In force
Sub-processors
The service providers that may access personal data while we run Workout OS and Workout Studio. This list is part of the Data Processing Agreement; we notify customers at least 30 days before it changes.
- Version
- 2026-11-03
- Effective date
- (new customers)
(existing customers) - Published
- Provider
- Laten Lukken Yazılım Sanayi Ticaret Ltd. Şti.
- Contact
- support@workoutos.app
This version applies to customers who sign up from 3 November 2026 as soon as they sign up. For customers who accepted the earlier version 2026-10-29, it takes effect on 3 December 2026; until then the previous version applies to them. You can request the text of the previous version at support@workoutos.app.
Contents
1Current list
| Provider | Purpose | Data processed | Data location | Transfer safeguard |
|---|---|---|---|---|
| Railway Corporation | Cloud hosting: application servers, PostgreSQL database and backups | All Customer Data and account data | EU: Netherlands (Amsterdam, EU West region) | Railway DPA and EU Standard Contractual Clauses (company in the US); KVKK standard contract |
| Resend (Plus Five Five, Inc.) | Transactional e-mail: verification, password reset, notification and reminder e-mails | Recipient e-mail address and name, message content, delivery status | EU: Ireland | Resend DPA and EU Standard Contractual Clauses (company in the US); KVKK standard contract |
| Sentry (Functional Software, Inc.) | Error tracking | Technical details at the time of an error. User, IP, cookies and request bodies are not sent; e-mails, phone numbers and ID numbers are masked. | EU: Germany | Sentry DPA and EU Standard Contractual Clauses (company in the US); KVKK standard contract |
| Hostinger International Ltd. | Hosting of the marketing websites, the early access list, the business mailbox (support correspondence) | Website server logs, early access entries, e-mails sent to us | EU: Germany (Frankfurt) | Hostinger data processing terms (EU company); KVKK standard contract |
| Polar Software, Inc.; Stripe as its payment processor | Subscription billing. Polar is merchant of record: it issues the invoice and calculates and remits tax. | Billing details, country, tax ID, payment transactions. Card data is processed only by Polar and Stripe. | US | Polar is an independent controller for payment data; Polar DPA and EU Standard Contractual Clauses; KVKK standard contract |
| Meta Platforms Ireland Ltd. (WhatsApp Business Cloud API) | WhatsApp reminders and messages in Workout Studio, only if the business connects its own WhatsApp Business number | Recipient phone number and name, message content | EU and US | Meta's WhatsApp Business terms and data processing terms, EU Standard Contractual Clauses |
| Expo (650 Industries, Inc.); Apple and Google push services | Push notifications to the member and client app (starts when the app is released) | Device push token, notification text | US | Expo DPA and EU Standard Contractual Clauses; KVKK standard contract |
A payment-provider account that a business connects to collect its own member and client payments (optional online payment add-on) is the business's own provider; the contract is between the business and that provider. Laten Lukken only passes data through those connections on the business's instructions.
2Notice of changes
We notify business owners by e-mail and in-panel notice, and update this page, at least 30 days before adding or replacing a sub-processor. Your right to object during that period is set out in the Data Processing Agreement.
If you would like to receive change notices without being a business owner, write to support@workoutos.app and we will add you to the notification list.