Sub-processors
CheerDeck uses the providers below to host and run the service. We give producers and clubs at least 14 days’ notice before adding or replacing one (see the data processing agreement).
| Provider | What for | Personal data | Where | UK transfer mechanism |
|---|---|---|---|---|
| Supabase | Database, sign-in and real-time updates for staff devices | All CheerDeck data (the database) | United Kingdom (London, eu-west-2) | Stored in the UK. Support access from the USA under the UK International Data Transfer Addendum. |
| Cloudflare | Web hosting, content delivery, the API service, file storage (music, public results, encrypted backups), security checks on forms | Requests to CheerDeck; music files; published public files (team and club names only); encrypted backups | Global network; storage in the EU/UK region | UK Extension to the EU–US Data Privacy Framework; UK International Data Transfer Addendum. |
| Brevo | Sending email (sign-in links, invoices, notifications) | Recipient name and email address, message content | European Union (France) | UK adequacy regulations for the EU. |
| Stripe | Card payments for entries and tickets, on each producer’s own Stripe account | Payer name, email address, payment details (entered with Stripe, never seen by CheerDeck) | Ireland / United States | UK Extension to the EU–US Data Privacy Framework; UK International Data Transfer Addendum. For entry and ticket payments Stripe acts for the producer. |
| GitHub | Running encrypted nightly backups and the monthly automated restore drill | Encrypted database backups in transit; the drill restores into a temporary environment that is destroyed at the end of the job and keeps nothing | United States | UK Extension to the EU–US Data Privacy Framework. |
| Resend (only if enabled) | Back-up email sending for urgent mail when the daily email budget is used up | Recipient name and email address, message content | United States | UK International Data Transfer Addendum. Listed only while the overflow is configured. |
What is never sent to these providers
- No production personal data is ever copied to a test or development environment; automated tests use fictional data only.
- Public event pages and producers’ websites receive team and club names only.
- Logs and error reports carry codes, never names, emails, dates of birth or messages that could identify a child.
Questions: privacy@cheerdeck.co.uk.