Sub-processor List
The companies that process personal information for us.
- Version 1.0
- Effective October 29, 2026
- For: Community owners, and anyone who wants to know
In short
- These companies process personal information for TeamALA under data processing agreements. We give community owners 14 days' notice of any change, and a chance to object (Community Agreement, Annex A, A4).
Sub-processors
Vercel Inc.
- Purpose
- hosting, edge network, server functions, request logs.
- Data
- IP address, browser type, page requested, and all data in transit.
- Location
- Dublin (functions); global edge; USA.
- Transfer safeguard
- EU-U.S. Data Privacy Framework / Standard Contractual Clauses.
Supabase Inc.
- Purpose
- platform database.
- Data
- all stored platform data.
- Location
- Ireland (AWS eu-west-1).
- Transfer safeguard
- Standard Contractual Clauses (for support access from outside the EU).
Upstash Inc.
- Purpose
- sessions, short links, rate limits, caches.
- Data
- session data, encrypted Discord tokens, short links, IP addresses used as rate-limit keys.
- Location
- Ireland (AWS eu-west-1).
- Transfer safeguard
- Standard Contractual Clauses.
Cloudflare Inc.
- Purpose
- DNS; the status page (a Worker and Workers KV).
- Data
- IP addresses in transit; uptime history (no personal information).
- Location
- global edge.
- Transfer safeguard
- EU-U.S. Data Privacy Framework / Standard Contractual Clauses.
GitHub Inc.
- Purpose
- encrypted daily database backups, kept 30 days.
- Data
- encrypted copies of the database.
- Location
- USA.
- Transfer safeguard
- EU-U.S. Data Privacy Framework / Standard Contractual Clauses.
Railway Corp.
- Purpose
- the Nora Legacy database, until it is retired.
- Data
- Nora Legacy server settings, moderation records, points and events, tickets and feedback, Roblox links, and optional time zones and birthdays.
- Location
- the Netherlands (Amsterdam, EU West).
- Transfer safeguard
- Standard Contractual Clauses.
Independent controllers (not sub-processors)
These are responsible for their own information:
- (a) Roblox Corporation;
- (b) Discord Inc.;
- (c) Okappiki (okappiki.com, safety-data partner); and
- (d) RoVer and Bloxlink.