Sub-processors and Data Locations

Last updated: 11 November 2026

This page lists every company that receives personal data from papergames.io, what it receives, the country where it processes it and the safeguard that protects the transfer. papergames.io is operated by Poly Bytes Sàrl, Chemin de la Planche-aux-Oies 4d, CH-1000 Lausanne, Switzerland. This page completes our Privacy Policy.

A processor handles data only on our behalf and on our instructions. An independent controller decides itself how it uses the data it receives, under its own privacy policy.

1. Our own infrastructure

  • Our application and game servers, our caches and our webhook system run on a dedicated server of OVH Hosting Inc. in its Beauharnois datacentre in Quebec, Canada.
  • Our production database runs on a separate OVH server in Canada.
  • Copies of the production database are made on the database server and copied to Amazon Web Services (EC2) in Canada (region ca-central-1), where the two most recent copies are kept. Copies of the webhook database are kept on our OVH server, which keeps the seven most recent.
  • All traffic to papergames.io passes through Cloudflare's network, which serves each visitor from a location near them.
  • Images and other files for the mobile apps are served from cdn.papergames.io through Cloudflare, from our own OVH server in Beauharnois, Canada.

2. How transfers are protected

  • Canada, the United Kingdom and the EU and EEA states are recognised by Switzerland and by the EU as offering adequate protection, so no further safeguard is needed for them.
  • The United States is recognised only for companies certified under the Swiss-US and EU-US Data Privacy Framework. Where a company below is certified, we rely on that certification.
  • For other transfers we rely on the European Commission's standard contractual clauses, which the Swiss Federal Data Protection and Information Commissioner recognises.

3. Hosting and network

OVH Hosting Inc. (OVHcloud)

  • Purpose: Hosts our servers and our production database.
  • Data: All the personal data described in our Privacy Policy.
  • Country: Canada (Beauharnois, Quebec).
  • Safeguard: Adequacy (Canada).
  • Role: Processor.

Amazon Web Services, Inc. (EC2)

  • Purpose: Stores copies of our production database.
  • Data: All the personal data held in the database.
  • Country: Canada (region ca-central-1).
  • Safeguard: Adequacy (Canada).
  • Role: Processor.

Cloudflare, Inc.

  • Purpose: Network, DNS, caching and protection for all traffic to papergames.io; the video player on the Gruppo pricing page (Cloudflare Stream); secure access to our monitoring.
  • Data: IP address, browser information, the pages and data you request, including sign-in cookies, and the country derived from your IP address.
  • Country: United States, and Cloudflare's worldwide network.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework; standard contractual clauses as a fallback.
  • Role: Processor.

4. Payments and app stores

Stripe

  • Purpose: Checkout, subscriptions, invoices and plan management for Plus, Gruppo and Games as a Service.
  • Data: Email address, account id, language and the plan you buy. Stripe collects your payment details itself and, for one-time passes, your name, address and any VAT number.
  • Country: Ireland and the United States, and Stripe's service providers worldwide.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Stripe, LLC); standard contractual clauses.
  • Role: Processor for payments; independent controller for fraud prevention and its own legal obligations.

Xsolla

  • Purpose: Sells coins on the website as the merchant of record.
  • Data: Account id, email address, and the purchase and payment details you give Xsolla.
  • Country: United States and other countries where Xsolla operates.
  • Safeguard: Standard contractual clauses.
  • Role: Independent controller.

Apple

  • Purpose: Coin purchases in the iPhone and iPad app (App Store), and Sign in with Apple.
  • Data: The purchase transaction; for Sign in with Apple, the name and email address or relay address you choose to share.
  • Country: Ireland (Apple Distribution International) and the United States (Apple Inc.).
  • Safeguard: Standard contractual clauses.
  • Role: Independent controller.

Google Play

  • Purpose: Coin purchases in the Android app.
  • Data: The purchase token, the product and Google's order record.
  • Country: Ireland, the United States and Google's data centres worldwide.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Google LLC); standard contractual clauses.
  • Role: Independent controller.

5. Email and notifications

Twilio SendGrid

  • Purpose: Sends service and marketing emails, and holds our marketing contact list.
  • Data: Email address and the email's content, such as display names. For customers on the marketing list, the fields listed in our Privacy Policy.
  • Country: United States.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Twilio Inc.); standard contractual clauses.
  • Role: Processor.

Firebase Cloud Messaging (Google)

  • Purpose: Delivers push notifications to the mobile apps, through Apple's push service on iPhone and iPad.
  • Data: Device token, and the notification: its title and text, including a sender's display name and up to 200 characters of an inbox message, and the ids the app needs to open it.
  • Country: Google's data centres worldwide.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Google LLC); standard contractual clauses.
  • Role: Processor.

6. Sign-in

Firebase Authentication (Google)

  • Purpose: Sign-in with Google and Apple in the mobile apps.
  • Data: Email address, name and the user id at Google or Apple.
  • Country: United States.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Google LLC); standard contractual clauses.
  • Role: Processor.

