List of sub-processors
Last updated : May 9, 2026
In accordance with Article 28 of Regulation (EU) 2016/679 (GDPR), Stopsport (operated by FV – Fitness Vendor) maintains an up-to-date list of sub-processors involved in the operation of the Platform. This page is the versioned source of truth. The Privacy Policy and the DPA may refer to this page for the latest details.
1. Active sub-processors
| Sub-processor | Service | Data location | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. | Database and authentication | European Union (Frankfurt) | No transfer outside the EU |
| Vercel Inc. | Hosting, CDN, serverless functions | United States | Standard contractual clauses |
| Stripe Payments Europe Limited | Payments, KYC, payouts (Connect Express) | Ireland (Dublin) | No transfer outside the EU for EU payments. PCI-DSS Level 1 |
| Resend Inc. | Transactional emails | United States | EU-US Data Privacy Framework |
| Functional Software, Inc. (Sentry) | Server-side error monitoring | United States | Standard contractual clauses |
| Mapbox Inc. | Mapping and geolocation | United States | Standard contractual clauses (Mapbox DPA) |
| Microsoft Corporation (Microsoft Clarity) | Usage analytics, heatmaps, anonymized sessions | United States | EU-US Data Privacy Framework |
| Meta Platforms Ireland Ltd. (Pixel + Conversions API) | B2B campaign performance and advertising retargeting | Ireland (Dublin) | Activated only after explicit consent |
| Anthropic, PBC | Performance reports (aggregated and anonymized data only) | United States | Standard contractual clauses |
| Upstash Inc. | Abuse protection (rate limiting) | European Union | No transfer outside the EU |
| Intercom Inc. | Embedded customer support (chat) | United States | Standard contractual clauses (Intercom DPA) |
| API Entreprise (gouv.fr) | SIRET verification at registration | France | Public data |
| OVHcloud SA | DNS, email forwarding, network infrastructure | France | No transfer outside the EU |
VirtuaGym (optional integration, member lookup) acts as a sub-processor only when a club explicitly enables the integration in its settings.
2. Prior information and right to object
Pursuant to Article 28.2 of the GDPR, FV – Fitness Vendor undertakes to inform data controllers (user clubs) before adding or replacing any sub-processor. Such information is provided through an update of this page ("Last updated" date) and, where the change directly affects an existing processing activity, by email notification to the clubs concerned.
The club has fifteen (15) days from the date of information to object to the change. In the event of legitimate objection based on data protection grounds, the club may terminate its use of the Platform without notice in accordance with the terms set out in Article 14 of the Terms.
3. Change history
| Date | Sub-processor | Action | Reason |
|---|---|---|---|
| May 9, 2026 | OVHcloud | Added | Explicit listing of the DNS and email forwarding provider (already in use) |
| May 9, 2026 | Page created | Initialization | Versioned source of truth for the sub-processor list (April 2026 audit, GDPR Art. 28.2 compliance) |
| May 1, 2026 | Anthropic | Added | Weekly performance report generation (aggregated data) |
| April 27, 2026 | Meta Platforms Ireland | Added | B2B performance measurement and retargeting (Pixel + Conversions API) |
| April 30, 2026 | Stripe Connect Express | Reclassified | Migration from standard Stripe to Stripe Connect Express (KYC + IBAN now managed by Stripe) |
| April 1, 2026 | Microsoft Clarity | Added | Usage analytics and heatmaps |
| April 1, 2026 | Sentry | Added | Server-side error monitoring |