RightsHub Sub-processors
Last updated: 3 October 2026
RightsHub engages the third parties below to process customer personal data in providing the platform. Each is bound by a written contract with data protection obligations no less protective than those in our Data Processing Agreement, and RightsHub remains fully liable for their performance.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, deployment and edge delivery | All data in transit; request and access logs | USA |
| Supabase | Database, authentication, file storage and transactional email (sign-in links) | All platform data at rest; user account and authentication data | EU (Frankfurt / Ireland) |
| Anthropic PBC | AI API for contract parsing and rights extraction, drafting report copy, and answering questions authorised users ask about their own account (Ask) | Contract text submitted for extraction, which may contain names, job titles and signatures; the partner, rights, delivery and fixture data a report or an answer needs, and the question asked | USA |
| Sentry (Functional Software, Inc.) | Application error monitoring and diagnostics | Error reports, which may include user identifiers and request context | USA |
| Upstash, Inc. | Rate limiting and abuse protection | Short-lived request counters keyed to a user or IP identifier | EU |
| Meta Platforms, Inc. | Social content retrieval, where the Club connects its own Meta account | Access tokens for the connected account; publicly available post content | USA |
Not sub-processors
RightsHub retrieves sports fixture and result data from TheSportsDB. No customer personal data is sent to that service, so it is a data source rather than a sub-processor.
Changes to this list
We notify customers at least 14 days before adding or replacing a sub-processor, giving them the opportunity to object on reasonable data protection grounds. To be notified of changes, or to raise an objection, contact support@rightshub.io.