Template: have counsel review before launch.
Subprocessors
Last updated October 22, 2026
TeeMarshal, Inc. uses the providers below to run the service. Each one processes data only to deliver its part of the service and is bound by a contract with data protection terms. None of them may sell course data or use it for their own marketing.
Current subprocessors
| Provider | What it does for us | Data it handles | Processing location |
|---|---|---|---|
| Supabase | Primary database, staff authentication, realtime updates for the tee sheet, and file storage (logos, import files, exports). | All course data: golfer records, bookings, payment metadata, messages, call logs, staff accounts, audit log. | United States |
| Vercel | Hosting for the admin app, booking sites, marketing site, and API. Custom booking domains and TLS certificates. | Data in transit for every request, IP addresses, request logs. | United States (global edge network) |
| Stripe | Card payments for golfers on each course's connected account, in-person card readers, and TeeMarshal subscription billing. | Golfer name, email, card details (collected directly by Stripe), payment amounts. Course business and bank details for payouts. | United States |
| Twilio | Text messages, phone numbers, carrier registration (10DLC), and voice calls with speech-to-text and text-to-speech for the phone agent. | Golfer mobile numbers, text message content, call audio and transcripts, optional call recordings. Course business details for registration. | United States |
| Resend | Transactional and broadcast email delivery, and delivery event tracking. | Golfer and staff email addresses, names, email content, delivery, open, and click events. | United States |
| Anthropic | AI model for the phone agent, marketing message drafts, and written monthly reports. Not permitted to train on this data. | Call transcripts with caller name and phone number, booking details needed to answer, course policies, aggregate course statistics. No card data. | United States |
| Inngest | Background job scheduling: reminders, slot generation, imports, exports, campaign sends. | Job payloads containing record identifiers and limited booking and contact details. | United States |
| Fly.io | Hosting for the real-time voice service that connects phone calls to the phone agent. | Call transcripts and booking details in transit during a call. Not stored there. | United States |
| Sentry | Error and performance monitoring. | Error reports with course identifiers, request metadata, IP addresses. Configured to exclude card data and message bodies. | United States |
| Better Stack | Uptime monitoring, status page, application logs, and on-call alerting. | Structured application logs with request and record identifiers, IP addresses. | United States and European Union |
| Upstash | Rate limiting and short-lived call state for phone agent failover. | IP addresses and phone numbers used as rate limit keys, in-progress call state. Short retention. | United States |
| Open-Meteo | Hourly weather forecasts for each course location. | Course latitude and longitude only. No personal information. | European Union |
| Sign in with Google for staff. When a course enables them: Google Analytics events from its booking site and Reserve with Google availability feeds and bookings. | Staff name and email for sign-in. If enabled by the course: booking analytics events, tee time availability and prices, and details of bookings made through Google. | United States |
Processing locations describe where each provider is expected to process our data and should be confirmed against each provider's current terms before launch.
Services a course chooses to connect
Some integrations are turned on by the course rather than by us, such as the Meta pixel, Google Ads conversion tracking, marketplace distribution feeds, Golf Genius links, and anything connected through the public API or webhooks. Those providers act for the course under the course's own agreement with them, and are not our subprocessors.
Changes to this list
We update this page at least 30 days before a new subprocessor starts processing course data, and notify account owners by email. If you have a reasonable data protection objection, see section 6 of the data processing addendum.
Contact
Questions about our providers: privacy@teemarshal.com.