Subprocessors
Effective September 30, 2026 · last updated September 30, 2026
Every company that touches PaddleLens data, what each one gets, and where it is. If you are a club deciding whether to put your roster here, this is the page to read alongside the Privacy Policy.
We name a new company here before it starts handling your club's data, and we ask you to agree to it. This page is the list; when it changes, PaddleLens puts the updated policy in front of you the next time you open the app, with a summary of what moved. The asking is the notice — you are never signed up to a change by a page you did not happen to visit. If you object to a new subprocessor on reasonable data protection grounds, write to info@paddlelens.com before you accept; we would rather hear it than find out during your procurement review. If we cannot settle it, you can stop using the Service and we will delete your club's data.
Optional Sentry error monitoring is a subprocessor service: it receives only the minimized diagnostic fields listed in its row, in the United States, with no exception message or request address, and is retained for no more than 90 days. The last four rows below are not subprocessors of club data — Google Analytics, PostHog, and our two advertising partners. None receives a roster, an athlete, a report, a photo or a message. Google counts public visits and major conversions under a server-generated pseudonymous code; PostHog counts product workflows under a different pseudonymous account code. Meta sees eligible public visits and, for a consenting adult, the successful-signup fact with connection and Meta browser/click IDs — no PaddleLens identity. Reddit sees eligible public visits and, for a consenting adult, the sign-up and any credit-pack checkout and purchase with a hashed email and a code for the account that only Reddit receives — never a name, phone, birth date or the account ID. They are listed anyway, because a page that claims to name every company that touches anything should not have a footnote.
They get a promise of their own, narrower and easier to check: we name an advertising or measurement partner on this page before it runs, never after, and every one of them inherits the same two limits — the person's own consent, and the closed list of what may be sent, which is written out in Privacy §6 and cannot be widened without asking again. If your club's procurement review needs a fixed notice period in writing, say so at info@paddlelens.com and we will agree one with you in your data processing agreement.
Optional Sentry error monitoring is a subprocessor service: it receives only the minimized diagnostic fields listed in its row, in the United States, with no exception message or request address, and is retained for no more than 90 days. The last four rows below are not subprocessors of club data — Google Analytics, PostHog, and our two advertising partners. None receives a roster, an athlete, a report, a photo or a message. Google counts public visits and major conversions under a server-generated pseudonymous code; PostHog counts product workflows under a different pseudonymous account code. Meta sees eligible public visits and, for a consenting adult, the successful-signup fact with connection and Meta browser/click IDs — no PaddleLens identity. Reddit sees eligible public visits and, for a consenting adult, the sign-up and any credit-pack checkout and purchase with a hashed email and a code for the account that only Reddit receives — never a name, phone, birth date or the account ID. They are listed anyway, because a page that claims to name every company that touches anything should not have a footnote.
They get a promise of their own, narrower and easier to check: we name an advertising or measurement partner on this page before it runs, never after, and every one of them inherits the same two limits — the person's own consent, and the closed list of what may be sent, which is written out in Privacy §6 and cannot be widened without asking again. If your club's procurement review needs a fixed notice period in writing, say so at info@paddlelens.com and we will agree one with you in your data processing agreement.
Who we use
| Company | What it does | What it receives | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosting — the server the application runs on | Everything, as it passes through the server. What stays stored there: uploaded video while it is being analyzed, annotated frames, Community media, and the encrypted local backup archives. The database records themselves live with Supabase — the next row. | Falkenstein, Germany |
| Supabase, Inc. | Managed hosting of the primary database (PostgreSQL) | The database contents: accounts, athlete data, measurements, reports, Community text, and the operational records around them. Not video, not media files, not annotated frames — those stay on the Hetzner server above. | Frankfurt, Germany — the data resides there; Supabase, Inc. is a US company |
| Anthropic PBC | Writes the technique report and the crew plan | Text only. For a report: measurements, scores, the paddler's first name, coach notes. For a crew plan: each selected athlete's name, height, weight, paddling side, trial results, scores and notes. Never video, never images. | United States |
| Stripe, Inc. | Processes PaddleLens purchases and payments made directly to connected clubs; verifies and pays out connected account holders | Name, email, connected-account identity and business details, bank details and the card details entered directly with Stripe. We never see full card or bank numbers, or Stripe's identity documents. | United States |
| Brevo (Sendinblue) | Sends transactional email | Your email address and the contents of the message: invites, receipts, password resets, service notices | France |
| Google LLC — Identity Services | Authenticates optional Google sign-in and confirms which Google account you chose | A stable Google account identifier and your verified email and display name, plus the ordinary IP, browser and device information Google receives during sign-in. Never your PaddleLens password, phone number, birth date, club or athlete data. PaddleLens keeps no Google access or refresh token. | United States and elsewhere |
| Twilio Inc. Only reaches you if you added a mobile number | Verifies mobile numbers; also sends club texts and receives replies when selected as the club messaging provider | Your mobile number and verification code. For club texts it carries: the message, club name, session label, date, time and RSVP code, or an urgent notice written by your coach; reply text, sender number, provider message ID, and delivery details. Never a report, a score, a measurement, an image or a link. | United States |
| Telnyx LLC For optional club text messages | Sends club texts and receives coded RSVP and consent replies when selected as the club messaging provider | Your mobile number and the club message, including a club name, session label, date, time and RSVP code, or an urgent notice written by your coach. For replies: sender number, reply text, provider message ID and time. It returns delivery status, segment counts and costs. Never a report, a score, a measurement, an image or a link. Twilio continues to verify numbers. | United States |
