List of subprocessors
These are the service providers that process personal data for us. For players' data they are subprocessors under the Data processing agreement; for account data they are our processors under the Privacy policy. The Croatian version is binding.
| Provider | Purpose | Data | Location | Transfer | Policy |
|---|---|---|---|---|---|
| Neon (Databricks) | Database | All account, quiz and session data | EU (Frankfurt) | EU | databricks.com |
| Convex | Live quiz sessions | Team names, answers, drawings and photos, presence, fair-play records | [PROVJERITI: our deployment region (Convex offers EU, Ireland)] | SCC | convex.dev |
| Vercel | Web app hosting and proxy to the API | IP address, request data | [PROVJERITI: function region (default USA, iad1)] | EU-US DPF | vercel.com |
| Render | API hosting, logs | IP address, request data, logs | [PROVJERITI: service region (Render offers Frankfurt)] | EU-US DPF | render.com |
| Amazon Web Services (S3, CloudFront) | File storage and delivery | Images, audio, scans of answer sheets; IP address on delivery | EU (Stockholm); CloudFront delivers from edge locations worldwide | EU-US DPF | aws.amazon.com |
| Resend | Sending transactional emails | Email address, name, email content | [PROVJERITI: sending region (Resend offers EU, Ireland)] | EU-US DPF | resend.com |
| Anthropic | AI question generation and reading answer sheets (OCR) | Quiz topic and notes, photos of answer sheets | USA | SCC | anthropic.com |
| Upstash | Rate limiting | IP address, user ID | [PROVJERITI: database region (Upstash offers Frankfurt and Ireland)] | EU-US DPF | upstash.com |
| Mapbox | Maps and address search for map questions | IP address, address query | USA | EU-US DPF | mapbox.com |
| Google (YouTube) | Embedded video, only with consent or on click | IP address, browser data | [PROVJERITI] | EU-US DPF | policies.google.com |
| Sentry | Error tracking, release health (cookieless sessions) and performance tracing for 10% of page loads, without consent; screen recording of an error only with consent | User ID, technical error data | EU (Frankfurt) | EU | sentry.io |
| PostHog | Product analytics | User ID, in-app events, plan, role and signup week; with consent also an anonymous browser id, pages visited without parameters and masked clicks | EU (Frankfurt) | EU | posthog.com |
| Tavily | Research for AI generation | Query derived from the quiz topic | USA | [PROVJERITI] | tavily.com |
Transfer mechanism:
- EU: data is stored in the EU.
- DPF: the provider is certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Its processing agreement also contains standard contractual clauses.
- SCC: standard contractual clauses (Commission Implementing Decision (EU) 2021/914), part of the processing agreement with the provider.
Some providers with storage in the EU (Neon, Sentry, PostHog) are US companies that can access data from the USA; the DPF or the standard contractual clauses in their processing agreements cover that.
Changes
Before adding or replacing a subprocessor we email organizers at least 30 days in advance [PRAVNIK: period] and record the change here.
| Date | Change |
|---|---|
| [PROVJERITI: publication date] | First list. |