Legal
Subprocessors.
Luminbrane AB (org. no. 559523-4245, VAT SE559523424501, Stockholm), trading as Portico Play, uses the companies below to provide the Portico Play service. Where we process player data for a customer, these companies are our subprocessors under the customer’s data processing agreement.
Changes and notice
We give customers at least 30 days’ notice before we add or replace a subprocessor. To be told about changes, write to [email protected].
Where your data lives. The database and file storage are served on services.porticoplay.com, our own domain. Behind it, Supabase runs them in the EU, in AWS eu-north-1 (Stockholm, Sweden).
1. Subprocessors that may process player data
| Company | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Database, file storage and sign-in infrastructure, served on services.porticoplay.com | All player data held by the service | EU: AWS eu-north-1, Stockholm, Sweden | Data stays in the EU. Any support access from outside the EEA: Standard Contractual Clauses (EU 2021/914) in Supabase's DPA |
| Fly.io, Inc. | Application servers that run the play pages, embeds, Rivals, hub, console and APIs | All player data in transit and in memory; short-lived logs | EU: region arn, Stockholm, Sweden | Data stays in the EU. Any access from the US: EU–US Data Privacy Framework (Fly.io is certified) and Fly.io's DPA |
| Cloudflare, Inc. | DNS, TLS, content delivery, DDoS protection, bot checks (Turnstile) | IP address, request data, Turnstile signals | Global network; EU visitors are usually served from EU data centres | DPF and SCCs in Cloudflare's DPA |
| Resend (Plus Five Five, Inc.) | Sending email: sign-in codes, prize messages, notifications | Email address, message content, delivery status | United States (Resend stores message data in the US) | EU–US Data Privacy Framework and Standard Contractual Clauses in Resend's DPA |
| 46elks AB | Sending SMS: prize messages and codes | Phone number, message content, delivery status | Sweden | Not needed (EU) |
| Telegram (Telegram Messenger Inc. / Telegram FZ-LLC) | Bot messages and sign-in, only for brands that turn on the Telegram channel | Telegram user id, message content | Outside the EEA | No processing agreement is offered by Telegram. Used only when a brand switches on its Telegram channel, by the brand's choice |
| Push services of the player’s browser (Google, Mozilla, Apple) | Only if web push is switched on for notifications [not live today] | Push endpoint, message | Varies | Not live; reviewed before launch |
2. Services where Portico is the controller
These are not subprocessors. They process data for Portico’s own purposes, not for a customer. We list them for transparency.
| Company | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Google (GA4, Google Tag Manager) | Portico’s own product analytics on play pages, with the player’s consent for that purpose (see the Portico analytics notice); analytics on porticoplay.com with the visitor’s consent | Pseudonymous ids, pages and events, approximate location, device type | US and EU | DPF and SCCs |
| Stripe Payments Europe, Ltd. | Billing Portico's customers | Customer contact and payment data; no player data | Ireland, with transfers by Stripe | Stripe's SCCs and DPF |
| Anthropic, PBC | AI drafting of game content in the console | Text the console user writes; no player data | US | Standard Contractual Clauses (Modules 2 and 3) in Anthropic's DPA |
| ElevenLabs | Generating sounds and voices for games | Text prompts; no player data | United States | EU–US Data Privacy Framework and Standard Contractual Clauses in ElevenLabs' DPA |
| Selma (Portico’s own sales system) | Following up sign-ups and enquiries from businesses | Business contact details | EU (Luminbrane), with message drafting by Anthropic in the US | Standard Contractual Clauses in Anthropic's DPA |
| Grafana (run by Luminbrane on Fly.io) | Operations monitoring | Aggregate figures only, no personal data | EU | Not a third party |
3. Services the brand chooses
When a brand connects its own tools, those companies work for the brand, not for Portico. Examples are the brand’s own Google Tag Manager or Google Analytics tags, its CRM webhook endpoint and a Shopify store for reward codes. The brand lists them in its own privacy notice.
4. Changes
| Date | Change |
|---|---|
| [date of publication] | First published list |
| [planned] | Google Fonts removed once play pages host their own fonts |