Last updated: April 2026
Sub-processors
The third-party services GAMB·8 relies on to operate — who, where, what they process, and why. This page is the canonical list; the general Privacy Policy refers here rather than naming vendors directly, so vendor swaps don't require a policy revision. Material changes are announced via the cookie banner on next sign-in.
Infrastructure & Edge
| Processor | Purpose | Region | Data |
|---|---|---|---|
| Railway | Application hosting, Postgres, Redis | US | All server-side account data, bet logs, trades, sessions |
| Cloudflare | CDN, DDoS protection, edge TLS | Global | Request IP, URL, user-agent (transient, not retained long-term) |
| GitHub | Source-code hosting, CI/CD | US | No end-user data; commit logs, issue history |
Payments
| Processor | Purpose | Region | Data |
|---|---|---|---|
| Stripe | Subscription billing, checkout, invoicing | US & EU | Card details (held by Stripe, not by us), customer ID, invoice records |
| On-chain crypto processors | USDC / BTC deposit derivation + settlement | Public blockchains | Deposit address, transaction hash, chain, amount. Sending wallet is public. |
See Billing Terms for how charges, renewals, and refunds work.
Observability & Analytics
| Processor | Purpose | Region | Retention |
|---|---|---|---|
| PostHog | Anonymised product analytics (page views, feature usage) | US & EU | 90 days |
| Sentry | Error tracking, stack traces | US | 30 days |
PostHog is initialised only after you consent on the cookie banner in GDPR regions. Global Privacy Control (GPC) and Do Not Track (DNT) signals are honoured estate-wide — see the Cookie Policy.
Identity & Authentication
| Processor | Purpose | Region | Data |
|---|---|---|---|
| Google LLC | OAuth sign-in (optional) | US | Stable user ID + email (only if you link) |
| Discord Inc. | OAuth sign-in (optional) | US | Stable user ID + email (only if you link) |
| X Corp. | OAuth sign-in (optional) | US | Stable user ID + screen name (only if you link) |
| Kick Streaming B.V. | OAuth sign-in (optional) | NL | Stable user ID + username (only if you link) |
OAuth tokens are stored encrypted at rest and are used only to keep your linked logins working. Unlink at any time from Settings → Privacy.
Messaging & Notifications
| Processor | Purpose | Region | Data |
|---|---|---|---|
| Firebase Cloud Messaging (Google LLC) | Push notifications on mobile / desktop | US | Device token + notification payload (until you unregister) |
| Transactional email provider | Account emails (verification, password reset, receipts, alerts) | EU / US | Your email address + message contents |
AI Providers
| Processor | Purpose | Region | Training use |
|---|---|---|---|
| Anthropic / OpenAI / equivalent LLM APIs | Coach Overlay, Multi-Agent Debate, Truth Engine summarisation | US | Configured for zero-data-retention where the provider supports it. We do not knowingly contribute your conversations to provider training. |
See AI Act Compliance for the full registry of AI systems, risk classifications, training methods, and oversight mechanisms.
Public-Data Ingestion
For editorial and analytics purposes, GAMB·8 reads public data from operator websites, blockchain explorers, public streamer platforms (Kick, YouTube, Twitch APIs), and third-party public dashboards (e.g. Tanzanite Terminal). We do not submit personal data to these sources; we read what they have already published. Source attribution is recorded in our own storage.
Changes to This List
We update this page when we add, remove, or replace a sub-processor. For subscribers in GDPR regions, a notice is shown in-product 30 days before any material change takes effect. You can object to a proposed sub-processor by emailing privacy@gamb8.com; if we cannot reconcile the objection, your remedy is termination under the Billing Terms.