Trust
Sub-processors Register
Version 1.2 · 9 active sub-processors
What This Is
This register lists all sub-processors engaged by BuiltByGo Ltd (operating Endorsr) that may process personal data. We maintain this register as part of our UK GDPR compliance under Article 28.
We review and update this register quarterly. Registered users will be notified of any additions or changes at least 14 days in advance.
Active Sub-Processors
| Name | Service | Data Processed | Location | DPA |
|---|---|---|---|---|
| Supabase | Database, Auth, Edge Functions | All platform data including profiles, deals, transactions | US (GCP us-west4) | Yes |
| Stripe | Payment processing & Connect | Payment metadata, transaction history | US / EU | Yes |
| Cloudinary | Image hosting & transformation | User-uploaded images | US (AWS us-east-1) | Yes |
| Mux | Video hosting & streaming | User-uploaded videos | US / EU | Yes |
| Cloudflare | CDN, DNS, DDoS protection | Request metadata, cached assets | Global edge | Yes |
| Railway | Web application hosting | Application runtime data in transit | US | Yes |
| Resend | Transactional email delivery | Email addresses, email content | US / EU | Yes |
| PostHog | Product analytics (self-hosted) | Anonymised usage events | US | Yes |
| Sentry | Error and performance monitoring | Error stack traces, performance metrics | US | Yes |
Conditional Sub-Processors
The following sub-processors are only engaged if the Controller uses specific platform features:
- Printful — Print-on-demand fulfilment (only if athlete sells merch)
- Partnero — Referral programme (only if user participates)
Changes
We will notify all Controllers at least 14 days before engaging any new sub-processor. If you do not wish to consent to a new sub-processor, you may terminate your account within that period.
For questions, contact [email protected].