Sub-processors
Last updated 2026-07-21
The providers that process personal data on our behalf. This page is referenced by both the Privacy Policy (Art. 13(1)(e) GDPR) and the Data Processing Agreement (Art. 28(2) GDPR), and it is the authoritative list for both.
1.Current sub-processors
| Provider | Purpose | Location | Transfer safeguard | Their DPA |
|---|---|---|---|---|
| Supabase Supabase, Inc., 970 Toa Payoh North, Singapore (US/EU operations) | Database, authentication and file storage for account data, bot configuration and avatars. | TODO: the region your Supabase project runs in, e.g. eu-central-1 (Frankfurt) | EU Standard Contractual Clauses where data is processed outside the EEA. | View |
| Railway Railway Corp., 2261 Market Street, San Francisco, CA 94114, USA | Application hosting for the dashboard, API and bot workers, including the job queue. | TODO: the region your Railway services run in | EU Standard Contractual Clauses. | View |
| TODO: your email provider TODO: legal entity and address, e.g. Resend, Inc., … | Delivery of service and, where consented, product emails. | TODO: processing region | TODO: SCCs / EU-U.S. Data Privacy Framework / EU only | TODO: link to their DPA |
Each is bound by a data processing agreement under Art. 28 GDPR and may act only on our instructions.
2.Independent controllers
These services are not sub-processors. They determine the purposes and means of their own processing, so your relationship with them is governed by their own terms and policies rather than ours.
| Service | Why it is involved | Their policy |
|---|---|---|
| Discord Discord Netherlands B.V. (EEA users) / Discord, Inc., 444 De Haro Street, San Francisco, CA 94107, USA | Sign-in via Discord OAuth, and every action your bots perform on Discord. Discord decides how it processes data on its own platform. | Privacy policy |
| Twitch Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA | Live-stream alerts, where a user configures them. Only public channel data is retrieved. | Privacy policy |
| YouTube / Google Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Video upload alerts, where a user configures them. Only public channel data is retrieved. | Privacy policy |
3.Notice of changes
We give account holders at least 30 days' notice by email before adding or replacing a sub-processor. Within that period you may object on reasonable data protection grounds; if the objection cannot be resolved you may terminate without notice and without cost.
To receive those notices, keep the email address on your account current. Questions about anything on this page go to TODO: privacy@yourdomain.tld.