These are the companies that process data on our behalf so that Paddles Up works. Clubs get 30 days' notice before we add one.
| Provider | What it does | What it can see | Where |
|---|---|---|---|
| Vercel | Hosting and delivery | Requests, IP addresses, headers | US |
| Neon | The database | Everything stored in it | US |
| Electric | Sends the rows you may read to your browser | Rows a signed-in person may read | US |
| Stripe | Payments, and card storage | Name, email, payment details, and identity data for club accounts | US, EU |
| PostHog | Product analytics, session replay, error reporting | Usage events, masked replays, IP, your account identifier | US |
| Resend | Sign-in codes and service email | Email address, message content | US |
| Google Maps Platform | Maps, places and geocoding | Search terms, and approximate location when you use a map | Global |
| Apple, Google | Sign-in, if you use them | The identifier and email they return | Global |
| DUPR | Ratings and match sync | Name, age, gender, profile image, match results — only if you link your account | US |
Two worth a closer look
PostHog. Analytics reaches PostHog from our own domain, so it arrives without your cookies — but PostHog still receives your IP, an identifier for you when you are signed in, and session replays. See Cookies and Tracking.
DUPR. This is a two-way sync, not a feed: results go out and profile fields come back. It happens only if you link your account. There is no unlink control in the app yet — write to privacy@paddlesup.io and we will disconnect it.
Not on this list
Tools that touch our code but not your data — our build system, our secret store, our development tooling. They are in scope for security review and out of scope for this list.