Legal
Subprocessors
The service providers who process personal information on Courtwell's behalf, kept current here and referenced from our Privacy Policy §7.
| Provider | Entity | What they receive | Processing location |
|---|---|---|---|
| Cloudflare | Cloudflare, Inc. (US) | Hosting, database, object and video storage, video delivery, email sending, request logs, cookieless site analytics — effectively all Service data at rest and in transit | Global edge; primary database in the United States (western North America) |
| Supabase | Supabase, Inc. (US) | Managed PostgreSQL holding the billing ledger, AI agent run records, derived facts extracted from your messages, and curriculum embeddings; the primary athlete record is being migrated here | US (N. Virginia) |
| Clerk | Clerk.com (US) | Identity of record: email, name, credentials, session tokens, Google sign-in linkage | US |
| Anthropic | Anthropic, PBC (US) | AI processing as described in Section 6. Excluded from training on our data | US |
| Stripe | Stripe, Inc. (US) | Payment and subscription processing. Receives card details directly from you | US |
| Expo | Expo (650 Industries, Inc.) (US) | Push notification token and a content-free message body, relayed onward to Apple (APNs) or Google (FCM). Also delivers over-the-air app updates, so the app contacts Expo on launch, sending device and app-version metadata and your IP address | US |
| PostHog | PostHog Inc. (US) | Product analytics events keyed to an opaque identifier, with derived flags only | US |
| Langfuse | Langfuse GmbH | AI request metadata only — surface, model, prompt version, token counts, timing. No prompt or response text | US |
| Sentry | Functional Software, Inc. (US) | Application error reports: error type, message, stack, route. No account identifier, email, or training data | US |
| Google LLC (US) | Sign-in, where you choose Google; a coach's calendar busy times, where the coach connects a Google Calendar (Section 3.11); push delivery to Android devices | US |