SPLT Club
Sub-processors
The services that process personal data for us, under contracts that only let them use it to run SPLT Club. Clubs are given at least 30 days’ notice before a new one is added.
| Sub-processor | What for | Data | Where | Transfers covered by |
|---|---|---|---|---|
| Railway | Hosting, database and file storage | All data held in SPLT Club | United States | [EU-US Data Privacy Framework and UK-US Data Bridge, or Standard Contractual Clauses — to confirm] |
| SendGrid (Twilio) | Email: invitations, sign-in links, password resets and notifications | Name, email address and the content of the email | United States | [Data Privacy Framework or Standard Contractual Clauses — to confirm] |
| Stripe | Taking club fee payments | Payer name, email address and amounts; card details are held by Stripe | United States | [Data Privacy Framework or Standard Contractual Clauses — to confirm] |
| Anthropic | Reading an ergometer photo, a receipt or a race draw; reading a club's past results, training plan or race calendar during club setup; reviewing training video; and the coach assistant, which answers a coach's questions and drafts actions for the coach to confirm | For erg photos, receipts and video: the image or frames only. Race draws and setup imports (past results, plans, race calendars) are documents the club uploads and can contain athletes' names, which are read to fill in a form a coach checks and saves. For the assistant: names and squads of the athletes the coach asks about, their recent training, last test, readiness, whether they are fit (never an injury's reason) and check-in notes, limited to athletes who share with that club | United States | [Data Privacy Framework or Standard Contractual Clauses — to confirm] |
| OpenAI | Voice calling on the timing board: a coach says a boat number and the app selects that boat | The coach's voice for the length of the call and the boat numbers they say; no athlete names are sent, and nothing from the call is kept beyond the selections the coach makes | United States | [Data Privacy Framework or Standard Contractual Clauses — to confirm] |
Not sub-processors
- Apps an athlete connects themselves, such as Concept2, Strava, Garmin and Whoop. The athlete authorises them directly, and each has its own privacy policy.
- Google Places, used to find where a club rows. It receives only the place name a coach types, sent from our servers, and no personal data.
- Open-Meteo, OpenStreetMap and the Environment Agency, for weather, place search and river levels. They receive only a club's location.