Subprocessors
1. About this list
This page lists the third-party service providers ("subprocessors") that Stailan AS ("Stailan", "we", "us", or "our") uses to operate the Stailan training platform. Each subprocessor is bound by a written data processing agreement that limits how they may use your personal information.
This list supplements section 8.1 of our Privacy Policy and is updated whenever we add, remove, or materially change a subprocessor.
2. Current subprocessors
| Provider | Service | Data shared | Location |
|---|---|---|---|
| Supabase Inc. | Database, authentication, edge functions. | All categories of personal data described in the Privacy Policy (other than live video/audio). | European Union (data stored in the EU region we have selected). |
| Anthropic, PBC | AI training plan generation and AI analysis chat (Claude API). | Health and fitness data, training history and goals, chat messages, summaries of workout data necessary to generate the requested output. | United States. |
| Strava, Inc. | Account login (OAuth) and activity import. | Authentication tokens, your Strava athlete ID, activities you choose to import. | United States. |
| Daily.co (Daily, Inc.) | Real-time video and audio for live group rides. | Real-time video and audio streams (not recorded), basic room participation metadata. | United States, with EU regional infrastructure where available. |
| GraphHopper GmbH | Route calculation. | Start, end, and waypoint coordinates for the route you request. | Germany (European Union). |
| MapTiler AG | Map tile rendering for route planning and analysis. | IP address and the coordinates of the map area you are viewing. | Switzerland, with global edge infrastructure. |
| Stripe Payments Europe, Limited | Web subscription processing and billing. | Name, email, billing address, payment instrument data (handled directly by Stripe), transaction information. | Ireland (European Union), with global processing infrastructure. |
| Apple Inc. (App Store) | In-app purchases on iOS. | Apple ID, purchase information, device information (handled by Apple). | United States and Ireland. |
| Google LLC (Google Play) | In-app purchases on Android. | Google account, purchase information, device information (handled by Google). | United States and the European Union. |
| Resend, Inc. | Transactional email delivery. | Email address, name, content of transactional emails (e.g., verification, password reset). | European Union region. |
| Vercel, Inc. | Hosting and content delivery for the web application. | IP address, request logs, content cached for delivery. | United States headquarters, with European Union regional compute and edge infrastructure. |
3. International transfers
Several of the providers above are based in the United States or operate global infrastructure. For transfers of personal data outside the European Economic Area, we rely on Standard Contractual Clauses adopted by the European Commission and on supplementary technical and organisational measures. See section 9 of the Privacy Policy for the full description of these safeguards.
4. Changes to this list
We will give reasonable advance notice of any new subprocessor that materially affects how your data is processed, for example through a notice in the Service or by email. The version history of this page is available in the changelog.
5. Contact
If you have any questions about our subprocessors or want a copy of the relevant data processing agreements, please contact us at support@stailan.com.
End of Subprocessors. This document is a draft prepared as a starting point for review by qualified legal counsel before publication.