Sub-processors
Last updated 2026-10-07The providers that process personal data on our behalf. This page is referenced by both the Privacy Policy (Art. 13(1)(e) GDPR) and the Data Processing Agreement (Art. 28(2) GDPR), and it is the authoritative list for both.
1. Current sub-processors
| Provider | Purpose | Location | Transfer safeguard | Their DPA |
|---|---|---|---|---|
| Supabase Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 | Database, authentication and file storage for account data, bot configuration and avatars; the spam-protection counters of the contact and launch-notice forms (a keyed hash of the network address, deleted after at most 24 hours). | eu-north-1 (Stockholm, Sweden) - inside the EU/EEA | EU Standard Contractual Clauses where data is processed outside the EEA. | View |
| manitu manitu GmbH, Welvertstraße 2, 66606 St. Wendel, Germany (AG Saarbrücken HRB 19076) | Server hosting (virtual server) for the website, dashboard, API and bot workers, including the in-memory job queue and the server logs, and storage of the nightly backups of the database and of stored files. The backups are encrypted with a key that is not on the server and are kept for less than 30 days. | St. Wendel, Germany, in its own data centre - inside the EU/EEA | None. The data processing agreement restricts processing to Germany and the EU/EEA. | View |
| Cloudflare Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (German subsidiary: Cloudflare Germany GmbH, Rosenheimer Str. 143C, 81671 München, AG München HRB 242623) | Content delivery, TLS termination, DDoS protection and bot filtering in front of the website, the dashboard and the API. Sees the IP address, the request metadata and the user agent of every request, including on these public pages. | Global anycast network - requests are normally served from the nearest edge location, which for European visitors is inside the EU/EEA, but EU-only processing is not contractually guaranteed on this plan | EU Standard Contractual Clauses, the UK International Data Transfer Addendum (B1.0) and SCCs adapted for the Swiss FADP; Cloudflare, Inc. additionally relies on the EU-U.S. Data Privacy Framework. | View |
| Brevo Brevo, a trading name of SENDINBLUE SAS, 9-17 rue Salneuve, 75017 Paris, France (RCS Paris 498 019 298) | Delivery of every email this platform sends: the account welcome message, contact form enquiries, moderator invitations, bot alerts, the weekly recaps, and the launch notification list. Receives the recipient address and the message. | Data centres in France - inside the EU/EEA. The provider states, however, that data may also reach countries without an adequacy decision, in particular the United States and India, through its own sub-processors. | Sent from France. Onward transfers to the provider's affiliates and sub-processors in India are covered by EU Standard Contractual Clauses with supplementary measures, and those to the United States by the EU-U.S. Data Privacy Framework together with Standard Contractual Clauses, as set out in the provider's Data Processing Agreement. | View |
| Zoho Mail Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands | Receiving and storing email sent to our addresses (support@, privacy@ and the other addresses at our domain), including contact form enquiries and data subject requests, and the replies we send from that mailbox. | Zoho's EU data centres (Amsterdam, Netherlands, and Dublin, Ireland) - inside the EU/EEA. Zoho group companies outside the EEA, in particular in India and the United States, may access data for support and operations. | Onward access by Zoho group companies outside the EEA is covered by intra-group agreements based on the EU Standard Contractual Clauses, as set out in Zoho's Privacy Policy and Data Processing Addendum. | View |
Each is bound by a data processing agreement under Art. 28 GDPR and may act only on our instructions.
2. Independent controllers
These services are not sub-processors. They determine the purposes and means of their own processing, so your relationship with them is governed by their own terms and policies rather than ours.
| Service | Why it is involved | Their policy |
|---|---|---|
| Polar Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901, USA (principal place of business: 548 Market Street PMB 61301, San Francisco, CA 94104-5401, USA) | Payment processing, checkout, invoicing and VAT. Polar is the Merchant of Record: it sells to you in its own name, determines your location for tax, charges and remits the VAT under its own registration, and issues your invoice. You enter your payment details and billing country directly at Polar's checkout. From us, before the checkout opens, Polar receives your account's email address (to find or create you as a customer) and your account ID; in the checkout also the plan, the period, the bot where there is one and the reference of your request to start straight away; and, when you delete your account, the instruction to cancel your subscription and anonymise the customer record. Transfer to the United States under the EU Standard Contractual Clauses. Polar decides how it processes this data. | Privacy policy |
| Discord Discord Netherlands B.V. (EEA users) / Discord, Inc., 444 De Haro Street, San Francisco, CA 94107, USA | Sign-in via Discord OAuth, and every action your bots perform on Discord. Discord decides how it processes data on its own platform. | Privacy policy |
| Twitch Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA | Live-stream alerts, where a user configures them. Only public channel data is retrieved. | Privacy policy |
| YouTube / Google Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Video upload alerts, where a user configures them. Only public channel data is retrieved. | Privacy policy |
| Steam / Valve Valve Corporation, P.O. Box 1688, Bellevue, WA 98009, USA. EU representative: RIVACY GmbH, Mexikoring 33, 22297 Hamburg, Germany. | Game update alerts, where a user configures them. Only the public store listing and public announcements for a chosen game are retrieved. | Privacy policy |
| Cfx.re / FiveM Rockstar Games, Inc., 622 Broadway, New York, NY 10012, USA, a Take-Two Interactive Software, Inc. company, which has operated Cfx.re since 2023. | FiveM player counts, where a user configures them. A server join code is sent and only the public server listing is retrieved. | Privacy policy |
3. Notice of changes
We give account holders at least 30 days' notice by email before adding or replacing a sub-processor. Within that period you may object, giving a data protection reason; if the objection cannot be resolved you may terminate the contract for the Service without notice and at no cost, as set out in the Data Processing Agreement.
To receive those notices, keep the email address on your account current. Questions about anything on this page go to privacy@ruination-bots.com.