Subprocessors
Version 2026-08-09 · Last updated August 9, 2026
These are the third-party providers Range HQ uses to operate the service. Clubs and federations acting as data controllers for their own membership data can rely on this list to satisfy their own subprocessor-disclosure obligations. We'll update this page before adding or replacing a provider that processes personal data.
| Provider | Purpose | Data categories | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage, realtime leaderboards, Edge Functions | All account, club, journal, and competition data; uploaded files | Managed cloud (project region), DPA + SCCs in place |
| Sentry | Application error monitoring | Technical/error data; auth and cookie headers are stripped before sending | United States |
| Stripe | Club subscription billing | Billing contact details and payment metadata (club owners only) | United States / global, PCI-DSS compliant |
| Tyro | Club card payments (preferred partner) | Club merchant ids / location refs, payment metadata, webhook envelopes (no PAN) | Australia / partner regions |
| Cloudflare (Turnstile) | Bot / abuse protection on sign-in | Device/browser signals used for a pass/fail verification token | Global network |
| Cloudmersive | Malware scanning of uploaded files | Uploaded file bytes, scanned transiently and not retained by the provider | United States |
| Netlify | Application hosting and observability | Request/function logs | Global edge network |
| Roboflow | Auth-gated diagram detect for multi-target card split | Transient target-card image bytes for inference only (v1); browser never calls Roboflow | United States / provider cloud |