Subprocessors
Last updated: September 2026
Suplay Games & Tools deliberately uses very few third-party services. The ones we do use are listed here.
Current subprocessors
| Subprocessor | Purpose | Data processed | Location | Transfer basis |
|---|---|---|---|---|
| TransIP / team.blue transip.nl | Hosting, compute, primary storage | All application data (database, application logs) | Netherlands (EU) | EU — no transfer mechanism required |
| Scaleway S.A.S. scaleway.com | Encrypted off-site backup storage (Object Storage, nl-ams region) | Encrypted PostgreSQL database snapshots (GPG AES-256 symmetric). The decryption key is held by suPlay B.V. only; Scaleway cannot decrypt. | Netherlands / France (EU) | EU — no transfer mechanism required |
| Sentry (Functional Software Inc.) sentry.io | Application error monitoring | Error messages, stack traces and technical context (URL, HTTP status, release). Configured with sendDefaultPii: false and no performance tracing or session replay. No game answers, class codes or participant identifiers are sent. | EU region (ingest.de.sentry.io) | EU — no transfer mechanism required |
Services we do NOT use
- No analytics — no Google Analytics, no Plausible, no Matomo, nothing.
- No tracking pixels — no Meta, no LinkedIn, no retargeting.
- No third-party fonts — typography fonts are self-hosted at build time via Next.js’s font pipeline, so no requests leave your browser to
fonts.googleapis.com. - No third-party iframes or embeds.
- No email service — we send no email from the minigames app.
- No payment processor — the service is free.
Self-hosted services (not subprocessors)
The PostgreSQL database and the Node.js application server are operated by suPlay B.V. on infrastructure in the Netherlands. These components are not third-party subprocessors.
Subprocessor change notifications
If you have a Data Processing Agreement with us, we will email your contact at least 30 days before adding or replacing any subprocessor.
Questions or DPA requests: privacy@suplay.nl.