Who helps us run VEYIAN
These companies process information for VEYIAN, only to provide the service. None of them may use it for their own purposes, and none of it is used for advertising.
In use
| Company | What for | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Supabase | database, sign-in, file storage | every category | EU (Ireland) | to confirm (DPA; US parent: SCCs) |
| Vercel | hosting the website and server | every category in transit; request logs | EU region dub1; US company | to confirm (DPA, SCCs) |
| Resend | sending email | email address, name, message content | to confirm (EU region recommended, M-2) | to confirm |
| Expo (push notifications and app updates) | delivering push notifications; over-the-air app updates (EAS) | push token, notification text (generic, no health words) | US | to confirm |
| Apple Push Notification service and Firebase Cloud Messaging | delivering push notifications to the phone (behind Expo) | push token, notification text | US | to confirm |
| Google Maps Routes | bus arrival times | bus position and stop coordinates (no names) | US | to confirm |
| YouTube (privacy-enhanced) and Vimeo | playing a drill or test video a coach linked | IP address and device data, when a video is played | US | to confirm |
| Google Fonts (in emails) | email typeface | IP address when an email is opened | US | none; replace with a system font stack (L-18) |
Switched off
These are built into the software but switched off. They receive nothing until we switch them on and update this page.
| Company | What for | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Typesafe AI (api.typesafe.ai) | finance smart search | the typed command with player codes, never names (task 195) | US | to confirm (zero-retention DPA needed) |
| OpenRouter (with a Gemini second opinion) | finance smart search fallback | the same codes-only payload | US | to confirm (zero-retention DPA needed) |
| Modal | match video processing (GPU) | match video of both teams' players | US | none (personal workspace adriansaab2) |
| Cloudflare R2 | match video originals and outputs | match video | to confirm | to confirm |
| Vision storage site (OpenAI-hosted site) | private match-recording storage endpoint | match video | US | none; hard-disabled in production until EU storage with a DPA (vision-storage-gate.ts) |
| Browser speech recognition (e.g. Google, Apple) | speaking a finance command | the staff member's voice | the browser maker's servers | none |
| Off-host deletion-ledger copy (destination not chosen) | re-erase deleted players after a backup restore | ids and dates only, never names | to decide (Adrian) | to decide |
| Sentry (error tracking, EU ingest; not installed) | server error reports | scrubbed error events: no emails, names, bodies, tokens or user block | EU (ingest.de.sentry.io) | to confirm |
| Uptime monitor (not chosen; e.g. Healthchecks.io EU) | cron job heartbeats | counts only | to decide | to decide |
Changes
We tell clubs at least 30 days before adding or replacing a company on this list, so a club can object. Questions: support@veyian.com.