Sub-processors

The Data Processing Agreement (§9) requires this list to be published, and requires at least 14 days’ notice to a Controller before a new sub-processor is added.

Objections to a sub-processor, and requests for the signed Data Processing Agreement, go to admin@tactye.com.

• DigitalOcean — hosting for the service and its data. Established in the United States; hosting in the European Union.
• Amazon Web Services — transactional email, such as invitations and password resets. European Union.
• Stripe — subscription billing for paying organizations. No player, event or tactical-board data. Established in the United States, with Stripe Payments Europe in Ireland.
• hCaptcha (Intuition Machines, Inc.) — bot protection on public forms. No account contents. Established in the United States.
• Plausible Analytics — cookieless website analytics. Established in Estonia; hosting in the European Union.
• OpenRouter, Inc. — routing a request to the AI model that generates practice content, where AI features are switched on for a club. Team- and session-level information only; the provider is instructed not to retain the request and not to train on it. Established in the United States. Applies from 2026-09-27.

Advertising

Advertising on this website is supplied by Google Ireland Limited, which is an independent controller for it rather than a sub-processor: it does not process a Controller’s data on our instructions, and no player, event or tactical-board data reaches it. It is named here because this is the page a reader consults for the third parties this product involves. What Google receives, and how consent for it is given and withdrawn, is described in the Privacy Notice.

Transfers outside the EU/EEA

Where a provider above is established outside the EU/EEA, transfers rely on the safeguards described in §10 of the Data Processing Agreement: an adequacy decision by the European Commission, or appropriate safeguards under Article 46 GDPR such as Standard Contractual Clauses.