Sub-Processors
Last updated: October 3, 2026
Soofte, Inc. (d/b/a “Humalike AI”) uses the providers below for the stated services. When we process Player data on a server owner’s instructions, relevant providers act as sub-processors under the applicable processing arrangement. For our own account, billing and security purposes, we act as a controller. A provider may also have separate controller responsibilities; inclusion here does not classify every activity or mean that all providers receive the same data.
Sub-processor list
This platform-wide list includes service providers and other data recipients. Not every provider receives every customer’s data. For NPC conversations, Deepgram transcribes audio, Google Gemini processes text and ElevenLabs synthesises NPC speech. Anthropic and Parallel.ai are used by other configured features. Payment and support services can process data under their own controller terms.
| Sub-processor | Purpose | Customer data processed | Processing location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting (compute, RDS, S3, SQS, CloudWatch, networking) | All customer data stored or processed by the platform | EU/US |
| AI model inference (Gemini) and business email (Google Workspace) | Text prompts, conversation context, NPC memory and textual game context sent to Gemini; business email and support communications | Global; processing locations depend on the service | |
| Anthropic | AI model inference | Conversation and prompt content sent to models | US |
| Deepgram | Speech-to-text transcription | End-user voice audio and resulting transcripts | EU for opted-out NPC transcription requests |
| ElevenLabs | Text-to-speech synthesis | NPC response text (which may repeat Player information) and voice settings; separate voice-design inputs where used | Service and workspace-dependent; may include the US |
| Parallel.ai | Persona grounding briefs | Persona content submitted for research grounding | US |
| Clerk | Authentication and identity for the customer console | Customer account and session data | US |
| Stripe | Payment processing | Customer billing and payment data | US |
| Resend | Transactional email delivery | Customer contact details and email content | US |
| PostHog | Product analytics | Account, server, NPC and conversation identifiers and product usage metadata | US |
| Vercel | Web and console hosting | Frontend traffic and API route request data | US |
| Better Stack | Monitoring, logging, status page | Service logs that may contain customer request metadata | US (telemetry region) |
| Discord | Customer support conversations | Customer contact details and support message content | US |
| OpenAI (from October 15, 2026) | AI model inference; synthetic data generation and pseudonymisation; support assistance | Conversation and prompt content sent to models; support message content | US |
| OpenRouter (from October 15, 2026) | Routing of model inference requests to model providers | Conversation and prompt content routed to model providers | US |
Locations describe the relevant service or configuration. A regional setting for one service does not determine every provider’s storage, support or onward processing location. Transfers outside the EEA rely on an adequacy decision or the EU Standard Contractual Clauses in each provider’s data processing terms. Contact us for a copy.
NPC provider retention and model use
- Deepgram: published data handling distinguishes request content from usage metadata. Our NPC transcription requests use the EU endpoint with model-improvement opt-out. Audio and transcripts are retained by Deepgram only for request processing; request metadata is available for 90 days, while summarised usage may remain longer.
- Google Gemini: Paid Services terms exclude product-improvement use of prompts and responses under those terms. Abuse monitoring retains relevant content for 55 days and permits restricted review and policy-enforcement model use. Content may be processed in countries where Google or its agents operate. Optional developer logs or dataset sharing are separate controls.
- ElevenLabs: training data use is disabled on our account. Its retention documentation distinguishes generation history, operational logs and backups. Synthesis content, related logs and backups follow the provider’s applicable retention and deletion terms.
Humalike’s application retention does not shorten retention independently applied by a provider. The Privacy Policy describes how requests concerning Player data are handled, including copies held by service providers.
Other recipients
Where AI NPC purchases are available through Tebex Limited, Tebex is the reseller and merchant of record and processes payment data as an independent controller. Its privacy policy applies to that processing. A server owner also receives and controls information through their game server; Players should review the owner’s notice.
Adding or replacing a sub-processor
- We assess a new vendor before engagement: what customer data it will process and its security posture (certifications, data processing terms, transfer mechanism).
- A Data Processing Agreement (or equivalent data processing terms) with the vendor must be in place before any customer data is processed.
- We update this public list at least 10 days before the new sub-processor begins processing customer data. Customers who have subscribed to updates are notified; this notice period is the customer’s opportunity to object under our Data Processing Agreement.
- The notice states the sub-processor’s name, purpose, data processed, and location, and reminds customers of their right under our Data Processing Agreement to object within the notice period by replying to the notice or emailing us.
- Removals and non-material changes (e.g. a vendor rename) are reflected on this list without advance notice.
Changelog
- 2026-10-03 — Updated provider roles, NPC data flows and retention information.
- 2026-10-04 — Added OpenAI and OpenRouter. They begin processing customer data no earlier than 2026-10-15, after the 10-day notice period.
- 2026-08-28 — List reconciled against the deployed codebase. Added Deepgram, ElevenLabs, Parallel.ai, and Vercel; expanded the Google entry to cover Gemini model inference alongside Google Workspace. Removed OpenAI, OpenRouter, and Slack, which are not in use.
- 2026-08-27 — Initial list published.
Subscribe to updates
To be notified before a new sub-processor begins processing customer data, subscribe to sub-processor updates.