Legal and privacy
Service Providers and Data Recipients
- Last updated:
- 21 June 2026
- Effective:
- 21 June 2026
- Version:
- 2026-06-21
ScoreSocial uses service providers and data recipients to host, secure, support, bill for, and operate the product. This page is updated when material provider use changes.
1. Provider inventory
| Provider | Role and purpose | Data categories | Region and safeguards | Retention |
|---|---|---|---|---|
| Supabase | Database, authentication support, file storage, private buckets, signed URLs. | Account, organisation, membership, invite, access request, prediction, score, standing, audit, notification, push, storage, screenshot, and legal acceptance data. | Production project region: AWS eu-west-2. Service terms, privacy terms, security controls, and DPA materials apply where available. | Database/storage records follow ScoreSocial retention rules and Supabase backup/storage settings. |
| Vercel | Hosting, serverless functions, deployment, request handling, application logs. | IP address, headers, route metadata, request IDs, deployment logs, application diagnostics. | Provider infrastructure may process data in multiple regions. Vercel account terms and data protection terms apply where available. | Request and deployment logs follow Vercel project/account settings. |
| Stripe | Organiser subscription checkout, billing portal, invoices, payment method handling, webhooks. | Billing email where supplied, customer IDs, subscription IDs, plan/status, invoice/payment metadata held by Stripe, webhook metadata. | Stripe acts under its own services agreement and privacy notices, with controller/processor roles depending on the billing activity. | Billing and tax records are retained for subscription, accounting, tax, dispute, and legal obligations. |
| Resend | Email delivery for recovery and OTP flows. | Email address, message content, delivery metadata, bounce/error data. | Provider terms, privacy terms, and data protection materials apply where available. | Email delivery metadata follows provider/project settings and operational need. |
| Sentry | Errors, diagnostics, performance, logs. Session Replay is disabled by default. | Error context, route metadata, device/browser data, logs, technical identifiers, and replay data only if separately enabled. | Provider terms, privacy terms, security controls, and DPA materials apply where available. | Diagnostics retention follows active Sentry project settings. |
| GitHub | Private issue tracker for bug reports and support/development work. | Bug report text, labels, metadata, platform/version, signed screenshot links. | Repository access is limited to authorised support/development users. GitHub terms and privacy notices apply. | Issues and comments are retained for support, audit, and development history unless removed. |
| Expo, Apple/APNs, Google/FCM/Google Play | Mobile push delivery, app distribution, and related platform services. | Push tokens, notification metadata, app diagnostics depending on platform settings. | Provider platform terms, privacy notices, and store policies apply. | Push tokens are retained until logout, opt-out, token replacement, account cleanup, or app data removal. |
| Upstash/Redis where configured | Caching, rate limiting, tenant/sports data cache. | Cache keys/values may include organisation, tenant, IP/rate-limit, or sports data depending on configuration. | Provider terms and selected region/settings apply. | Cache records follow configured TTLs and cleanup behavior. |
| Sports data providers | Fixture, result, standings, event, and pool data sources. | Sports data and server request metadata. User data is not needed for normal fixture/result requests. | Provider API terms and request logging apply. | Sports data is retained as part of fixtures, results, standings, and event history. |
2. Updates
This page is updated when ScoreSocial adds or removes providers, changes production regions, changes retention settings, adds analytics, changes push providers, or changes bug/support workflows.