← Back to hawthornhq.com

Legal

Sub-processors

Last updated 14 October 2026

HawthornHQ uses other providers to deliver the service. They fall into two groups: the platform services we engage to run HawthornHQ itself, and the integrations your club chooses to connect. This page names both, and says what each one processes. When the list changes, we update this page — the date above is the date of the last change.

Platform sub-processors

We engage these providers to run HawthornHQ. We choose them, they process data on our instructions, and they are engaged for every club on the platform whether or not you connect any integration.

Provider	Purpose	Data they process
Supabase	Database, sign-in and file storage — the platform's own infrastructure.	The records HawthornHQ runs on: member and staff names and contact details, bookings, financial records, uploaded images and signed agreement PDFs.
DigitalOcean	Application hosting and scheduled jobs (Toronto region).	The computing that serves the app; request logs, which include IP addresses.
Stripe	Payment processing — online payments, saved cards and terminal payments at the desk.	Card details are entered on Stripe's own payment pages and card readers and never reach HawthornHQ's servers. Stripe receives the payer's name and email and the payment amounts and dates.
Amazon Web Services (Amazon SES)	Transactional email for the platform's own notices, such as sign-up invitations and account notifications.	Recipient names and email addresses, and the content of those messages.
Sentry	Error monitoring — knowing when something breaks, and what broke.	Error reports: stack traces, page URLs, error messages and company identifiers. When an error occurs in a browser, a recording of that page with input values masked. No member records are sent.

Operator-directed integrations

These providers process your club's data only if you connect them, and the data flows at your direction: you choose the provider, you configure it, and you can disconnect it at any time. What each integration does is described on the capabilities page.

Provider	Purpose	Data they process
Twilio	SMS reminders for bookings and coaching sessions.	Member mobile numbers and the content of the reminders sent.
GHIN (USGA)	Official handicap syncing.	Member names, GHIN numbers and handicap data.
UniFi Access (Ubiquiti)	Door access control — doors that open for a booking and close after it.	Member identity details used to issue door credentials, access schedules, and door entry logs.
Kisi	Door access control — doors that open for a booking and close after it.	Member identity details used to issue door credentials, access schedules, and door entry logs.
QuickBooks Online (Intuit)	Accounting journal sync, to your club's own QuickBooks books.	Financial journal entries: amounts, account names and member references.
Xero	Accounting journal sync, to your club's own Xero organisation.	Financial journal entries: amounts, account names and member references.
FrontAccounting	Accounting journal sync, to your club's own FrontAccounting instance.	Financial journal entries: amounts, account names and member references.
Resend	Transactional email for your club's own notices — confirmations, statements, reminders — if you choose Resend as the sender.	Recipient names and email addresses, and the content of the messages sent.
Amazon SES	Transactional email for your club's own notices — confirmations, statements, reminders — if you choose Amazon SES as the sender. (SES also sends the platform's own notices — see the platform table above.)	Recipient names and email addresses, and the content of the messages sent.
Your own SMTP server	Transactional email for your club's own notices, delivered through the mail server you designate. You choose the provider; HawthornHQ sends it your credentials and the messages.	Recipient names and email addresses, and the content of the messages sent, delivered via your server.