Data Processing Agreement (DPA)

As of: September 2026

Document in preparation

This Data Processing Agreement under Art. 28 GDPR is currently being prepared by our legal counsel. The document will be published here once it has been finalised.

In the meantime, the DPA is available on request. Please contact us via the contact form.

1. Purpose of this agreement

This Data Processing Agreement (DPA) governs under Art. 28 GDPR the rights and obligations between My Pilates Flows (data processor) and registered teachers and studios (controllers) when processing personal data in connection with use of the platform.

2. Next steps

The full DPA document will be published after legal review. For urgent enquiries please contact us via the contact form.

Annex: sub-processors

We use the following sub-processors to provide the platform. They are the same providers described in section 4 of the privacy policy. The contracting entity and transfer safeguard stated for each are taken from the published data processing agreements of the providers.

SupabaseSupabase Pte. Ltd
Service
Database, authentication and file storage
Seat
Singapore
Where data is processed
eu-central-1 (Frankfurt) only; no replication outside the EU
Third-country transfer safeguard
EU Commission Standard Contractual Clauses (Decision 2021/914), agreed in the Supabase data processing agreement
VercelVercel Inc.
Service
Hosting, server-side processing, content delivery, and cookieless audience and performance measurement
Seat
USA
Where data is processed
Server-side processing and scheduled jobs in fra1 (Frankfurt) only. The routing layer and access logs run at the edge location closest to the request – outside the EU for requests from outside the EU
Third-country transfer safeguard
EU Commission Standard Contractual Clauses (Decision 2021/914), agreed in the Vercel data processing agreement
AnthropicAnthropic Ireland, Limited
Service
AI-assisted plan generation. Sent: structured class parameters, library exercise text and the names of exercises you created yourself. Never sent: names, email addresses, personal cues, notes, class titles and descriptions you wrote, or feedback comments
Seat
Seat not stated in the Anthropic terms; counterparty for customers in the European Economic Area, parent company Anthropic, PBC (USA)
Where data is processed
Place of processing not stated in the Anthropic terms; we treat the processing as a transfer to the USA (section 5 of the privacy policy)
Third-country transfer safeguard
EU Commission Standard Contractual Clauses (Decision 2021/914), agreed in the Anthropic data processing agreement
UpstashUpstash, Inc.
Service
Rate limiting to protect against abusive use
Seat
USA (Delaware)
Where data is processed
eu-central-1 (Frankfurt) only; no replication outside the EU
Third-country transfer safeguard
EU Commission Standard Contractual Clauses (Decision 2021/914), agreed in the Upstash data processing agreement
ResendPlus Five Five, Inc.
Service
Delivery of transactional email
Seat
USA
Where data is processed
Dispatched from eu-west-1 (Ireland). Message content, delivery logs and account records are stored in the USA; Resend offers no data residency in the EU
Third-country transfer safeguard
EU Commission Standard Contractual Clauses (Decision 2021/914), agreed in the Resend data processing agreement
StripeStripe Payments Europe, Limited
Service
Payment processing for paid tiers via the Checkout page hosted by Stripe
Seat
Counterparty for providers established in Germany; the Stripe data processing agreement does not state its seat
Where data is processed
Place of processing not stated in the Stripe data processing agreement; onward transfer to Stripe, LLC (USA) and other group companies
Third-country transfer safeguard
EU Commission Standard Contractual Clauses (Decision 2021/914), agreed in the Stripe data processing agreement
IONOSIONOS SE
Service
Operates the mailbox for the product addresses, including an email archive with a configured retention period of eleven years
Seat
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany
Where data is processed
According to IONOS's product information, data centres in Germany; we hold no contractual assurance
Third-country transfer safeguard
On that information, no third-country transfer; the data processing agreement has been part of the IONOS contractual terms since 19 July 2022
SentryFunctional Software, Inc.
Service
Error and performance monitoring of the application. Technical error data is transmitted; IP addresses, cookies, request bodies and query parameters are not, and of the HTTP headers only the browser identification
Seat
USA (San Francisco, California)
Where data is processed
EU region: error events, traces and source map files exclusively in Frankfurt. The administrative data of our access (account, organisation, project, access tokens) remains in the USA
Third-country transfer safeguard
Primarily the EU-U.S. Data Privacy Framework; failing that, the EU Commission Standard Contractual Clauses (Decision 2021/914, Module 2), agreed in the Sentry data processing agreement