CatalysFit

Subprocessor List

Last updated: June 2026

CatalysAI uses the following sub-processors to process personal data on behalf of our clients (Personal Trainers). This list is kept up to date as required by Article 28 of the GDPR and the LGPD.

Vendor	Purpose	Data Processed	Location	DPA
Supabase (AWS)	Database & Authentication	All personal data	US East (São Paulo for BR data)	DPA
OpenRouter / MiniMax	AI workout generation	Anonymized training parameters (no PII sent)	US	Terms
Stripe	Payment processing	Name, email, payment card	US / EU	DPA
Resend	Transactional emails	Name, email	US	DPA
Vercel	Hosting & CDN	IP address, request logs	US / EU	DPA

Supabase (AWS)

Database & Authentication

Data Processed: All personal data

Location: US East (São Paulo for BR data)

OpenRouter / MiniMax

AI workout generation

Data Processed: Anonymized training parameters (no PII sent)

Location: US

Stripe

Payment processing

Data Processed: Name, email, payment card

Location: US / EU

Resend

Transactional emails

Data Processed: Name, email

Location: US

Vercel

Hosting & CDN

Data Processed: IP address, request logs

Location: US / EU

Important Notes

•CatalysAI will notify trainers 30 days before adding new sub-processors.
•Trainers may object to the addition of new sub-processors within 15 days of notification.
•In case of a justified objection, CatalysAI will work with the trainer to find an alternative solution or allow contract termination without penalty.