Sub-processors
The providers that process data on behalf of venues, what each one does, what data it receives and where, and those involved without being sub-processors.
In force since 2026-09-28
1. What this list is
Playium processes the data of each venue's families and staff on the venue's behalf, under the data processing agreement. To provide the service it uses the providers on this list (sub-processors), under a contract that imposes equivalent data protection obligations on them.
Where a provider processes data outside the European Union, the transfer relies on the provider's certification under the EU-U.S. Data Privacy Framework or on the standard contractual clauses of Decision (EU) 2021/914 included in its data processing agreement.
2. Sub-processors
| Provider | Purpose | Data | Where |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, access accounts, files and server functions | All service data | Database and files in the EU (eu-west-1 region, Ireland). Server functions run in the region closest to each request, in the EU or in the United States |
| Vercel (Vercel Inc., United States) | Hosting of the website, the panel, the family app and the public calendar; usage and performance metrics, only with analytics consent | IP address, browser and pages visited | Global network, based in the United States |
| Resend (Plus Five Five, Inc., United States) | Sending all emails | Recipient address and message content | United States |
| Sentry (Functional Software, Inc., United States) | Error monitoring | Technical data about the error and, if signed in, the account's identifier and username (usually the email). With analytics consent, a visual replay of the session in which the error occurred, with text and forms always hidden | EU (Germany) |
| Microsoft Clarity (Microsoft) | Session recording and heatmaps, only when Playium has it enabled and with analytics consent | IP address, browser and interaction with the page | United States |
| Push services from Google, Mozilla and Apple | Delivering notifications to the device, if the family enables them | Technical identifier of the subscription. The content travels encrypted and the service cannot read it | Depending on each device's browser |
3. Only if the venue enables them
| Provider | Purpose | Data | Where |
|---|---|---|---|
| Meta Platforms Ireland (Ireland) | WhatsApp Business: messages between the venue and its customers, and connecting the number from the panel | Phone number and message content | Ireland and United States |
| Anthropic (Anthropic, PBC, United States) | WhatsApp artificial intelligence assistant | Conversation content, without the sentences the assistant recognises as health data or the allergies the family states after saying yes in the fixed consent step, and, if the person writing is already a customer, the parent/guardian's name, their children's names and ages and their upcoming bookings | United States |
Under Anthropic's commercial terms, it may not use this content to train its models; according to its documentation, it keeps it for 30 days and then deletes it, except content flagged by its safety systems, which it may keep for longer.
4. Providers that are not sub-processors
They take part in the service, but do not process data on Playium's behalf:
| Provider | What it does | Why it is not a sub-processor |
|---|---|---|
| Dodo Payments (Dodo Payments Inc.) | Charges the venue for its Playium subscription | It is the seller (merchant of record) and processes payment data as an independent controller |
| Stripe and PayPal | Gateways the venue contracts to take payments from its families | They are the venue's providers, under their own contract |
| Meta Platforms Ireland (Meta Pixel and Conversions API) | Measures Playium's advertising, only with marketing consent | It processes data of people who visit Playium's public website or sign up there as Playium customers; never data Playium processes on a venue's behalf (families, panel, app or calendar) |
5. Changes to the list
Playium will notify each venue of any addition or replacement of a sub-processor at least 30 days in advance, by email to the venue's administrator. During that period the venue may object and, if the objection cannot be resolved, terminate the contract without penalty before the change takes effect, as set out in the data processing agreement.
| Date | Change |
|---|---|
| 2026-09-28 | List published |