Sub-processors
Last updated: 2026-04-24
Battle Trade relies on the following third-party sub-processors to operate. For each, we disclose what data we share, why, and where to find their Data Processing Agreement. If you are an EU/UK data subject, all listed providers either host in the EEA or operate under Standard Contractual Clauses (SCCs) for EU→US transfers as required by GDPR Art. 46.
We review this list whenever we onboard a new provider. If you have a question about a specific sub-processor, email e@battle.fyi.
| Provider | Purpose | Data Shared | Region | DPA | SCCs |
|---|---|---|---|---|---|
| Supabase | Primary database + auth + realtime | Profile records, gameplay, sessions, feedback, session blocklist | US (us-east-2) | Link | Yes — EU SCCs included in DPA |
| Privy | Wallet + email + social authentication | Authentication identifiers (Privy user ID), linked email / wallet | US | Link | Yes — SCCs in DPA |
| Stripe | Payment processing (credit purchases, Battle Pass) | Card metadata (tokenized), transaction amount, email on receipt | US + EU | Link | Yes — SCCs for EU→US transfers |
| Base Pay | USDC payments on Base chain | Wallet address, transaction hash, amount | On-chain (public ledger) | Link | N/A — public blockchain |
| Vercel | Hosting + Analytics + Speed Insights | Request logs, page views (gated by cookie consent), IP (logs) | Global edge, primary US | Link | Yes — SCCs in DPA |
| Sentry | Error tracking | Error messages + stack traces; IP + email scrubbed server-side | US | Link | Yes — SCCs for EU→US transfers |
| Upstash | Redis rate limiting + session blocklist cache | Hashed IP + rate-limit counters, session blocklist jti | US / EU (configurable per workspace) | Link | Yes — SCCs in DPA |
| LiveKit | Broadcast / camera / mic streaming | Audio + video streams during active lobbies | US edge mesh | Link | Yes — SCCs for EU→US transfers |
| Notion | Internal sync of feedback + contact submissions | Feedback title, description, optional email | US | Link | Yes — SCCs in DPA |
| Pyth Network | Price feeds | No user data sent; read-only price oracle | On-chain | N/A | N/A — no personal data |
Changes
Material changes to this list are announced via the Privacy Policy change log at least 7 days before taking effect. If you object to a new sub-processor, you can request account erasure at any time.