Subprocessors
Last updated September 9, 2026
This page lists the third-party service providers (“subprocessors”) that OpenCourt, Inc. engages to process personal data of our customers’ end users — the players, members and guests who use a club’s OpenCourt instance — on the club’s behalf.
It does not include tools OpenCourt uses for its own business operations, such as our sales CRM or internal email. Those are covered by the OpenCourt Privacy Policy.
Core subprocessors
Engaged for every customer.
| Subprocessor | Purpose | Data categories | Region |
|---|---|---|---|
| Vercel | Application hosting and edge network | All request data, IP addresses | US (us-west-1) |
| Supabase | Database, authentication, file storage | Names, emails, phone numbers, all account and booking data | US (us-west-1) |
| Cloudflare | Reverse proxy, CDN, DNS | IP addresses, uploaded media, traffic metadata | Global edge |
| Stripe | Payments and payouts (Stripe Connect) | Name, email, payment and card data, billing address | US / global |
| Postmark | Transactional email delivery | Email address, name, message content | US |
| Twilio1 | SMS one-time passcodes | Phone numbers | US / global |
| Patch Retention | Retention and customer messaging sync | Names, emails, phone numbers, membership, orders, check-ins | US (region undisclosed) |
| Expo3 | Mobile push notifications and over-the-air updates | Push tokens, device info, notification content, IP address | US |
| Inngest | Background job orchestration | Record identifiers; some recipient email addresses | US |
| PostHog | Product analytics and session replay | IP address, device, usage events, user identifiers, session recordings | US (us-east-1) |
| Sentry | Error and performance monitoring; AI assistant tracing | IP address; personal data incidentally present in error context; Ace AI prompts and results | US |
| Axiom | Log management and observability | IP addresses, request metadata, user agents, user identifiers; personal data incidentally present in logs | US |
| Featurebase4 | Feedback, changelog and surveys (club staff only) | Admin name, email, user and club identifiers | EU |
| Slack | Internal operational alerts | Personal data only incidentally present in error and operations logs | US |
Conditional subprocessors
Engaged only when a club enables the related feature.
| Subprocessor | Purpose | Data categories | Region |
|---|---|---|---|
| Anthropic2 | Ace AI assistant (via Vercel AI Gateway) | Club and customer data included in admin prompts and tool results | US |
| OpenAI2 | Ace AI voice dictation; automatic fallback when Anthropic is unavailable | Admin dictation audio and transcripts; on fallback, Ace prompts and results | US |
| Google (Gemini API)2 | Ace AI automatic fallback when Anthropic and OpenAI are unavailable | Ace prompts and results | US |
| Seam | Smart-lock access control | Name, access codes and credentials | US |
| Rhombus Systems5 | Smart-lock access control (momentary door unlock) | User identifier at the moment of door unlock | US |
| SaveMyPlay | Court video recording | User email, user ID | US (region undisclosed) |
| Sporfie | Court video recording and analysis | Event organizer name, event details, times, court information | US |
| Meta (Facebook)6 | Advertising conversion tracking (Meta Pixel and Conversions API), per club, opt-in | Page-view and purchase events, hashed email and phone, hashed customer ID, IP address, user agent, Meta click IDs | US / global |
Notes
- Twilio is reached through Supabase Auth for SMS one-time passcodes and is a subprocessor of Supabase for that purpose.
- Ace AI is available only to clubs that enable it. Requests route through the Vercel AI Gateway to the model provider, which processes the prompt. Anthropic is the primary provider; OpenAI and Google are used only as automatic fallbacks when the preceding provider is unavailable.
- Expo push delivery reaches Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM).
- Featurebase processes data for club staff and administrators only, not end customers.
- Rhombus Systems is engaged only when a club connects a Rhombus access-control organization. OpenCourt sends the door identifier and the acting user’s identifier at the moment of unlock, and does not create or store door PINs with Rhombus.
- Meta is engaged only when a club turns on conversion tracking for its own advertising and a club administrator accepts an in-app data-sharing acknowledgment. Identifiers are hashed before transmission. OpenCourt never sends card or payment details to Meta.
Third-party rating services
DUPR and World Padel Rating are independent data controllers, not OpenCourt subprocessors. A user connects their existing account through OAuth, authorizing a data exchange between two independent services, each governed by its own privacy policy. The exchange is two-way: OpenCourt retrieves the user’s rating, and sends match results, scores, team composition and event details so the provider can compute it.
Sub-subprocessors
Our subprocessors may engage their own subprocessors to support their services. Where they do, they remain responsible for those parties’ compliance with applicable data-protection obligations. Notable examples: Supabase and Vercel run on Amazon Web Services; Expo push delivery reaches Apple (APNs) and Google (FCM); Seam brokers access to the smart-lock manufacturer’s own systems; Rhombus Systems runs on Amazon Web Services.
Changes to this list
We update this page before engaging a new subprocessor or replacing an existing one. To be notified of changes, email privacy@getopencourt.com.
Questions? Contact us