Sub-processors
Last updated: 28 October 2026.
These are the third parties that process data on behalf of Rolegend so the product can work. Each entry says what that company receives and where it processes it. This list is part of Nightshift Software's Privacy Policy and of the service schedule for Rolegend.
Supabase
Sign-in, the database everything is stored in, and file storage for generated images.
- What it receives: Your email address and sign-in session; every row your account owns (profile, worlds, campaigns, characters, turns, world state, quests, inventory, credit history); and any image you generate.
- Where: Paris, France (Supabase region eu-west-3).
Vercel
Hosting. The site and its API run as Vercel functions, and the platform holds the logs they write.
- What it receives: Every request you make to the site, and whatever those requests put in a log line: request paths, errors, and the tool calls the GM makes.
- Where: vercel.json pins the functions to Vercel's cdg1 region (Paris). Static assets are served from Vercel's global network.
PostHog
Product analytics and error tracking. Counts what accounts do inside the game so we can tell whether the product works, and receives our error reports so a failure is visible rather than merely logged.
- What it receives: From your browser, only if you accept the cookie banner: pages visited, which buttons you pressed, and where on a page you clicked or scrolled. From us, whether or not you accept: your account's internal identifier and the fact that an account was created, a character was made, a turn was played, or a subscription started or ended, plus structured details such as the plan chosen. Also any error that the game reports, with secrets and long values stripped before it is sent. Never your campaign text.
- Where: European Union (PostHog Cloud EU, eu.i.posthog.com).
OpenRouter
Routes every AI request to the model vendor that does the work: the GM's narration, entity images, read-aloud audio, the embeddings behind lore retrieval, and the moderation screens. Rolegend sends no AI request to a vendor directly. Each request goes through OpenRouter first, and it passes the request on to a vendor that serves the named model.
- What it receives: The prompt behind each GM reply: your character sheet, the campaign and world state, the recent transcript, retrieved lore, and the text you write. Also the prompt behind an image you ask for, and the reference images that the request carries. Also the text of any reply you ask to hear read aloud. Also the text of anything indexed for retrieval. Also, for the moderation screens, the text you write each turn, each GM reply, and the prompt, the reference images and the result of each image you ask for.
- Where: United States.
Anthropic
Generates the GM's narration when the configured model is one of Anthropic's. Reached through OpenRouter rather than directly, so it receives the prompt from them.
- What it receives: The prompt behind each GM reply: your character sheet, the campaign and world state, the recent transcript, retrieved lore, and the text you write.
- Where: United States.
Generates entity images when the configured image model is one of Google's, and reads the Game Master's replies aloud when you ask for audio and the configured speech model is one of Google's. The default image model is Google's Gemini 2.5 Flash Image, and the default speech model is Google's Gemini 3.8 Flash TTS. Reached through OpenRouter rather than directly, so it receives the request from them.
- What it receives: The prompt behind an image you ask for, and the reference images that the request carries. The text of any reply you ask to hear read aloud.
- Where: Outside the UK and the EEA, at the Google Cloud location that OpenRouter selects. The request does not name a region.
OpenAI
Two jobs, both reached through OpenRouter rather than directly. It generates the GM's narration when the configured model is one of OpenAI's. It also makes the embeddings behind lore retrieval, whichever vendor writes the narration: OpenRouter sends each embedding request to OpenAI or to Microsoft's Azure OpenAI service.
- What it receives: The same per-turn prompt as above when it is the generation vendor, and the text of anything indexed for retrieval.
- Where: United States. OpenAI offers European data residency for eligible endpoints; Rolegend does not currently use it.
Microsoft
Makes the embeddings behind lore retrieval when OpenRouter sends the request to Microsoft's Azure OpenAI service, which runs the same OpenAI embedding model. Reached through OpenRouter rather than directly.
- What it receives: The text of anything indexed for retrieval.
