Sub-processors
The third-party services ClubHelix relies on to deliver the platform, what each one does, and the personal data it handles on our behalf.
Last updated: 12 September 2026
This platform is operated by ClubHelix (ABN 94 817 471 185) (“we”, “us”). To run a reliable, secure platform we use a small set of trusted third-party providers. Under data-protection law these are our sub-processors: services that process personal data on our instructions and on your behalf when you or your members use a ClubHelix site.
We choose providers that offer strong security and a data-processing agreement, share only the data each one needs to do its job, and keep the list below current. Every provider’s own privacy or data-processing terms — including their full legal entity name and data-residency commitments — are linked from their name.
Current sub-processors
| Provider | What it does | Personal data processed |
|---|---|---|
Vercel Hosting & delivery | Runs the ClubHelix application, serves every page over its global edge network, and provisions tenants’ custom domains. | IP address, request metadata, and any content submitted through the site while it is being served. |
Supabase Database, auth & storage | Primary managed Postgres database, user authentication, and storage for uploaded files such as logos and gallery images. | Account and member records, authentication credentials and sessions, and uploaded files. |
Stripe Payments | Processes subscription billing for clubs and, where enabled, member registration and shop payments, including invoicing and tax handling. | Name, email, billing address, payment-method/card details, and transaction history. |
Amazon Web Services (Amazon SES) Email delivery | Sends transactional email (sign-in, receipts, notifications) and member broadcasts, with per-tenant DKIM signing. | Recipient name and email address, and the content of the message sent. |
Twilio SMS delivery | Delivers text messages — member notifications and admin broadcasts — for organisations that switch SMS on. Listed here ahead of that switch, so the disclosure precedes the first message rather than following it. | Recipient mobile number and the content of the text message sent. |
Sentry Observability | Captures application errors and performance traces so we can diagnose and fix faults. | IP address, account/user identifiers, and diagnostic metadata attached to errors. |
Axiom Observability | Stores and indexes application logs for debugging, security and auditing. | Request metadata and any account identifiers that appear in log lines. |
Inngest Background jobs | Schedules and runs background workflows such as notifications, email fan-out and recurring maintenance tasks. | Job payloads that may contain account and member identifiers. |
Google Sign-in & search | Optional “Sign in with Google” authentication, and Google Search Console registration for paid tenants’ verified custom domains (search indexing). | For sign-in: your Google email and basic profile. For Search Console: public site URLs and sitemaps only. |
Anthropic AI features | Powers the optional “Helix Assistant” editor, which generates site content and theme suggestions when an admin asks for them. | The prompt and page/theme text an administrator chooses to submit to the assistant. |
Web push notifications
If a member opts in to push notifications, their browser or device delivers those messages through the push service operated by their browser or operating-system vendor (for example Google, Apple or Mozilla). We sign and send messages to whichever endpoint the member’s own browser provides; we don’t choose that vendor and only send a message when there is something to notify.
Tenant-provided integrations
Some features only send data to a provider when a club’s administrators enable them — for example connecting their own payment payouts or embedding third-party content. Where a club configures such an integration, that provider acts as a sub-processor for that club’s data, in addition to the platform-wide list above.
Changes & how to object
This list may change as the platform evolves. When we add or replace a sub-processor we will update this page. If you have a data-processing agreement with us that entitles you to advance notice of changes, we will provide it as agreed. To ask a question, request details, or object to a particular sub-processor, contact us at security@clubhelix.com.