Subprocessors
Last updated: 4 October 2026
These are the service providers that process personal data for Letterbrawl. Each one may only use the data to provide its service to us, under a data processing agreement (DPA). For the full picture, read the Privacy Policy.
Changes to this list
We may add, replace or remove service providers at any time, for example to improve the service, to lower costs or to change hosting. For every provider we use:
- we sign a data processing agreement that limits the provider to processing data on our instructions (Art. 28 GDPR, Art. 9 Swiss FADP);
- if the provider processes data outside Switzerland, the EU or the EEA, we use only a country with an adequate level of protection or appropriate safeguards, such as the Data Privacy Framework or Standard Contractual Clauses (Art. 44 to 49 GDPR, Art. 16 and 17 FADP);
- we update this page and its "Last updated" date before the new provider starts to process personal data.
A new provider does not change why we use your data. If we ever want to use your data for a new purpose, we update the Privacy Policy first and ask for your consent where the law requires it. If a change is important for you, for example data that moves to a new country, we also tell you in the game or by email (if you have an account) before it takes effect.
These changes do not limit your rights. You can still ask for access to your data, correct it, delete it, object to its use, or complain to a data protection authority (in Switzerland the FDPIC, in the EU the authority where you live). See Your rights. You can also delete your account at any time.
DPF means the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework. SCCs means the European Commission's Standard Contractual Clauses, with the changes needed for Swiss and UK law.
| Name | Legal entity | Purpose | Data | Location | Transfer safeguard | Link |
|---|---|---|---|---|---|---|
| Vercel | Vercel Inc., USA | Website hosting, content delivery network, server functions, request logs; Vercel Speed Insights (page-speed measurement without cookies or visitor IDs); Vercel Web Analytics (visit statistics without cookies, only with your consent); the Vercel Marketplace, through which we set up and pay for the Upstash and Neon databases | IP address, request details, all game and account data passing through the server; for Web Analytics: page views, referrer, country, device and browser type, and a hash that changes every day | Server functions: Frankfurt, Germany (fra1). Static files are served from the edge location nearest to you, which can be outside Europe. | DPF (EU-U.S., UK Extension and Swiss-U.S., active) and SCCs in the Vercel DPA | DPA · Privacy |
| Upstash | Upstash, Inc., USA | Redis database for live games, ratings and power-ups; QStash scheduler that starts reminder runs. Set up through the Vercel Marketplace. | Display names, guesses, results, room codes, ratings, power-ups, streaks, guest IDs | Frankfurt, Germany (AWS eu-central-1) | DPF (EU-U.S., UK Extension and Swiss-U.S., active) and the Upstash DPA | DPA · Privacy |
| Neon | Neon, LLC, a subsidiary of Databricks, Inc., USA (the Neon service terms are with Databricks, Inc.) | Postgres database for accounts. Set up through the Vercel Marketplace. | Email address, display name, friends, daily puzzle results, pasted puzzle results, reminder settings and consent records | Frankfurt, Germany (AWS eu-central-1) | DPF (EU-U.S., UK Extension and Swiss-U.S., active; Databricks, Inc. certification covers Neon, LLC) and SCCs in the Databricks/Neon terms | Terms & DPA · Privacy |
| Resend | Plus Five Five, Inc. (trading as Resend), USA | Sending sign-in and reminder emails | Email address, the sign-in email itself, delivery logs | Account data and email logs: United States. Emails are sent from the sending region we choose. | DPF (EU-U.S. and UK Extension; not certified under the Swiss-U.S. DPF) and SCCs in the Resend DPA, which also cover Swiss transfers | DPA · Privacy |
| Google Analytics | Google LLC, USA (and its affiliate Google Ireland Limited, Ireland) | Website statistics, only with your consent | Pages and features used, device and browser data, approximate location, analytics cookie ID. No full IP addresses are stored. | United States and other countries where Google operates | DPF (EU-U.S., UK Extension and Swiss-U.S., active for Google LLC) and SCCs in Google's data processing terms | Data processing terms · Privacy |
| Cloudflare | Cloudflare, Inc., USA | DNS (finds the address of letterbrawl.com) and email forwarding for @letterbrawl.com addresses. It does not carry game traffic. | DNS lookups, which usually come from your internet provider's DNS resolver; emails you send to us (address, content) | Global network | DPF (EU-U.S., UK Extension and Swiss-U.S., active) and SCCs in the Cloudflare DPA | DPA · Privacy |
| Meta (WhatsApp) | Meta Platforms Ireland Limited, Ireland | Sends WhatsApp reminders. Only for players who link WhatsApp. | Phone number, reminder text | EU and United States | WhatsApp Business data processing terms | Data processing terms |
Their own providers
These companies use their own subprocessors, for example Amazon Web Services data centres. Each publishes its own list.
Changes
We update this page when we add or change a provider. Questions: privacy@letterbrawl.com.