Sub-processors
Last updated: 5 October 2026
You cannot run a web application without infrastructure, and infrastructure providers necessarily handle data. Naming every one of them is both a legal requirement and, we think, the only honest way to claim we protect your data.
This is the complete list. It has its own page, and its own date, because it changes on a different rhythm from the Privacy Notice.
1. What this list is
A processor is a company that handles personal data on our instructions and for no purpose of its own. A sub-processor is one engaged on our behalf, with our authorisation. What matters is that every company below is bound to do only what we tell it, and that we remain accountable for all of it.
Each is engaged under a written data processing agreement imposing confidentiality, security obligations, breach notification, deletion or return of data at the end of the engagement, and audit rights.
2. How we choose and govern them
- Necessity. We add a provider only when the product genuinely cannot do the job without one. Convenience is not a reason to widen the list.
- Minimum data. Each receives only the data its function requires. Our AI provider, for instance, receives scenario content and what you wrote inside a simulation, and no profile data whatsoever.
- Due diligence before engagement. We assess security posture, certifications, breach history, sub-processing chain and transfer mechanisms before sending anyone data.
- Purpose locked by contract. No provider may use your data for its own purposes, including improving its own products or training models, with one disclosed exception: Google’s free Gemini service (see below).
- Periodic review. We re-check the list and the agreements behind it at least once a year.
3. The current list
3.1 Core infrastructure
These are load-bearing: RoleCube does not run without them.
| Provider | Function | Personal data it handles | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting and edge network | Everything passing through the application, plus IP addresses, browser details and request times in server logs, kept for no more than 30 days | Application servers: London, United Kingdom (lhr1). Static pages and files are served from Vercel's global edge network, nearest to the visitor |
| Neon Inc. | Serverless PostgreSQL database, and managed authentication built on Better Auth | All stored account, profile, plan, access-code redemption, simulation, report and evaluation data; problem reports you send; records of your analytics choices; how you found us and the partner that referred you, if any; password hashes; sign-in sessions with their IP address and browser; one-time codes; counters of wrong attempts keyed by a one-way scrambled form of an IP address (never the address), deleted within two days | London, United Kingdom (AWS eu-west-2) |
3.2 Feature providers
| Provider | Function | Personal data it handles | Location |
|---|---|---|---|
| Google LLC (Gemini API, free service) | Writes replies from fictional colleagues, and assesses the reasoning in submitted reports against the authored rubric | Scenario content; the messages and meeting questions you type; your report narrative, recommendation and selections; and a summary of what you did in the simulation. Never your name, email address, date of birth, location or account identifier. Under Google’s free-service terms Google may use this content to improve its products and its staff may read it. | United States and other countries where Google operates |
| Resend | Sends our emails: sign-up codes, password reset codes, the welcome email, the confirmation when you report a problem, and internal notes to our team when someone starts signing up, joins or reports a problem | Name, email address, the email itself (for a problem report, what you wrote and the technical details sent with it), and whether it was delivered. No open or click tracking. Delivery records kept for 30 days. | Dublin, Ireland (AWS eu-west-1) |
3.3 Consent-gated
These receive nothing unless you have agreed to analytics.
| Provider | Function | Personal data it handles | Location |
|---|---|---|---|
| PostHog, Inc. | Product analytics | Against a random identifier: pages viewed and actions taken; heatmap positions and session replays with all text, inputs and images masked in the browser (never inside a simulation or on the sign-in pages); page address, browser and device type, the site you arrived from, and non-identifying detail such as which scenario, attempt, fictional colleague, plan, campaign or partner an event relates to, but never an access code. IP addresses are discarded. No name, email address, date of birth, message or report text, or evaluation content. Events kept for no more than 25 months, recordings for no more than 90 days. | European Union (Frankfurt) |
We do not currently use a payment provider, because RoleCube does not take payments.
4. What none of them may do
- use your data for any purpose of their own;
- train or improve a model or product with it (except as disclosed for Google below);
- sell, rent or share it;
- engage a further sub-processor without our authorisation;
- retain it after our engagement ends, beyond a short deletion window or what law requires of them;
- disclose it to anyone except where a valid legal order compels them.
Beyond this list, we disclose personal data only to professional advisers under confidentiality, to a counterparty in a corporate transaction, or where a valid legal order requires it. Those are set out in the Privacy Notice.
5. International transfers
Our servers, database, email and analytics providers are in the United Kingdom and the European Union; our AI provider processes data in the United States and elsewhere. Transfers out of the UAE rely on contractual safeguards requiring the recipient to protect the data to UAE standards. RoleCube is not currently offered in the EEA, the UK or Switzerland, so no transfers of their data are expected; if that changes, this section will be updated first.
The full explanation is in the Privacy Notice. You may request a copy of the safeguards we rely on, with commercially confidential terms redacted.
6. Notice of changes
- This page is dated, and the date changes whenever the list does, so you can tell at a glance whether anything has moved.
- We add a provider to this page before it starts handling personal data, and if it handles your data in a new way, we tell you by email or in the product first.
- Removing a provider needs no notice, but the date still changes.
7. Your choices
The providers in section 3.1 are how the product exists at all, so they cannot be switched off individually. What you can do is decline or withdraw analytics (which means PostHog receives nothing about you), object to processing based on legitimate interests, or delete your account. All of this is covered in the Privacy Notice.
Questions about anyone on this list go to privacy@rolecube.com.