Sub-processors
The complete list of third parties involved in running Priveo. If we add one, this page changes before the service is switched on, and existing customers are told.
| Who | What they do | Where |
|---|---|---|
| Supabase | Database, authentication, scheduled jobs. This is where athlete records live. All clinical and account data | EU — Frankfurt (eu-central-1) |
| Vercel | Serves the application. Requests pass through; nothing clinical is stored there. Request metadata in transit | Global edge network |
| Stripe | Subscription billing. Card details go to Stripe directly and never reach us. Your email and billing record. No athlete data. | US / EU |
| Resend | Sends the one daily digest email to you. Nothing else is emailed. Your email address and the digest contents | US / EU |
| Sentry | Error reports, so a crash gets fixed rather than repeated. Scrubbed stack traces. Names, emails, clinical fields and tokens removed before sending. | EU |
| PostHog | Counts which features get used, so effort goes to the ones that do. Numeric and boolean events only. No identifiers, no free text, no recordings. | EU |
Not on this list, deliberately
- No AI or LLM provider. Priveo has no machine-learning features and never will, so no athlete data is sent to a model — ours or anyone else’s. See the thresholds: the clinical logic is arithmetic against published research.
- No advertising or tracking networks. No ad pixels, no fingerprinting, no data brokers.
- No third-party fonts or CDNs. Fonts are served from our own domain, so loading a page does not tell anyone else that you visited.
Need a signed DPA?
Clubs and federations usually do. Ask and you will get one.
Written to be accurate and readable, not to be exhaustive. It is not legal advice. If your club, federation or insurer needs a signed agreement or a specific clause, email us and you will get a real answer from a person.