Subprocessors
Effective October 5, 2026
Descriptive clarifications updated October 9, 2026
ClubNest uses specialized infrastructure providers to operate the platform. This page identifies providers used for the functions below. A provider receives information only when its relevant feature or workflow is used. Locations describe service infrastructure, not a promise of exclusive U.S. data residency.
Current principal providers
| Provider | Purpose | Processing location |
|---|---|---|
| Supabase | Database, authentication, storage and backend infrastructure | Depends on configured service region and provider infrastructure |
| Vercel | Web application hosting, delivery and deployment infrastructure | Global infrastructure; location may vary by service configuration |
| Cloudflare | Turnstile human verification and abuse prevention on protected forms; browser and network signals are processed by the provider | Global provider infrastructure; processing depends on the service |
| GitHub | Source and deployment automation, including private backup capture on hosted runners; recovery data is processed temporarily before archive encryption | Hosted runner and provider infrastructure; location depends on the service configuration |
| Google Drive | Storage of encrypted platform recovery archives uploaded by the backup workflow to the connected backup account | Provider infrastructure; locations and terms depend on the connected account and service |
| Resend | Email delivery and delivery-event processing when email is enabled; recipient addresses and message content are sent to the provider | Provider infrastructure; verify applicable regional and contractual terms before enabling delivery |
| Sightengine | Profile photo screening when configured and enabled; uploaded image content is sent for explicit and inappropriate content detection before storage | Provider infrastructure; verify applicable regional and contractual terms before enabling photo uploads |
Payment providers and embedded services
Square processes ClubNest subscriptions and, when connected by an organization, its supported member payments. PayPal processes supported payments where the organization’s connection is available. These providers receive payment, account and transaction information and may act independently for fraud prevention, payment-network and regulatory obligations. Their own terms and privacy notices apply.
Embedded Google Maps receives the requested event location and ordinary browser/network information when a map loads. Opening external links also takes you to that provider’s service. Maps and customer-selected integrations are not a promise that all their processing occurs solely on ClubNest instructions.
Optional calendar subscriptions and airport weather
Adding an event to an external calendar sends its title, times, description and location to the calendar service you choose. When you subscribe to an Aviation calendar feed, your selected calendar provider receives the feed URL and its reservation and registered-event titles, times and locations. That provider acts under its own terms and privacy practices. Anyone holding the private URL can retrieve the feed without signing in. Rotating or disabling the URL prevents future access through it, but does not delete previously downloaded copies.
The Aviation airport-weather display requests METAR observations from the NOAA National Weather Service Aviation Weather Center. ClubNest sends the selected airport identifier from its server; the request does not include your member profile, credentials or reservation details. An airport observation is not a complete preflight briefing.
Changes and objections
The Data Processing Addendum explains notice, objection and contractual protections for subprocessors. Contact info@clubnest.tech for processing questions or to object to a proposed provider on data-protection grounds. Updating this list does not by itself replace a required customer notice.
Contractual safeguards
Providers processing Customer personal information on our behalf are subject to applicable contractual confidentiality, security and use restrictions. A Customer’s separately connected provider may have its own independent relationship with the Customer. Review that provider’s terms and permissions before connecting it.