Sub-processors
Last updated: 30 July 2026.
These are the third parties that process data on behalf of Rolegend so the product can work. Each entry says what that company receives and where it processes it. This list is part of Nightshift Software's Privacy Policy and of the service schedule for Rolegend.
Supabase
Sign-in, the database everything is stored in, and file storage for generated images.
- What it receives: Your email address and sign-in session; every row your account owns - profile, worlds, campaigns, characters, turns, world state, quests, inventory, credit history; and any image you generate.
- Where: Paris, France (Supabase region eu-west-3).
Vercel
Hosting. The site and its API run as Vercel functions, and the platform holds the server logs they write.
- What it receives: Every request you make to the site, and whatever those requests put in a log line - request paths, errors, and the tool calls the GM makes.
- Where: vercel.json pins the functions to Vercel's cdg1 region (Paris). Static assets are served from Vercel's global network.
PostHog
Product analytics and error tracking. Counts what accounts do inside the game so we can tell whether the product works, and receives the server's error reports so a failure is visible rather than merely logged.
- What it receives: From your browser, only if you accept the cookie banner: pages visited, which buttons you pressed, and where on a page you clicked or scrolled. From our servers, whether or not you accept: your account's internal identifier and the fact that an account was created, a character was made, a turn was played, or a subscription started or ended, plus structured details such as the plan chosen. Also any error the server reports, with secrets and long values stripped before it is sent. Never your campaign text.
- Where: European Union (PostHog Cloud EU, eu.i.posthog.com).
Anthropic
Generates the GM's narration when Anthropic is the platform's configured model provider, and is the failover target for an OpenAI-primary deployment when an Anthropic key is set.
- What it receives: The prompt behind each GM reply: your character sheet, the campaign and world state, the recent transcript, retrieved lore, your lines and veils, and the text you write.
- Where: United States.
OpenAI
Three jobs. It generates the GM's narration when OpenAI is the configured provider (or the failover target); it produces the embeddings behind lore retrieval, which it does whichever provider generates the narration; and it generates entity images.
- What it receives: The same per-turn prompt as above when it is the generation provider; the text of anything indexed for retrieval; and the prompt behind an image you ask for.
- Where: United States. OpenAI offers European data residency for eligible endpoints; Rolegend does not currently use it.
Stripe
Subscription payments and the billing portal.
- What it receives: Your email address, and the payment details you enter - those go straight into Stripe's own hosted checkout page, so card numbers never reach Rolegend. What comes back to us is the customer and subscription identifiers and the subscription status.
- Where: United States (Stripe, LLC).
Resend
Sends product email - the welcome message, the account-deleted confirmation, and the other notices under src/server/email/.
- What it receives: Your email address and the contents of those messages.
- Where: United States. Resend can send from an EU region, but account data, email metadata and logs are held in the United States regardless.
Transfers outside the UK
Supabase, Vercel and PostHog process in the EEA, so nothing leaves it for those three. The rest process in the United States, and each transfer is covered by that company’s own arrangement rather than by one blanket mechanism:
- Anthropic. Anthropic's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and forms part of their commercial terms.
- OpenAI. OpenAI's Data Processing Addendum: an adequacy decision where one applies, otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
- Stripe. The EU-US Data Privacy Framework, under which Stripe, LLC is self-certified, with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum carried in Stripe's Data Transfers Addendum as a fallback.
- Resend. The EU-US Data Privacy Framework and its UK Extension, under which Resend is certified, with the EU Standard Contractual Clauses carried in their Data Processing Addendum.
These describe each company’s published terms as at 30 July 2026. They are stated here because they are checkable, not because a lawyer has reviewed this page.
Not on this list
Session recording. Nothing records your screen or what you type. PostHog is on the list above for errors and for basic usage analytics, and its session-replay feature is switched off in code.
Optional integrations. The code supports the integrations below, but each one is inert until an operator sets an environment variable, and that variable is what picks the recipient - so the code alone cannot name a company for any of them. Whether any is switched on in production: {{OPTIONAL_INTEGRATIONS_IN_USE}}
SELFHOSTED_BASE_URL- Sends the same per-turn prompts to a self-hosted, OpenAI-compatible model endpoint instead of Anthropic or OpenAI. Whoever hosts that endpoint is the recipient.ERROR_REPORTING_DSN- Forwards structured error reports to the URL it names. With it unset, error reports stop at the server log.OTEL_EXPORTER_OTLP_ENDPOINT- Exports OpenTelemetry traces of turn generation. With it unset, the spans are recorded against a no-op tracer and leave the process nowhere.
Changes
Adding a sub-processor means updating this page. It carries the date it was last checked against the code, at the top.
Contact
Questions about anything here: support@rolegend.com.