ScoreOrder Subprocessor Register
Last updated September 22, 2026
This register identifies third parties ScoreOrder directly engages to process Organization Personal Data. A provider’s own subprocessors are governed by its agreement with ScoreOrder and are available through the provider links below.
Direct subprocessors
| Provider | Purpose | Personal data involved | Principal processing location | Provider information |
|---|---|---|---|---|
| Supabase, Inc. | Production database, authentication, private file storage, database APIs, and backups. | Account, profile, registration, membership, attendance, communications, files, operational records, and other information stored by the Service. | ScoreOrder’s primary project is hosted in AWS us-east-1 in the United States. Limited support and provider operations may occur elsewhere. | Privacy Security and DPA information |
| Vercel Inc. | Application hosting, server-side request execution, networking, deployment, and operational logging. | Information contained in requests and responses, account and session metadata, IP address, browser and device metadata, and limited operational logs. | United States and other locations used by Vercel and its subprocessors. | Privacy DPA Security and subprocessors |
| AC PM LLC, doing business as Postmark | Transactional email delivery, delivery events, and bounce and suppression handling. | Recipient and sender addresses, names used in messages, email subject and content, attachments when used, message metadata, delivery status, and bounce information. | United States and other locations identified by Postmark. | Privacy DPA Subprocessors |
| Cloudflare, Inc. | Authoritative DNS for ScoreOrder domains and organization subdomains. ScoreOrder application traffic is not proxied through Cloudflare. | DNS query and account-administration information, including requested hostnames and organization-derived subdomain names. | Global network locations used by Cloudflare. | Privacy DPA Subprocessors |
Mixed-role payment provider
Stripe, LLC
Stripe acts as a processor for some services and as an independent controller for regulated payments, fraud prevention, identity verification, legal compliance, and other purposes described in its terms. It may receive organization names and contact information, ScoreOrder and Stripe identifiers, plan and payment metadata, dues or charge descriptions, payer information, payment status, refunds, disputes, and information entered directly into Stripe-hosted pages. ScoreOrder does not receive full card or bank-account numbers.
Stripe is not treated as a ScoreOrder subprocessor to the extent it independently determines why and how it processes personal data as a controller. Where Stripe processes Organization Personal Data solely on ScoreOrder’s behalf, the processor terms in Stripe’s DPA apply.
User-selected delivery services and recipients
These services are disclosed for transparency but are not selected by ScoreOrder as direct subprocessors. A user or administrator chooses them by enabling the relevant feature or choosing a browser, device, or calendar provider.
Browser and device push services
Apple, Google, Mozilla, or another service selected by the user’s browser or device receives a device endpoint and notification payload to deliver a push notification. ScoreOrder does not select that provider for the Organization.
External calendar providers
An administrator may import a third-party calendar feed, and a user may direct a calendar provider to retrieve a personal ScoreOrder feed. The selected provider receives the feed URL and calendar content at the user’s or Organization’s direction.
Change notices and objections
ScoreOrder will notify Organization contacts and active administrators at least 30 days before a new direct subprocessor begins processing Organization Personal Data, except where an urgent change is reasonably necessary to protect the Service or prevent material disruption. In that case, notice will be given as soon as reasonably practicable.
An Organization may object during the notice period on reasonable, documented data-protection grounds by emailing privacy@scoreorder.app. ScoreOrder will review the objection in good faith and work with the Organization on a reasonable resolution where practicable, subject to the parties’ agreement.