Draft — subject to legal review
This document is a working draft prepared for review by qualified counsel. It is not legal advice, it is not yet in force, and it may change materially before publication. Bracketed text marks information that has not been confirmed yet.
Codexx Nepal Pvt. Ltd. ("Afterparty") uses the third parties below to process personal data on behalf of operators under the Data Processing Agreement. This page is Annex 3 of the Data Processing Agreement.
The hosted Service runs in the AWS US East (N. Virginia) region (us-east-1), United States. Some sub-processors are used only when an operator enables the related feature; this is indicated in the "When used" column. Where a sub-processor receives personal data transferred from the European Economic Area, the United Kingdom or Switzerland, the transfer is covered by the Standard Contractual Clauses (and the UK Addendum or Swiss amendments) included in that provider's data processing terms.
Infrastructure and Core Service
| Sub-processor | Purpose | Personal data processed | Location | When used | Transfer safeguard |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Hosting of application servers; managed PostgreSQL database (Amazon RDS) and Redis cache and queues (Amazon ElastiCache); object storage and backups (Amazon S3); logs, metrics and application error diagnostics (Amazon CloudWatch); secrets and encryption keys (AWS Secrets Manager, AWS Key Management Service) | All data processed in the Service, including technical data and user or player identifiers contained in logs and error context | United States (us-east-1) | Always | SCCs in the AWS Data Processing Addendum |
Application errors and diagnostics are recorded in Amazon CloudWatch within the same AWS account and region. Afterparty does not use a separate error-monitoring or analytics provider.
Messaging
| Sub-processor | Purpose | Personal data processed | Location | When used | Transfer safeguard |
|---|---|---|---|---|---|
| Twilio Inc. (Twilio SendGrid) | Delivery of journey, campaign and transactional email, and delivery, bounce, spam-report and unsubscribe events | Recipient email address, message content, delivery and engagement events | United States | When email messaging is enabled and the operator uses Afterparty's sending account | SCCs in the Twilio Data Protection Addendum |
| Twilio Inc. (Programmable Messaging) | Delivery of SMS messages | Recipient phone number, message content, delivery status, opt-out keywords | United States | When SMS messaging is enabled and the operator uses Afterparty's Twilio account | SCCs in the Twilio Data Protection Addendum |
| Delivyr, LLC (a division of EES Global, LLC) | Delivery of SMS and MMS messages to recipients in the United States and Canada, including carrier registration and content compliance screening | Recipient phone number, message content, delivery status, opt-out keywords | United States | When SMS messaging is enabled and the operator uses Afterparty's Delivyr account | Used only for recipients in the United States and Canada; SCCs in Delivyr's data processing terms if EEA, UK or Swiss personal data is involved |
| Google LLC (Firebase Cloud Messaging) | Relay of push notifications to Android and web devices | Push device token, notification content | United States | When push relay to Android or web is enabled | SCCs in Google's data processing terms |
| Apple Inc. (Apple Push Notification service) | Relay of push notifications to Apple devices | Push device token, notification content | United States | When push relay to Apple devices is enabled | Apple's developer data processing terms, including SCCs where applicable |
| 650 Industries, Inc. (Expo) | Relay of push notifications for Expo-based apps | Push device token, notification content | United States | When the operator's app uses Expo push | SCCs in Expo's data processing terms |
Twilio Inc. is a single sub-processor; it appears twice because Afterparty uses two of its services.
AI Features
| Sub-processor | Purpose | Personal data processed | Location | When used | Transfer safeguard |
|---|---|---|---|---|---|
| Anthropic, PBC | Large language model inference for AI agents, drafting and AI scores | Prompts and context, which may include pseudonymous player data and aggregated metrics | United States | When AI Features are enabled; the default AI provider of the hosted Service | SCCs in Anthropic's data processing addendum; no training on customer data; inputs and outputs retained only for a limited period for trust-and-safety and legal purposes under Anthropic's commercial terms |
| OpenAI, L.L.C. | Large language model inference for AI agents, drafting and AI scores | Prompts and context, which may include pseudonymous player data and aggregated metrics | United States | Only when the operator selects this provider for its tenant | SCCs in OpenAI's data processing addendum; no training on customer data; inputs and outputs retained only for a limited period for abuse monitoring and legal purposes under OpenAI's business terms |
Operators can disable AI Features for their tenant, in which case no data is sent to these providers.
Not Sub-processors
Services that an operator connects under its own contract, such as its own Twilio, SendGrid, Delivyr, email, push, wallet, payment or data-warehouse accounts, are engaged directly by the operator and are not Afterparty sub-processors. Afterparty does not use a payment processor for player funds, because Afterparty never holds or transmits player funds.
Changes and Notifications
We will update this page at least 30 days before a new sub-processor begins processing personal data, as described in Section 7 of the Data Processing Agreement. To receive email notifications of changes, write to privacy@afterparty.example.com from an address authorised by your organisation.