Sub-processors
The suppliers we use that may process club and member information when we run a hub for a club.
The Studio Hub Systems (Pty) Ltd runs the Dojo Hub, PT Hub and other Studio Hub products for clubs. Each club is in charge of its members' information. We store and process it for the club, under our Data Processing Agreement (version 2026-11-04, v1.0).
We tell clubs by email at least 30 days before we add or replace a sub-processor, and update this page. A club may object under the Data Processing Agreement.
Cross-border transfers are governed by Data Processing Agreements with our US sub-processors that give an adequate level of data protection under section 72 of POPIA.
Suppliers we use for every club
| Supplier | What we use it for | Personal information | Where | Their terms |
|---|---|---|---|---|
| Supabase Inc. (on Amazon Web Services) | Database, file storage, sign in, server functions, and its own 7 days of backups | All hub information | EU: Paris, France (AWS eu-west-3). Supabase is a US company. | Data processing addendum |
| Cloudflare Inc. | Hosting hub pages and club websites, DNS, content delivery, bot check (Turnstile), email routing | IP addresses, page requests, form traffic passing through | Global network | Customer DPA |
| Twilio Inc. (including WhatsApp Business through Meta) | WhatsApp messages to members, on the club's own Twilio account | Names, phone numbers, message text | US and global. WhatsApp messages also pass through Meta. The club's WhatsApp Business sender is under its own agreement with Meta. | Data protection addendum |
| Resend Inc. | Sign in codes and club emails | Email addresses, names, message text | US | DPA |
| Anthropic PBC | AI office assistant ("Ask Dojo") and AI help during club setup | Staff questions and the club information needed to answer them. Usage is capped. Health notes are never sent. Anthropic does not train its models on this data under its commercial terms. | US | Data processing addendum |
| GitHub Inc. (Microsoft) | Encrypted backup copies (the newest 7) and source code | Encrypted database backups only, unreadable without our key | US | Data protection agreement |
| Apple, Google and Mozilla web push services | Push notifications to members' phones | A device id and short notification text | US | Apple, Google, Mozilla |
| Giphy (Shutterstock) | GIF search in the WhatsApp tab used by club staff, only when GIFs are switched on | The search words typed only. The search goes through our server, so no member information and no member's IP address reaches Giphy. The preview pictures load from Giphy in the staff member's browser, so Giphy sees that staff member's IP address. A chosen GIF is copied to our own storage before it is sent. | US | Privacy policy |
Our own backups
| Where | What | Kept |
|---|---|---|
| Our own computer in South Africa (not a supplier) | A daily database backup. The backup files are encrypted (AES-256). | 30 days |
| GitHub, US (above) | Copies of the newest 7 daily backups, in a private repository, unreadable without our key | Newest 7 |
| Supabase, EU (above) | Supabase's own backups | 7 days |
Services a club connects with its own account
These run only when a club connects its own account. The club has its own agreement with the provider.
| Supplier | What it is used for | Personal information | Where | Their terms |
|---|---|---|---|---|
| Netcash (Pty) Ltd | Debit orders in South Africa, on the club's own Netcash account | Name and bank details go straight to Netcash. The hub keeps the last 4 digits only. | South Africa | Privacy policy |
| Yoco, Ozow, Paystack, PayFast | Card, instant EFT and online payments in South Africa | Name, email, amount, reference. Card details are typed on the provider's page and never stored by the hub. | South Africa | Provider's own terms |
| Stripe, PayPal | International card and online payments | Name, email, amount, reference | Provider's country | Provider's own terms |
| 9Pay | Online payments in Vietnam (coming soon) | Name, email, amount, reference | Vietnam | Provider's own terms |
| Zoho Corporation (Zoho Mail) | Only when a club connects its own Zoho mailbox to the hub inbox | Emails in that mailbox | Per the club's Zoho account | Club's own Zoho terms |
| Meta Platforms | Only on club websites where the club adds the Meta pixel. The hub's default for every law is "ask first": the pixel waits until the visitor says yes. | Page views and device information | US and Ireland | Club's own Meta terms |
Each supplier uses its own sub-processors, listed on its website.
Questions
Email [email protected], or phone or WhatsApp 082 226 0215 (+27 82 226 0215). Information Officer: Brett Clarke. The Studio Hub Systems (Pty) Ltd, 120 Edison Crescent, Hennopspark, Centurion, 0172, South Africa.