Subprocessors for STATIQ
Version 1.1 · Effective from: 2026-10-14 · Owner: JIWA HOLDING AS · Updated before every supplier change
| Supplier | Service | Data | Region | Transfer basis |
|---|---|---|---|---|
| Supabase Inc. | Postgres, Auth, private object storage (reports) | account, workspace, minimized roster, log, reports | EU (eu-north-1, Stockholm) | DPA; EU storage |
| Cloudflare, Inc. | hosting the web app, API and jobs (Workers/Queues) | requests in transit, logs (redacted), job messages (IDs) | global network, EU data where possible | DPA + EU SCC / DPF |
| Apple Inc. | App Store, subscription, App Store Server Notifications | transaction ID, product, app account token (workspace ID) | USA/global | Apple's developer terms, DPF |
| Stripe, Inc. | web payments, customer portal | customer and subscription IDs, payment method (held only by Stripe) | EU/USA | DPA + SCC / DPF |
| GitHub, Inc. | source code, CI (no production data) | no personal data | USA | n/a |
| Resend (Plus Five Five, Inc.) | account emails from Supabase Auth and quote requests | recipient address, message content, action links, delivery metadata and quote details | Ireland (sending); United States (storage and other processing) | Standard DPA in existing agreement; DPF active, re-certification under review (8 October 2026) |
| one.com | Receipt and storage of contact, support and privacy enquiries | sender/recipient addresses, message content and delivery metadata | Denmark (hosting/backups); possible processing in India, see below | Standard DPA in JIWA’s agreement; scope and safeguards for processing in India to be clarified |
| Google (Google Analytics) | Consent-based public homepage analytics | cookie identifiers, page views, browser/device and network information | International processing, including outside the EEA | Google data processing terms and applicable transfer safeguards; account-specific contractual basis must be confirmed |
Google Analytics is used only for optional analysis of the public homepage. We use no advertising or email marketing suppliers. Changes to the list are notified in the app at least 30 days before taking effect where processing is expanded.
Account emails
Supabase Auth sends essential account emails through Resend: invitations, registration confirmation, password recovery and email change confirmation. Resend processes the recipient address, message content with an action link and delivery metadata. The account password is not sent in the email. Do not share the action link with others.
Quote requests
The contact’s name, business email, organization and country, plus optional phone number, team/user/game counts and message, are used to respond to the request and prepare a quote. The quote feature sends this information through Resend to contact@statiqsport.com, an alias for JIWA’s regular mailbox at one.com. A request does not subscribe you to marketing and is not stored in the app database. Retention in the mailbox and by email providers must be manually limited to the purpose and any legally required retention.
Resend (Plus Five Five, Inc.) uses Ireland as its sending region but stores message content and delivery logs in the United States, as described in Resend’s privacy information. The standard data processing agreement applies to the existing account through the service terms. The transfer to Resend relies on the EU-U.S. Data Privacy Framework (DPF). The DPF register showed active status with re-certification under review on 8 October 2026. The sending region does not mean EU storage.
one.com’s standard data processing agreement forms part of JIWA HOLDING AS’s existing agreement. one.com lists Danish data centres and backups for hosting, and system monitoring in Denmark and India. The agreement requires transfer safeguards, such as standard contractual clauses (SCC), for subprocessors outside the EEA. The scope of processing in India for this email plan is not yet confirmed; the service is therefore not described as limited to the EEA. This concerns the mailbox for contact, support and privacy enquiries.
Google Analytics on the public homepage
Only the homepage uses Google Analytics after an active choice. Google does not receive STATIQ account, game or player data through this tag. Google’s data processing terms describe terms and transfer safeguards. Google’s European data information describes regional collection before further processing; this does not guarantee EEA-only storage. Applicable acceptance of terms, transfer basis and the property’s retention period are provider settings requiring separate confirmation. The website integration does not verify these settings.