Sub-Processors
1. What's a sub-processor?
Sub-processors are companies we contract with to provide infrastructure or services we don't build ourselves. All sub-processors below are bound by data-processing agreements (DPAs) and may only use your data for the purposes we specify.
2. Complete sub-processor list
| Vendor | Service | Categories of data | Region(s) |
|---|---|---|---|
| Auth0 (Okta, Inc.) | Identity, authentication, session management | Email, password hash, login events, IP, device | US |
| Microsoft Azure | Hosting, Azure SQL Database, Azure Blob Storage (falkenstorprod), Azure CDN | All platform data at rest and in transit | US (East / Central) |
| Microsoft Azure AI / Cognitive Services | Text analytics, image analysis (text and image inputs) | Text inputs, image inputs | US |
| Microsoft Azure Communication Services ("Falken Dispatch") | Transactional and marketing email delivery | Email address, name, message content | US |
| Stripe, Inc. + Stripe Connect | Payment processing, subscription billing, organization payouts | Tokenized card info, billing address, name, transaction history | US |
| Anthropic, PBC | AI inference for match recaps and coaching insights (default) | Performance text data; no training on inputs per Anthropic API terms | US |
| OpenAI, L.L.C. | AI inference fallback | Same as Anthropic; no training on inputs per OpenAI API terms | US |
| Google LLC (Analytics 4) | Aggregate web traffic measurement on this website (measurement ID G-EJZ8W0D71B) and on the admin dashboard at https://falken.nexus (measurement ID G-XWXN0FV4CG) | Page views, sessions, traffic source, device category, approximate geography, and the Google Analytics cookies (_ga, _ga_*) set in your browser | US |
| Google LLC (Maps Platform — Geocoding) | Address-to-coordinates lookup | Addresses (camp, event, range, optionally org HQ) | US |
| Google LLC (reCAPTCHA) | Bot protection on contact form | IP, browser metadata, form-interaction signals | US |
| Google LLC (Firebase Cloud Messaging) | Android push notifications | Device push tokens, notification payloads | US |
| Apple Inc. (APNs) | iOS push notifications | Device push tokens, notification payloads | US |
| MaxMind, Inc. (GeoLite2) | IP geolocation lookup (offline database — your IP is not sent to MaxMind) | IP at lookup time (resolved locally) | Local |
| Meta Platforms, Inc. (Facebook Graph API) | Authorized posting to an organization's Facebook page | Content the organization chooses to post | US |
| X Corp. (Twitter API) | Authorized posting to an organization's X account | Content the organization chooses to post | US |
| LinkedIn Corporation | Authorized posting to an organization's LinkedIn page | Content the organization chooses to post | US |
3. International data transfers
All sub-processors above are US-based or US-headquartered with US regions in use. For UK and EEA users, data is transferred to the United States under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs).
Where sub-processors are EU-US Data Privacy Framework (DPF) certified — Auth0, Microsoft, AWS, Google, Stripe — we additionally rely on DPF. You can verify any vendor's DPF status at dataprivacyframework.gov.
4. Vendors we do not use today
For transparency:
- No error or crash monitoring SaaS (no Sentry, no Datadog, no Rollbar, etc.).
- No advertising networks.
- No data brokers.
- No analytics other than Google Analytics 4 listed above (no Plausible, no Mixpanel, no Amplitude, no Segment, no Heap, no PostHog, etc.).
If we ever add any of the above, we update this page first.
5. How we update this page
- New sub-processor added: a row appears here, the version bumps, and the "Last Updated" date changes.
- Sub-processor removed: the row stays for 90 days with strikethrough and a removal date, then is removed.
- New vendor handling payment or children's data: we email all registered users at least 30 days before the new sub-processor begins processing, giving you time to object or close your account.
6. Vendors not listed here, and why
- Hover (Tucows) — our domain registrar. Domain registrars are not sub-processors; Hover sees only authoritative DNS queries, not your personal data.
- Apple App Store / Google Play Store — we do not use Apple In-App Purchases or Google Play Billing. Our mobile apps redirect payment flows to web checkout via Stripe.
- Internal libraries (Syncfusion, AutoMapper, etc.) — software libraries that run in our own infrastructure; no user data flows to a third party at runtime.
Get Early Access to Falken
Sign up to be notified when our alpha launches. Be among the first to experience the platform.
No spam. Unsubscribe anytime. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.