A sub-processor is a company that can touch personal data we hold, on our behalf, in order to make the service work. Article 28 of the UK and EU GDPR requires us to keep this list and to tell you before it changes, and the Data Processing Agreement points at this page rather than restating it, so that it cannot go stale in two places at once.
This list last changed in August 2026.
The list
| Company | What it does | What it can see | Where |
|---|---|---|---|
| Stripe | Payments, subscriptions, invoicing and payment fraud checks | Name, email address, billing address, card details (held by Stripe, never by us), payment history | United States, Ireland |
| Resend | Sending transactional email — provisioning, invoices, alerts, password resets | Name, email address, and the content of the message being sent | United States |
| Cloudflare | DNS for customer subdomains, and network protection | The subdomain chosen and the address it points at; IP addresses in transit | United States, with a global network |
| Backblaze | Off-site encrypted backups of databases | Whatever the backed-up database contains, including your server data | United States |
| Discord | Community support, and delivering the alerts you configure if you point them at Discord | Your Discord identity and whatever you write to us there | United States |
Each of them is engaged under a written contract that is no less protective than the terms we owe you, and we remain responsible to you for what they do with your data. Where a supplier is outside the UK or the EEA, the transfer is covered by Standard Contractual Clauses with the UK Addendum.
Where the machines are
Your account, invoices and audit trail are held on our application server in London, United Kingdom. Your game server is in whichever region you chose when you ordered:
- London, United Kingdom
- Amsterdam, Netherlands
- US East Coast
The datacentres are operated by third-party providers under contract to us. We have not named them here yet, and we would rather leave a gap than print a name we have not confirmed — a sub-processor list is read by regulators, and a wrong entry on it is worse than a missing one. Ask at dpo@ghostnode.gg and we will tell you exactly whose machines your region runs on.
What is deliberately not on this list
No analytics provider, no advertising network, no data broker, no marketing platform, no customer data platform, no session recording, no AI training arrangement. This list is short because the architecture is: personal data is held where it is needed to run the service and nowhere else.
The panel itself, the control layer underneath it and the game servers all run on machines we rent and administer. Nothing about your account or your server is handed to a third party for processing beyond the table above.
Changes, and how you will hear about them
We give at least 30 days' notice before a new sub-processor starts, or before one is replaced, by email to the address on your account. If you object on reasonable data protection grounds within those 30 days we will work with you to find a way round it, and if there is not one, you may terminate the affected service and take a pro-rata refund of the unused period.
To be told about changes without waiting for the email, this page carries the date the list last changed at the top.
Questions
dpo@ghostnode.gg. We will tell you the transfer mechanism, the contract terms or the location for any supplier on this list, and we will answer a security questionnaire if your own compliance work needs one.
GhostNode Ltd is a company registered in England and Wales, company number 17414337. Registered office: 66 Paul Street, London, EC2A 4NA, United Kingdom. General enquiries support@ghostnode.gg; anything about personal data dpo@ghostnode.gg.