Providers and cookies
Service providers and international transfers
These providers process information to operate Ludi. AI features run when an authorised user requests them.
| Provider | Purpose and data | Location | Safeguard |
|---|---|---|---|
| Supabase, Inc., USA | Database, authentication and file storage. Holds all data stored in Ludi, including athlete records. | Our project is hosted in Frankfurt, Germany (eu-central-1). Supabase is a company based in the USA. | Supabase data processing agreement, including the EU standard contractual clauses: supabase.com/legal/dpa. Copy: at the link above or on request from nelson@ludisp.com. |
| Cloudflare, Inc., USA — hosting and security | Website requests, browser and request information, hosting, scheduled jobs and Turnstile bot checks. Request and error logs: 7 days. | Global processing; not limited to the EU. | Cloudflare DPA with EU Standard Contractual Clauses: cloudflare.com/cloudflare-customer-dpa. Copies available at the link or from nelson@ludisp.com. |
| Cloudflare, Inc., USA — email forwarding | Forwards messages sent to ludisp.com addresses to our mailbox. | Global processing; not limited to the EU. | Cloudflare DPA with EU Standard Contractual Clauses, linked above. |
| Cloudflare, Inc., USA — voice transcription | Workers AI turns AI-assessment voice memos into text. Ludi does not save this audio. Cloudflare normally deletes audio and text after processing, subject to its legal and security exceptions; operational metadata may be retained. | Processing is not limited to the EU. | Cloudflare DPA with EU Standard Contractual Clauses, linked above. |
| Plus Five Five, Inc. (Resend), USA | Sign-in and password emails, invitations, booking messages and operational emails containing names, email addresses, messages, team and appointment details, booking notes, access links and calendar invitations. Booking notes should contain only necessary appointment information. | Stored in the USA, including when sent through Ireland. Email and log data is generally retained for 30 days; provider terms govern backups and retention after termination. | Resend data processing agreement with the EU standard contractual clauses; Resend is also certified under the EU-US Data Privacy Framework: resend.com/legal/dpa. Sub-processors: resend.com/legal/subprocessors. Copies available on request. |
| Anthropic Ireland, Limited, Ireland | AI-assisted assessment drafts requested by a user. Submitted data includes selected text, images and PDFs, relevant profile information including injury details and existing notes, and follow-up answers. Structured profile information excludes names and contact details, but text and files may still identify people. API data is not used for model training by default. | Processing in the USA; data is normally deleted within 30 days. For flagged usage-policy violations, inputs and outputs may be retained for up to two years and related classification scores for up to seven years. Other exceptions apply for legal obligations and certain features. Details: privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data. | Provider DPA with the Standard Contractual Clauses applicable to the contractual relationship: anthropic.com/legal/data-processing-addendum. Sub-processors: anthropic.com/subprocessors. Copies available on request. |
Some providers and their sub-processors process data outside the European Economic Area, particularly in the USA. Those transfers are subject to the safeguards stated in the table.