Sub-processors
The providers that process personal data on our behalf, what they do, where, and how international transfers are protected.
This text has not been reviewed by a professional yet
Draft written by the team. The owner of the service is not incorporated yet, so its identity details are marked as pending, and the document is waiting for the review of a legal adviser before it has contractual value.
1. Current list
Valve is listed for transparency: it acts as an independent controller of the Steam data it returns, not as our processor. Stripe is our processor for payments and an independent controller for its own fraud prevention.
| Provider | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| OVH SAS (OVHcloud) | Platform servers, game servers in London and Paris, database and outgoing email | All account, server and player data | France, United Kingdom | UK adequacy decision |
| Amazon Web Services EMEA SARL | Content delivery (CloudFront), DNS (Route 53) and backup storage (S3) | IP address, requests and encrypted backups | European Union, United States | EU-US Data Privacy Framework, standard contractual clauses as fallback |
| Stripe Payments Europe Ltd. | Payments, invoices and fraud prevention | Name, email, billing address, payment method, amounts | Ireland, United States | EU-US Data Privacy Framework, standard contractual clauses as fallback |
| Google Ireland Ltd. | Sign-in with Google; Analytics and Ads measurement only with consent | Google account id and email; pseudonymous visit data | Ireland, United States | EU-US Data Privacy Framework, standard contractual clauses as fallback |
| Discord Inc. | Sign-in with Discord | Discord account id, username and email | United States | EU-US Data Privacy Framework, standard contractual clauses as fallback |
| Cloudflare, Inc. | Turnstile anti-bot check on public forms | IP address and browser signals | United States | EU-US Data Privacy Framework, standard contractual clauses as fallback |
| Valve Corporation (Steam Web API) (Independent controller) | Steam Web API lookups of player profiles | Steam ids of players | United States | Standard contractual clauses |
2. Changes
We announce a new sub-processor or a change of location at least 30 days before it starts, on this page with a new version date and by email to customers who rely on the data processing agreement, who may object within that period.