Legal
Subprocessors
Last updated: 21 May 2026
CatchLab uses the following providers to deliver, host, secure, or operate the service. Locations and transfer mechanisms depend on the provider's own infrastructure and legal terms.
Core Platform Subprocessors
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, storage, row-level access control, and platform backend services. | Club, coach, athlete, session, telemetry-derived data, raw session archives, credentials, and application records. |
| Vercel | Hosting for the public website, portal, admin app, and serverless routes. | Account/session requests, application traffic, logs, and operational metadata. |
| Railway | Hosting for the Python processing API that processes raw Peach files and generates analysis outputs. | Raw session archives, session metadata, generated analytics, temporary processing files, and operational logs. |
| Cloudflare | DNS, traffic delivery, security, or email-obfuscation services where enabled for CatchLab domains. | Website request metadata, IP addresses, headers, and technical security data. |
Website And Operational Services
| Provider | Purpose | Data involved |
|---|---|---|
| Google Fonts | Font delivery for the public website unless fonts are self-hosted. | Technical request metadata from website visitors. |
| jsDelivr | Chart.js delivery for the public demo page. | Technical request metadata from demo page visitors. |
| Tally | Embedded demo/contact form on the public demo page. | Contact details and form responses submitted by website visitors, plus technical request metadata. |
| GitHub | Code hosting, deployment workflows, and issue/operations records. | Operational metadata, code, and support/security information. Customer data should not be intentionally stored in GitHub. |
Connected Services
Intervals.icu, TrainingPeaks, Strava, Garmin Connect, and similar platforms are connected services chosen or instructed by clubs, coaches, or athletes. They are normally independent recipients or controllers for data sent to them, not CatchLab subprocessors for core platform hosting.
Changes
CatchLab may update this list when providers change. CatchLab will give reasonable prior notice of material subprocessor changes, normally 30 days where practical. Customers may object to a new subprocessor on reasonable data-protection grounds by contacting [email protected].