Subprocessors
> Last updated: 2026-08-11 > Related: Data Processing Addendum, Privacy Policy
Matfact engages the following subprocessors to provide the platform. Gyms (controllers) are notified of material changes via the product site and/or email when practicable, with at least 30 days notice for non-emergency replacements except where a subprocessor must be changed sooner for security or legal reasons.
| Subprocessor | Service | Location / transfer | Personal data involved |
|---|---|---|---|
| Railway | Application hosting, PostgreSQL | USA (and Railway regions used for the project) | Account and tenant data stored in the database; application logs |
| Cloudflare | DNS, Pages (web apps), R2 object storage | Global / USA | Web traffic metadata; avatar and media URLs/objects |
| Stripe, Inc. | SaaS billing; Connect for gym member dues | USA / EU (Stripe) | Customer identifiers, billing email/name, subscription metadata (cards stay with Stripe) |
| Resend | Transactional and contact email delivery | USA | Recipient email, name, message content |
| Google LLC | Google Sign-In (OAuth ID tokens) | USA | Subject identifier, email, optional profile picture URL |
| Apple Inc. | Sign in with Apple | USA | Subject identifier, email (may be relay) |
Change process
1. Update this file and the published Subprocessors page. 2. Note the change date in Privacy Policy “last updated” when the change is material. 3. For processor engagements with gyms, treat this list as Annex to the DPA.
Vendor terms
Before production go-live, confirm Matfact’s accounts have accepted each vendor’s data processing / DPA terms (Stripe, Resend, Cloudflare, Railway, Google, Apple as applicable).