Legal

Subprocessor List

1. About this list

NXTRUNN LLC uses the third-party service providers below ("subprocessors") to operate the platform. Each processes personal data only on NXTRUNN's instructions and under a data-processing agreement (DPA), and only to provide its service. We maintain this list as part of our transparency commitments under GDPR, UK GDPR, CCPA/CPRA, LGPD, PIPEDA, and the Australia Privacy Act. We update this list when we add, remove, or materially change a subprocessor.

2. Current subprocessors

Format: Subprocessor — Service / purpose — Personal data processed — App / Portal — Processing location

• Clerk — Authentication, identity & session management — Name, email, credentials, user IDs, age-verification flag — Both — United States
• Supabase — Primary application database (Postgres) — All account, profile, activity, UGC, transaction-metadata, and operational data — Both — United States
• Cloudflare R2 — Object storage (photos, media, uploaded documents) — Run/profile/post photos, event media, verification documents — Both — United States / global
• Stripe (incl. Stripe Connect) — Payments for tickets, merchandise & partner subscriptions; organizer payouts; fraud prevention — Payment/transaction metadata, payout/banking & KYC data (held by Stripe), customer/subscription IDs — Both — United States / global
• Apple App Store / Google Play — Mobile app distribution and consumer in-app membership purchases — Install/account data and subscription status per store policies — App (mobile) — Global
• Mapbox — Maps, geocoding, address/location search — Approximate/searched location, IP, map-interaction data — App — United States
• AWS SES — Transactional email delivery — Email address, message content, delivery metadata — Both — United States
• Sentry — Error & performance monitoring — Diagnostic/device/context data (PII scrubbed/minimized) — Both — United States
• PostHog — Product analytics (enabled where configured/consented) — Usage events, device/approx-location, pseudonymous IDs — Both — United States
• Upstash (Redis) — Rate limiting, caching — IP/user identifiers, ephemeral keys — Both — United States / global
• Anthropic (Claude) — AI-assisted features — Content submitted to AI features; prompt/inputs — Both — United States
• Apple Wallet (Apple) — Digital pass generation/distribution — Pass/ticket data, holder identifiers — App — United States / global
• Google Wallet (Google) — Digital pass generation/distribution — Pass/ticket data, holder identifiers — App — United States / global
• OpenWeather — Runner's weather forecast — Approximate location/coordinates for forecast — App — United States / global
• Printful — Merchandise printing & fulfillment — Buyer name, shipping address, order details — Portal — United States / global
• Vercel — Application hosting & delivery — All data transiting the app; request/IP logs — Both — United States / global
• Svix (via Clerk webhooks) — Webhook delivery infrastructure — Event payloads (user/account identifiers) — Both — United States
• Slack — Internal support/ops notifications — Limited operational/support metadata — Internal — United States

Processing locations reflect each provider's primary U.S. operations; some providers may process data in other regions under their own configurations and data-processing agreements.

Note on Activity Connections: Apple Health (HealthKit) and Health Connect on Android are device-level integrations, not subprocessors. Garmin Connect and COROS are independent third-party platforms from which NXTRUNN may receive data at your direction through provider-authorized OAuth/API connections; they are not NXTRUNN subprocessors merely because you connect an account. Their own privacy policies govern the information they hold. NXTRUNN's Privacy Policy governs the activity data NXTRUNN receives and stores.

3. International transfers

Several subprocessors process data in the United States and other countries. NXTRUNN relies on appropriate safeguards (e.g., EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework where a provider is certified) for such transfers, as described in the Privacy Policy (§7).

4. Contact

Questions about our subprocessors or to request transfer-safeguard details: legal@nxtrunn.com · info@nxtrunn.com · NXTRUNN LLC, 1317 Edgewater Dr #2018, Orlando, FL 32804, United States.