Google Sign-In

  • Purpose: Sign-in with Google on the website.
  • Data: Name, email address and Google user id.
  • Country: Ireland, the United States and Google's data centres worldwide.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Google LLC); standard contractual clauses.
  • Role: Independent controller.

Facebook Login (Meta Platforms Ireland Limited)

  • Purpose: Sign-in with Facebook on the website.
  • Data: Name, email address and Facebook user id.
  • Country: Ireland, the United States and other countries where Meta has data centres.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Meta Platforms, Inc., re-certification under review); standard contractual clauses.
  • Role: Independent controller.

Discord

  • Purpose: Sign-in with Discord on the website.
  • Data: Email address, Discord user id and the profile Discord returns, including your Discord username and avatar.
  • Country: United States.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Discord, Inc., re-certification under review); standard contractual clauses.
  • Role: Independent controller.

7. Safety and moderation

OpenAI

  • Purpose: Automated moderation of display names, inbox and in-game messages, and tournament names and descriptions.
  • Data: The text being checked, without your account id or email address.
  • Country: United States (contract with OpenAI Ireland Ltd).
  • Safeguard: Standard contractual clauses.
  • Role: Processor.

Google reCAPTCHA

  • Purpose: Tells people from bots on the sign-up, login and password reset forms.
  • Data: IP address, browser and device information, and how you interact with the page.
  • Country: Google's data centres worldwide.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Google LLC); standard contractual clauses.
  • Role: Processor.

8. Analytics

Google Analytics

  • Purpose: Measures visits and events on the website.
  • Data: Pages viewed, events, browser and device information, IP address (which Google uses to estimate your location) and, where cookies are allowed, a cookie id.
  • Country: Visits from the EU, Switzerland and the UK are received on servers in Europe, then processed in Google's data centres worldwide.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Google LLC); standard contractual clauses.
  • Role: Processor.

Google Analytics for Firebase

  • Purpose: Measures screen views in the mobile apps.
  • Data: App instance id, screens and events, device information, language and a one-way hash of your account id.
  • Country: Google's data centres worldwide.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Google LLC); standard contractual clauses.
  • Role: Processor.

Mixpanel, Inc.

  • Purpose: Measures app launches, screens and games in the mobile apps.
  • Data: A Mixpanel device id, your account id once you have played a game, app events, device information and IP address (which Mixpanel uses to estimate your location).
  • Country: United States.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Mixpanel, Inc.).
  • Role: Processor.

9. Advertising on the website

Venatus Media Limited

  • Purpose: Runs the ads on the website and the consent banner shown to visitors in the EU, Norway, Iceland, Liechtenstein and the UK.
  • Data: Cookies and similar identifiers, IP address, browser and device information, the pages you visit and your consent choice. We do not give Venatus your name, email address or account id.
  • Country: United Kingdom. Venatus states that its services may also be hosted outside Europe, including in the United States.
  • Safeguard: Adequacy (United Kingdom); standard contractual clauses for Venatus's own transfers outside Europe.
  • Role: Independent controller.

Venatus's advertising partners

  • Purpose: Bid for ad space, serve and measure ads, and recognise browsers across sites.
  • Data: Cookies and device identifiers, IP address, browser information, the page address and your consent signal.
  • Country: The United States, the EU, the United Kingdom, Israel and other countries.
  • Safeguard: Set by each partner. Partners in the United States certified under the Data Privacy Framework, such as Amazon, Google, Magnite, PubMatic, Index Exchange, Microsoft, Yahoo, The Trade Desk, LiveRamp and OpenX, rely on it.
  • Role: Independent controllers.

Venatus chooses its partners and can change them without any change on our side. At the time of writing they include Amazon Publisher Services, Google Ad Manager, Magnite, PubMatic, Index Exchange, Microsoft, Yahoo, The Trade Desk, OpenX, TripleLift, Criteo, Sharethrough, GumGum, Seedtag and other ad exchanges, and the identity services ID5, LiveRamp, Unified ID, Yahoo ConnectID and SharedID.

10. Video

YouTube (Google Ireland Limited)

  • Purpose: Plays the video on the Games as a Service pricing page, only after you press its play button, from the privacy-enhanced youtube-nocookie.com domain.
  • Data: IP address, browser information and how you use the player.
  • Country: Ireland, the United States and Google's data centres worldwide.
  • Safeguard: Swiss-US and EU-US Data Privacy Framework (Google LLC); standard contractual clauses.
  • Role: Independent controller.

11. Companies using our API

Games as a Service customers

  • Purpose: Run papergames.io games for their own users and receive the results.
  • Data: Each player's display name, score and the id the company uses for them.
  • Country: Wherever the company operates.
  • Safeguard: The company's own, under its own privacy notice.
  • Role: Independent controllers.

12. Contact

For questions about this list, write to [email protected].