| WeatherAPI.com (Weather API Ltd) | Supplies the forecast shown against a scheduled session | The map coordinates of a club's training venue — a lake, a river or a town a coach chose from a search box — and nothing else. No name, no email, no account identifier, no athlete data, and nothing about any individual person. It cannot tell one member of a club from another, or that anyone in particular is going. | United Kingdom |
| Sentry (Functional Software, Inc.) | Optionally receives backend error reports so we can diagnose crashes and failed requests | Only when configured: event time and level, application release, exception type, a stack trace limited to file, function and line/column numbers, and the request method. Exception messages, request addresses, local variables, cookies, headers, IP addresses, user context, breadcrumbs and arbitrary extras are not sent. Performance tracing is off; retained for no more than 90 days. | United States — US ingest region only |
| Google LLC — Analytics 4 | Counts public-site visits and major conversions | Only if you accepted analytics cookies: normalized public route templates, device type, approximate region, and the successful signup or checkout-start events. For a signed-in account, Google receives a stable server-generated pseudonymous code in its reserved User-ID field — never the database account ID, name or email. See Privacy §9. | United States and elsewhere |
| PostHog, Inc. — US cloud | Counts which pages and app features get used | Only if you accepted analytics cookies, and never any club or athlete data: normalized pages and screens, the product moments listed in Privacy §2, device and browser type — under a pseudonymous account code for signed-in members, never a name or email. Session replay and autocapture are off. See Privacy §9. | United States |
| Meta Platforms — Meta Pixel Meta Platforms Ireland Ltd for visitors in the EU/EEA; Meta Platforms, Inc. elsewhere | Measures whether the ads we buy on Facebook and Instagram bring anyone here, and lets Meta choose who sees them next | Only if you accepted advertising cookies, and only on eligible public URLs: that a browser opened one, plus its IP, browser type, Meta browser ID and any Meta ad-click ID. If you are over 18, a successful account creation may also send that signup fact with a random event ID, request IP and Meta's browser/ad-click IDs so browser and server copies count once; the server does not forward the raw User-Agent header. No name, email, phone, birth date, PaddleLens account ID, purchase, club or athlete data, and never a private account route. For what the pixel collects Meta is not our processor: we and Meta are joint controllers under Meta's Controller Addendum, and Meta also uses it for its own purposes: choosing who is shown ads, its own advertising, and what its apps and AI show you. Privacy §6 sets out which of us answers for what. | United States and elsewhere |
| Reddit, Inc. — Reddit Pixel and Conversions API | Measures whether the ads we buy on Reddit bring anyone here, and lets Reddit choose who sees them next | Only if you accepted advertising cookies, and only on eligible public URLs: that a browser opened one while signed out, its IP and browser details, Reddit's browser ID and any Reddit ad-click ID, and — anonymously — that someone asked for a sign-up link. If you are over 18, our server may also send Reddit your sign-up and, once you have accepted the current Terms, the start and completion of a credit-pack purchase, each with an event ID, your email address hashed with SHA-256 and a code for your account that only Reddit receives; the sign-up and checkout start also carry the request IP, User-Agent, screen size and Reddit IDs, and the purchase events the pack and price. No name, phone, birth date, PaddleLens account ID, club or athlete data, and never a private account route. Reddit is not our processor either: under Reddit's Business Tool Terms and Advertising Data Processing Agreement we and Reddit are independent controllers, and Reddit also uses what it receives for its own purposes, including choosing who is shown ads and its own advertising. Privacy §6 sets out which of us answers for what. | United States |
Google Drive, and why it isn't on that list
If your club switches on the club photo drop, photos and video go into a folder in your club manager's own Google account — under your club's relationship with Google, not ours. We relay the files and keep no copy, and our access is scoped so we can only reach the folder we created for your club. So Google is your club's processor for those photos rather than our subprocessor, and only your club manager can delete them. Privacy §3 explains this properly, and everyone is shown it before their first upload.
Push notifications, and why your browser picks the company
If you turn notifications on, they reach your device through the push relay built into your browser — Google's for Chrome, Mozilla's for Firefox, Apple's for Safari, Microsoft's for Edge. We don't choose that company and can't replace it; your browser does. What it sees is an encrypted payload it cannot read — each message is enciphered to keys held only by your browser — plus the delivery address your browser assigned to itself. Turning notifications off deletes that address from our server, and deleting your account does too.
What we don't do
- No data brokers, no analytics beyond the two rows above, and no advertising network beyond the two named above — which measure our own ads and choose who sees them, only with your consent, and never see a signed-in screen; the one thing either learns about life inside the app is Reddit's report of a consenting adult's credit-pack checkout and purchase.
- Nothing here trains an AI model on your data — not ours, not Anthropic's.
- We have never sold personal information for money. Since August 2026 we do share, in the California sense, if you accept advertising cookies: eligible public-page visits and, for adults, the successful-signup fact — and, to Reddit only, credit-pack checkouts and purchases. Privacy §6 explains it and Cookie settings turns it off.
- No club or athlete data ever reaches an advertising platform, and no name, account ID, roster, profile, measurement, report, frame, photo, message, phone number or birth date — not raw, hashed, as a customer list, or for a custom or lookalike audience. The one piece of identity that does is Reddit's: for a consenting adult, a hashed email and a code for the account that only Reddit receives, with a sign-up or a credit-pack checkout or purchase. Meta receives only the fact a sign-up succeeded, a deduplication ID, connection data and Meta's own browser/click IDs, and no purchase. Widening either closed list requires a new notice and acceptance.
Changes
This list was last changed on September 30, 2026. The date moves when the table moves, not when we tidy the wording, so you can trust it as a change log. Clubs with a data processing agreement in place also get the notice by email.
Questions, or a request about your data? Write to info@paddlelens.com.