Sub-processors
Version 2 · In force from 27 October 2026
These are every third-party service that touches personal data held in RepDesk. Each one processes it on our instructions, under contract, and for no purpose of its own. We keep this page current; it is the list our Data Processing Addendum refers to.
1. The list
| Who | What they do | What they receive | Where |
|---|---|---|---|
| Clerk | Sign-in and identity, for the gym app and the partner portal | Name, email address, mobile number, profile picture | Outside India |
| Supabase | The database that holds everything your gym records | All workspace data, including member records | Mumbai, India |
| Resend | Sending service email — receipts, notices, account messages | Recipient email address and the message itself | Outside India |
| Meta (WhatsApp Cloud API) | Delivering the WhatsApp messages a gym sends its members | Member name, mobile number, message content, delivery status | Outside India |
| Mixpanel | Product analytics — only after you accept analytics cookies | An opaque identifier, page and event names, counts. No names, numbers or amounts. Your IP address when sent from the browser. | European Union |
| Vercel | Hosting the website and the app front-ends | IP address and request metadata | Globally distributed |
| Vercel Analytics | Counting visits to the marketing site only. Not used in the app. | Aggregate page view data | Globally distributed |
| Cloudflare | TLS, DNS, protection against attacks, and the tunnel carrying API traffic | IP address and request metadata for every request | Globally distributed |
2. What we deliberately do not use
A shorter list is a safer list. The following categories of service appear in most software of this kind and are entirely absent from RepDesk:
- No payment gateway. RepDesk never processes money. A member pays the gym in the real world and RepDesk records that it happened.
- No SMS provider. Messaging is WhatsApp only.
- No third-party error tracking or monitoring service. Our logs stay on our own infrastructure.
- No file or object storage provider. RepDesk accepts no uploads. Exports are generated in your browser and never leave it unless you send them.
- No push notification service.
- No AI or large language model API. No data held in RepDesk is sent to any such service.
- No advertising network, no data broker, no analytics beyond the one above.
Our cache runs as a container on the same hardware as our API server, operated by us. It is not a managed cloud service, so there is no third party to name — the server itself sits in Lucknow, Uttar Pradesh, India.
3. When this list changes
If we add a sub-processor that will handle personal data, or replace one, we update this page and give notice to gyms with an active workspace before the change takes effect, by email to the address on the account.
A gym that objects to a new sub-processor on reasonable data protection grounds may tell us within fourteen days of that notice. We will try to resolve it; if we cannot, the gym may stop using RepDesk and we will delete its data in accordance with the Privacy Policy.
Every sub-processor is bound by written terms no less protective than those in our Data Processing Addendum, and we remain responsible to you for what they do.
Questions about anyone on this list: privacy@repdesk.co.in.