This page lists the companies that The Sportsbook ("we") uses to process personal data of operators' players on the operators' behalf, under our Data Processing Addendum. It also lists, for transparency, the third parties whose content can load in the player's browser, and the providers we use for our own business.
Changes. We give operators at least 14 days' notice before a new sub-processor starts processing player data. We do this by updating this page and notifying the owner of each operator account by email or in the console. If we must replace a sub-processor urgently to keep the service secure or available, the notice may be shorter, but we always give it before the new sub-processor starts processing player data. Operators can object as described in Section 6 of the Data Processing Addendum. Questions: support@thesportsbook.app.
These companies process player data on our behalf to run the sportsbook.
| Sub-processor | Purpose | Location of processing | Player data processed | Transfer safeguard |
|---|---|---|---|---|
| Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA | Hosting of our API and application servers, the PostgreSQL database and scheduled jobs (including the backup job); application logs | PostgreSQL database: European Union (Netherlands). API and application servers: United States (California). Backup job: Singapore | All categories in Annex I of the DPA: player identifiers, display names, language, bets, token balances and movements, block status and reasons, session and metering records; IP address and browser information in request logs | Standard Contractual Clauses as offered in Railway's DPA; EU-U.S. Data Privacy Framework where Railway is certified |
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Hosting and delivery of the embedded sportsbook (play.thesportsbook.app) and of our other web front-ends, including the console where operators view player data; content delivery network; request logs | Global edge network; server functions in the United States (Washington, D.C. area) | IP address and browser information of players; request URLs (including single-use launch tokens valid for 60 seconds); player data passing through the embed's server routes and shown in the console | EU-U.S. Data Privacy Framework (with UK Extension and Swiss-U.S. DPF); Standard Contractual Clauses in Vercel's DPA |
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Domain name system (DNS); delivery of operators' branding images from assets.thesportsbook.app; object storage of daily database backups, encrypted at rest and kept for 30 days | Global network for DNS and image delivery; backups stored in a Western European location | IP address and browser information of players loading branding images; full copies of the database in backups (all categories in Annex I of the DPA) | EU-U.S. Data Privacy Framework (with UK Extension and Swiss-U.S. DPF); Standard Contractual Clauses in Cloudflare's DPA |
Cloudflare, Inc. is a US company, so the transfer safeguards above also apply to the backups stored in Western Europe.
Our servers send no personal data to the providers of sports data (fixtures, odds, results). However, on pages of live matches the player's browser connects directly to third-party live match data and video services, which receive the player's IP address, browser information and the match being viewed (see section 2).
Three features can make the player's browser load content directly from another company. That company receives the player's IP address and browser information, and may set its own cookies, under its own terms and privacy policy. It does not process player data on our behalf or on the operator's, so it is not a sub-processor.
| Third party | When content loads | What it receives |
|---|---|---|
| Twitch (Twitch Interactive, Inc.), YouTube (Google LLC / Google Ireland Limited, through youtube-nocookie.com), Kick | On a match with a public stream, only after the player clicks to watch the stream, following a notice that the platform may set its own cookies | IP address, browser information; the platform's own cookies once the player has loaded it |
| Third-party live match data and video services | On pages of live matches that show the match visualisation or, for some matches, video from the data provider | IP address, browser information, the match being viewed |
| Any website hosting a logo or icon linked by the operator | The operator enters an external image address in the console instead of uploading the file | IP address, browser information, the page address (referrer) |
These providers do not process player data. We use them, as controller, for our relationship with operators and prospects. Our Privacy Policy describes this processing.
| Provider | Purpose | Location | Data | Transfer safeguard |
|---|---|---|---|---|
| Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA | Sending transactional emails (sign-up codes, password reset, invitations, welcome) and notifications of requests sent from our website | United States | Email addresses and names of console users and prospects, the content of those emails | EU-U.S. Data Privacy Framework; Standard Contractual Clauses (Module One/Two as in Resend's DPA) |
| Google LLC / Google Ireland Limited | "Continue with Google" sign-in to the console; the business mailbox that receives notifications of requests sent from our website | United States / Ireland | For sign-in: the Google account identifier, name and email; for the mailbox: the content of those notifications | EU-U.S. Data Privacy Framework |
| OxaPay (oxapay.com) | Crypto payment of paid plans | As stated in OxaPay's own terms | We send only the invoice number, the amount and a description of the plan, which do not identify anyone. Anything the payer enters on OxaPay's payment page goes to OxaPay directly, and OxaPay processes it as a separate controller under its own terms and privacy policy | None needed: we send OxaPay no personal data (see our Privacy Policy) |
| Railway, Vercel, Cloudflare | As in Section 1, for the console, our website and our database | As in Section 1 | Console accounts, billing records and website requests | As in Section 1 |