Service Providers & Sub-Processors
Last updated: July 7, 2026
Advantage Flag Football League uses the following service providers to operate our website and registration platform (the "Service," as defined in our Privacy Policy). We limit each provider to the data it needs to do its job for us. Except as noted below for Google Maps Platform and Sign in with Google (which Google provides as an independent company under its own terms), Slack, and our uniform vendor (see their rows), each provider is bound by data-processing terms that prohibit use of league data for its own purposes, like advertising, marketing, or AI training. (Some providers may use limited data to keep their own networks safe and abuse-free, as their standard terms allow.) When we add or change a provider that handles personal information, we update this page - check the "last updated" date above, or email us with questions.
| Provider | Purpose | Personal data involved | Location | Data terms |
|---|---|---|---|---|
| ShirePath Solutions LLC | Platform development, hosting operations, and maintenance on the League's behalf | All Service data | United States | Services agreement + data-processing addendum with the League (to be executed before go-live) |
| Vercel Inc. | Application hosting | Data transiting the application; request logs retained ~1 day (Vercel Pro plan) | United States (primary) | Vercel DPA (applies automatically as part of our agreement) |
| Neon Inc. | PostgreSQL database hosting | Registration, player, payment, and communication records | United States | Neon DPA (applies automatically as part of our agreement); SOC 2 |
| Google LLC - Cloud (Storage + Cloud Run) | Encrypted file storage with time-limited access links; check-document rendering | Scanned check images and league documents | United States | Google Cloud Data Processing Addendum (applies automatically as part of our agreement) |
| Google LLC - Maps Platform (Geocoding) | Converting household addresses to map coordinates for team placement | Household street address only, as entered by the parent - we never attach names or account details | United States/global | Independent-company terms - Google may use request data to provide and improve its own services (Maps Controller Terms) |
| Anthropic PBC | AI-assisted check transcription; AI assistance to administrators during team formation; standardizing school and team names | Check images (payer name, bank account/routing numbers, signature, memo line); player roster details (name, grade, school, division, and related placement information such as teammate requests and sibling groupings); administrators' placement-request text, including coach names appearing on placement forms; free-text school and team-name entries from registration and coach forms | United States | Anthropic Commercial Terms - no model training on customer content; inputs/outputs deleted within 30 days (longer only where law or Anthropic's safety processes require) |
| Twilio Inc. (including SendGrid) | SMS and email delivery | Recipient name, phone/email, message content; for league announcements, open/click engagement events | United States | Twilio DPA (applies automatically as part of our agreement; covers SMS + email) |
| Slack Technologies (Salesforce) | Internal operational alerts to league/platform staff | Limited account and error details on certain alert paths | United States | Slack/Salesforce standard terms; used only for internal operational alerts to staff and excepted from the no-own-use statement above |
| Google LLC - Identity (Sign in with Google) | Optional sign-in | Google account email, name, profile photo (provided by Google to us) | United States | Google's terms; inbound identity only (kept for transparency) |
| Elite Sports Apparel USA | Printing team uniforms (order forms sent each season) | Player last name, jersey number, and uniform sizes - nothing else | United States | Confidentiality/limited-use letter to be obtained; until then, excepted from the no-own-use statement above |
| Amazon Web Services, Inc. (AWS) | Error-alert pipeline (an AWS Lambda function) that receives production error logs forwarded from our host and posts matching failures to Slack for on-call staff | Error-log content forwarded from the application - request metadata (path, status code, request ID) and any personal data incidentally present in an error message; processed in memory to post the alert and not otherwise stored. Separately, the function's own operational logs (which do not include the forwarded content) are retained by AWS for about 14 days | United States | AWS GDPR Data Processing Addendum (applies automatically as part of our agreement) |
Questions: info@ylafl.com. Read our Privacy Policy.