Sub-processors
Draft: pending legal review. This is a working draft. It is not legal advice and is not yet in force. Highlighted text in brackets is a placeholder to fill in ([like this]) or an open business decision ([Decision: like this]). Purple "Drafting note" boxes are for reviewers and must be removed before publishing.
These are the companies that process personal data for us to run Bonus Round. We require each one to be bound by a contract that limits what it can do with the data. [Decision: Confirm a data processing agreement is in place with each sub-processor]
Data controller: Dream Park Immersive Inc., 1525 Van Ness Ave, San Francisco, CA. Privacy contact and Data Protection Officer: Aidan Wolf, aidan@dreampark.app.
Current sub-processors
| Company | What we use it for | Data it receives | Location |
|---|---|---|---|
| Anthropic, PBC (Claude) | The AI models behind our brand agent, play agent, ad design and play-test review, plus web search for the brand agent. | Screenshots and visible text from brand websites and games, images brands upload, brand kits, game analyses, search queries, developers' login notes. Never test-login usernames or passwords. | [ANTHROPIC PROCESSING LOCATION] |
| Google LLC (Gemini API) | Generating reference images for creatives. | Text prompts and brand images such as logos and product photos. | [GOOGLE PROCESSING LOCATION] |
| Meshy | Turning reference images into 3D models, and rigging characters. | Generated reference images (which may include brand logos and products). | [MESHY LEGAL ENTITY AND LOCATION] |
| ElevenLabs | Generating music, sound effects and synthetic voice-overs (text-to-speech) for creatives. | Text prompts describing the music and sounds, and voice-over scripts (the round's ad copy, which may include brand and product names). No personal data is intended to be sent. | [ELEVENLABS LEGAL ENTITY AND LOCATION] |
| Stripe | Payments, Checkout, subscriptions and auto-recharge, and payouts to developers through Stripe Connect. | Account email, payment details (collected by Stripe directly), amounts, and for payouts, identity, bank and tax details (collected by Stripe directly). | United States and other countries; contracting entity [STRIPE CONTRACTING ENTITY] |
| [HOSTING PROVIDER] | Hosting our servers, database and files. | All data described in our Privacy Policy. | [HOSTING REGION] |
| SendGrid | Delivering the emails Bonus Round sends to account holders, such as sign-in, receipts, payouts, invitations, alerts, statements and, unless you turn them off, tips and referral emails. | Recipient email address and name, and the message content. SendGrid reports delivery events back to us (for example delivered, bounced, spam report or unsubscribe). Open and click tracking are turned off. | [SENDGRID LEGAL ENTITY AND LOCATION] |
Confirm with ElevenLabs which voices are used for voice-overs (library voices, not clones of real people) and that their terms allow commercial advertising use. The code doesn't call Wikipedia or Wikidata yet; if the brand agent starts using them, they are public sources, not sub-processors (see below). No hosting provider is named anywhere in the code, so that row is a placeholder.
Other third parties that aren't sub-processors
- Google Fonts. Visitors' browsers load our website's fonts directly from Google, which receives their IP address and user agent. See the Cookie Notice.
- Public sources. Our brand agent reads publicly available websites and search results about a brand, and may use reference sources such as Wikipedia and Wikidata. We read from these sources; we don't send them personal data.
- Software we run ourselves. Headless Chromium (through Playwright) for our agents' browser, and Blender for preparing 3D models, run on our own servers.
- Stripe as an independent controller. For identity verification, fraud prevention and its legal obligations, Stripe may process data as an independent controller under its own privacy policy.
Changes to this list
We will update this page before a new sub-processor starts processing personal data. [Decision: How customers are notified of changes (e.g. email to account holders, or an RSS feed), the notice period (e.g. 30 days) and the right to object]
Questions: aidan@dreampark.app.