses the WhatsApp channel | Phone numbers and WhatsApp message content | US/global (Meta’s infrastructure) |
| Amazon Web Services | Encrypted backups of the platform’s data (Amazon S3) and, when we move them, email delivery (Amazon SES) and running ClubTitan’s background jobs | An encrypted copy of all platform data; for email and background jobs, once moved, the email addresses, message content and club data they process | UK — AWS eu-west-2 (London) |
| Resend | Email delivery: the email we send, inbound email and club sending domains | Email addresses, message content and delivery outcomes | US company; mail for our domains is sent and received through its EU region (Ireland) |
| Railway | Background job processing (reminders, imports, scheduled work) | Job data, which can include member records being processed | US company; our worker runs in its EU region (the Netherlands) |
| Sentry | Error monitoring, so we find and fix faults | Technical error data, minimised — not member content | US — our account is hosted in the Sentry US region |
| Expo (EAS) | Mobile app builds and push-notification delivery | Push notification tokens and notification content | US |
| Google Wallet | Wallet passes, for members who choose to add their membership or an event pass to Google Wallet | A member’s name and membership details on a pass they choose to add — nothing else | US (Google LLC), under Standard Contractual Clauses and the UK Extension to the EU–US Data Privacy Framework |
| Microsoft 365 | Our business email, including the support and privacy addresses | Correspondence sent to us — support and privacy requests included — and our replies | UK (mailbox content); a US company, under Standard Contractual Clauses with the UK Addendum and the EU–US Data Privacy Framework |
| Google Maps Platform (Places) | Address and place search: the suggestions under an address or venue box as it is typed, and the one place a person picks | The words typed into an address or venue box and the place picked — never a name, an account or who is typing | US (Google LLC), under Standard Contractual Clauses with the UK Addendum (Google Maps Platform’s Controller-Controller Data Protection Terms) |
| Google (Gemini API) | Spot the ball set-up only: removing the ball from a club’s competition photo (AI image editing) | A square crop around the ball of a club’s competition photo, with the faces the club hid already covered — it may still show an adult, or a child the club has permission to show; never a name or an account. Sent under the club’s own Google account instead where the club has connected its own Google AI key | US (Google LLC), possibly cached wherever Google has facilities; on our paid account Google does not use the photo to improve its products and keeps it only for a limited time to detect abuse |
| postcodes.io | Postcode lookups: checking a postcode when an address is typed, and finding a postcode’s centre to match lifts nearest first and estimate pickup times | Postcodes only — never a name, a house number or any other detail | UK open postcode data (ONS); sent postcodes only, never anything that identifies a person |
| Intuit Inc. (QuickBooks) | Accounting software a club chooses to connect: ClubTitan sends that club’s payouts and the account matches it sets to the club’s own QuickBooks company | The club’s accounting data the club chooses to send — payout totals by category, fees and references; no child’s name leaves ClubTitan | US (Intuit Inc.); the transfer is covered by the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses |
Apple and Google additionally act as delivery intermediaries for push notifications on their platforms, listed here for completeness. Development-only tooling that never processes member personal data is not a sub-processor and is not listed.
International transfers
The core data store is in the UK. Where a provider processes personal data outside the UK/EU, the transfer relies on a UK adequacy decision (for a certified US provider, the UK Extension to the EU–US Data Privacy Framework) or on Standard Contractual Clauses with the UK International Data Transfer Addendum, under each provider's own data processing terms.
Changes to this list
- We give clubs at least 30 days' advance notice before adding or replacing a sub-processor that will process club member data — notified directly to club administrators, not just edited here.
- A club may object on reasonable data-protection grounds within that window; if we can't resolve the objection, the club can leave with its data — export is built in and leaving carries no notice period or fee.
- Removals and non-material updates are reflected on this page as they happen.
Last updated October 2026.