Legal

Subprocessor List

Effective August 19, 2026. Contact: privacy@puckdesk.com

PuckDesk engages the following third-party service providers that may process Customer Data (as defined in the Terms of Service) on PuckDesk’s behalf. Where applicable law requires it, PuckDesk imposes appropriate contractual obligations on each subprocessor.

Vendor	Purpose	Data categories	Location	DPA / terms
Stripe, Inc.	Payment processing and subscription billing	Customer name, email, payment instrument metadata (card last 4, expiry, billing address), subscription status and history. PuckDesk does not store raw card numbers.	United States	Stripe Data Processing Agreement; Stripe is independently PCI-DSS compliant.
Supabase, Inc.	Relational database, authentication/session management, file storage	All Customer Data, staff user accounts (name, email, hashed credentials), authentication tokens, organization and player records, uploaded files.	United States (AWS us-east-1 — verify in Supabase dashboard)	Supabase Data Processing Addendum (supabase.com/privacy)
Resend, Inc.	Transactional email delivery	Recipient email address, name, subscription/billing details in email body (invitation, welcome, trial notification emails).	United States	Resend DPA (resend.com/legal/dpa)
Anthropic PBC	AI-assisted data parsing (optional import feature only)	Content of files uploaded by staff when the AI import feature is used. No health data, billing data, or scouting data is sent unless present in the uploaded file.	United States	Anthropic usage policies. Confirm data retention period and DPA requirement for GDPR obligations.
Vercel, Inc.	Application hosting, CDN, serverless function execution	All data transmitted to/from the application (HTTP request/response, auth tokens, application payloads); server-side logs.	United States + global edge network	Vercel Data Processing Addendum (vercel.com/legal/dpa)

Vendors NOT used

The following are not currently used by PuckDesk:

Third-party web analytics (Google Analytics, Amplitude, Mixpanel, etc.)
Advertising or retargeting pixels (Meta Pixel, Google Ads, etc.)
External customer data platforms (CDPs)
Third-party A/B testing tools that receive user data

This list will be updated before any new subprocessor that processes Customer Data is enabled in production. For questions, contact privacy@puckdesk.com.