Subprocessors

What This Page Covers

Martial Arts Toolkit uses a small number of external service providers to run the platform. Where those providers process personal data on behalf of a club, they act as subprocessors under our data processing agreement with that club. This page lists each provider, what it processes, and when it is used.

Current Subprocessors

Vercel — Application hosting, private file (Blob) storage, request logs, and cookieless analytics and performance measurement. Used: Always.

Railway — Managed MySQL database hosting, backups, and infrastructure logs. Used: Always.

Resend — Transactional and club email delivery: recipient, sender, subject, message content, attachments, and delivery events. Used: When email features are used.

Stripe — Payments and billing: account, payer, transaction, subscription, refund, and fraud-prevention information. Card and bank details are entered on Stripe-hosted pages and never stored by us. Used: When billing or club payments are enabled.

Google — Sign in with Google: OAuth identifier, verified email address, and the sign-in transaction. Used: When an account chooses Google sign-in.

OpenAI — Optional AI drafting features: the prompt and working context a user chooses to submit. Not used for club records otherwise. Used: Only when an optional AI feature is used.

Ionx Solutions LLP (Verisys Antivirus API) — Malware scanning of uploaded files in the UK region: file bytes and detected type under a neutral name. Files are deleted by the provider immediately after scanning. Used: When files are uploaded.

Ideal Postcodes — UK address lookup: the postcode or partial address typed into an address box, so a full address can be chosen from a list. Only the text entered in that box is sent - no name, and nothing identifying the person the address belongs to. Used: When an address is searched for rather than typed out in full.

Embedded Content

Clubs can link YouTube videos as training resources. Playing an embedded video is a direct interaction with YouTube under YouTube's own terms and privacy policy rather than subprocessing on our instructions.

Changes To This List

We review this register before enabling any new provider and keep contractual and UK transfer arrangements in place for each one. Clubs with a data processing agreement are notified of material subprocessor changes and may object as set out in that agreement.

Contact

Questions about this list or our data protection arrangements: support@martialartstoolkit.com.