Legal
Sub-processors
Last updated: 10 July 2026
Clubstance uses a small set of vetted third-party services ("sub-processors") to run the platform. Each processes personal data only for the purpose listed below and is bound by data protection obligations consistent with our Data Processing Terms. We update this page at least 15 days before adding or replacing a sub-processor that touches customer personal data.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Database, authentication, and file storage — the platform's primary data store | All platform data: accounts, member records, photos, payments, attendance | Managed cloud (AWS), region pinned per project |
| Cloudflare | Web hosting, content delivery, and network security | Traffic metadata (IP addresses, request logs) | Global edge network |
| Razorpay | Payment processing for subscriptions and gym member payments | Payment details (card/UPI handled by Razorpay directly), payer name, contact | India |
| Meta Platforms (WhatsApp Cloud API) | Delivery of WhatsApp messages sent by gyms (reminders, receipts, broadcasts) | Member phone numbers and message content | Global (Meta infrastructure) |
| Resend | Transactional email delivery | Recipient email addresses and email content | United States |
| Sentry (Functional Software, Inc.) | Error monitoring and sampled session replay (typed text masked) | Technical telemetry: browser/device info, IP, stack traces, masked session recordings | European Union |
| Optional “Sign in with Google” authentication | Google account identifier, name, email (only if you choose Google sign-in) | Global |
Not a sub-processor: biometric devices
Fingerprint and face templates are processed by the gym's own biometric hardware and the on-premise bridge software inside the gym's local network. They never reach Clubstance's cloud or any sub-processor above — our servers receive only check-in events and device-user mappings.
Questions
Write to [email protected] to be notified of sub-processor changes by email.