- Where: Outside the UK and the EEA, at the Azure location that OpenRouter selects. The request does not name a region.
DeepInfra
Runs the moderation screens on Meta's Llama Guard 4 model. The screens check the text you write each turn, each GM reply, and the prompt, the reference images and the result of each image you ask for. Reached through OpenRouter rather than directly.
- What it receives: The text you write each turn, each GM reply, and the prompt behind an image you ask for, its reference images and the image that comes back.
- Where: United States.
Stripe
Subscription payments and the billing portal.
- What it receives: Your email address, and the payment details you enter. Those go straight into Stripe's own hosted checkout page, so card numbers never reach Rolegend. What comes back to us is the customer and subscription identifiers and the subscription status.
- Where: United States (Stripe, LLC).
Resend
Sends product email: the welcome message, the account-deleted confirmation and our other account notices. Holds the early access list.
- What it receives: Your email address and the contents of those messages. If you join early access, your address on that list.
- Where: United States. Resend can send from an EU region, but account data, email metadata and logs are held in the United States regardless.
Cloudflare
Runs the check that you are a person, on the early access form. It is the only page on the site that asks you for anything, and it is the only page Cloudflare is involved in.
- What it receives: Your IP address, and signals your browser gives up while the check runs, such as how the page was loaded and how the pointer moved. Not what you typed into the form: the answers come to us, and what Cloudflare returns to us is a yes or a no.
- Where: Cloudflare's global network. The check is served by whichever of their locations is nearest to you, so it is not tied to one country.
Dictating your turn
The microphone button in the composer uses your browser’s own speech recognition, not ours. In Chrome and Edge your browser sends the audio to Google’s speech service to turn it into text; Safari can do it on your device. Either way Rolegend never receives or stores the recording, only the text your browser hands back, and only once you press send. Nothing is recorded until you press the microphone, and browsers that have no recognizer do not show the button.
Transfers outside the UK
Supabase, Vercel and PostHog process in the EEA, so nothing leaves it for them. The rest process outside the UK and the EEA, where the table above says. Each transfer is covered by that company’s own arrangement rather than by one blanket mechanism:
- OpenRouter. European Commission adequacy decisions where one applies, otherwise the EU Standard Contractual Clauses approved under Article 46 GDPR, as stated in OpenRouter's privacy policy.
- Anthropic. Anthropic's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and forms part of their commercial terms.
- Google. Google's Cloud Data Processing Addendum: a transfer solution that Google adopted, such as a recognised data protection framework, where one applies, otherwise the EU Standard Contractual Clauses.
- OpenAI. OpenAI's Data Processing Addendum: an adequacy decision where one applies, otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
- Microsoft. The EU-US Data Privacy Framework, under which Microsoft is certified, with the EU Standard Contractual Clauses incorporated in Microsoft's Products and Services Data Protection Addendum.
- DeepInfra. DeepInfra's privacy policy names no transfer mechanism. The request reaches DeepInfra through OpenRouter, whose transfer terms are listed above.
- Stripe. The EU-US Data Privacy Framework, under which Stripe, LLC is self-certified, with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum carried in Stripe's Data Transfers Addendum as a fallback.
- Resend. The EU-US Data Privacy Framework and its UK Extension, under which Resend is certified, with the EU Standard Contractual Clauses carried in their Data Processing Addendum.
- Cloudflare. Cloudflare's Data Processing Addendum, which applies the EU Standard Contractual Clauses as amended by the UK Addendum, and their certification under the EU-US Data Privacy Framework and its UK extension.
These describe each company’s published terms as at 28 October 2026. They are stated here because they are checkable against each company’s published terms.
Not on this list
Session recording. Nothing records your screen or what you type. PostHog is on the list above for errors and for basic usage analytics, and its session-replay feature is switched off in code.
Changes
Adding a sub-processor means updating this page. It carries the date it was last checked against the code, at the top.
Contact
Questions about anything here: support@rolegend.com.