Sub-processors
ClubTitan is built on a deliberately small set of service providers. This page is the sub-processor list referenced by the club data-processing agreement and the privacy notice: who each provider is, what they do for the platform, what data they touch, and where they process it. Each is bound by written terms no less protective than our DPA.
The list
| Provider | What they do | Data touched | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage — the platform’s core data store | All platform data, including member and club records | UK — AWS eu-west-2 (London) |
| Vercel | Hosting for the web application and club websites | Data in transit through the app; server logs | US company; serving region [to be confirmed before launch] |
| Stripe | Card and Bacs payment processing (the club’s own Stripe account) | Payment and transaction data; card details are held by Stripe, never by us | UK/EU and US, under Stripe’s own certified safeguards |
| GoCardless | Bank payments — Direct Debit and pay-by-bank | Bank payment data (account holder, mandate, payment amounts) | UK |
| Anthropic | AI drafting and assistance (see the AI transparency statement) | Prompt content — the most sensitive data classes are excluded by our data-class controls | US |
| Meta (WhatsApp Business) | WhatsApp message delivery where a club uses the WhatsApp channel | Phone numbers and WhatsApp message content | US/global (Meta’s infrastructure) |
| Resend | Transactional and (consented) marketing email delivery | Email addresses and message content | US [processing region to be confirmed before launch] |
| Railway | Background job processing (reminders, imports, scheduled work) | Job data, which can include member records being processed | US company [processing region to be confirmed before launch] |
| Sentry | Error monitoring, so we find and fix faults | Technical error data, minimised — not member content | US [EU hosting option to be confirmed before launch] |
| Expo (EAS) | Mobile app builds and push-notification delivery | Push notification tokens and notification content | US |
Apple and Google additionally act as delivery intermediaries for push notifications on their platforms, listed here for completeness. Development-only tooling that never processes member personal data is not a sub-processor and is not listed.
International transfers
The core data store is in the UK. Where a provider processes personal data outside the UK/EU, the transfer relies on a UK adequacy decision or on Standard Contractual Clauses with the UK International Data Transfer Addendum — the specific mechanism per provider is being settled in legal review [to be confirmed before launch] and will be stated in the table above.
Changes to this list
- We give clubs at least 30 days' advance notice before adding or replacing a sub-processor that will process club member data — notified directly to club administrators, not just edited here.
- A club may object on reasonable data-protection grounds within that window; if we can't resolve the objection, the club can leave with its data — export is built in and leaving carries no notice period or fee.
- Removals and non-material updates are reflected on this page as they happen.
This draft was last updated in July 2026.