Subprocessors
Subprocessor List
This Subprocessor List identifies categories and named providers used to support Odd Latent business services, including OddGameMaker.
Version date: 15 June 2026
Overview
This Subprocessor List forms part of the Agreement between Odd Latent Oy and Customer.
S4.1 Subprocessor Categories
Provider may use subprocessors and third-party services in the following categories:
- Slack workspace, Slack Connect, Slack app, bot, message, file, user, and metadata processing.
- OddGameMaker web app account, project, upload, session, browser, and metadata processing.
- Cloud hosting, web application hosting, compute, deployments, prototype artifact storage, CDN, backup, networking, and security.
- Hosted AI models, multimodal models, image generation, video generation, code generation, media processing, and content moderation.
- Custom minimized/anonymized telemetry, logging, monitoring, observability, and incident response.
- Support, Google Workspace email, billing, accounting, document management, e-signature, and business operations.
S4.2 Named Subprocessors
| Provider | Service category | Processing purpose | Data categories | Processing location | Status |
|---|---|---|---|---|---|
| Slack Technologies / Salesforce group companies | Slack workspace, Slack Connect, app, bot, messages, files, user and metadata processing | Customer interface, bot interaction, Slack Connect channel communications, file exchange, notifications, support | Slack user data, workspace/channel metadata, messages, files, commands, interactions, tokens or app metadata | Global (including USA and EU/EEA), per Slack terms and workspace configuration. | Current |
| Vercel Inc. | Hosting, compute, deployments, logs, custom telemetry | Backend systems, workers, service operation, OddGameMaker web app hosting, prototype deployment hosting, custom telemetry | Customer Content and Outputs processed to provide the Service, generated prototypes, logs, metadata, anonymized/minimized telemetry, OddGameMaker account, session, and project data | Global (including USA and EU/EEA), per Vercel configuration and terms. | Current |
| GitHub, Inc. | Prototype/project artifact storage and development operations | Store and manage generated prototype code/assets, OddGameMaker project artifacts where used, and customer-uploaded assets used in those prototypes | Generated prototype files, generated assets, customer-uploaded assets used in prototypes, project metadata | Global (including USA and EU/EEA), per GitHub terms. | Current |
| Cloudflare, Inc. | CDN, networking, and security | Deliver website, OddGameMaker, prototype, and service assets and support service security/performance | Cached or delivered files/assets/outputs, metadata, network/security logs where used | Global CDN (including EU/EEA and USA), per Cloudflare configuration and terms. | Current |
| OpenAI, L.L.C. | Hosted AI model processing | Text, multimodal, code, analysis, generation, transformation, moderation, and tool workflows where used. Account settings disable provider training on customer data when applicable. | Prompts, files, instructions, outputs, metadata | Global (including USA), per OpenAI API terms and settings. | Current |
| Anthropic, PBC | Hosted AI model processing | Text, code, analysis, generation, transformation, and tool workflows where used. Account settings disable provider training on customer data when applicable. | Prompts, files, instructions, outputs, metadata | Global (including USA), per Anthropic API terms and settings. | Current |
| Google LLC / Google AI services | Hosted AI model processing | Text, multimodal, image/video/audio-related processing, embeddings, search/ranking, or other model workflows where used. Account settings disable provider training on customer data when applicable. | Prompts, files, instructions, outputs, metadata | Global (including EU/EEA and USA), per Google API terms and settings. | Current |
| Replicate, Inc. | Hosted model API and media generation | Run third-party models for image, video, audio, transformation, or other generation workflows where used. Account settings disable provider training on customer data when applicable. | Prompts, input files, image/video/audio inputs, outputs, metadata | Global (including USA), per Replicate terms and settings. | Current |
| Stability AI Ltd. / Stability AI services | Image generation and media processing | Create or transform images and creative assets. Account settings disable provider training on customer data when applicable. | Prompts, image inputs, outputs, metadata | Global (including USA and EU/EEA), per Stability API terms and settings. | Current |
| ElevenLabs, Inc. | Audio/voice generation and processing | Generate or process audio/voice assets where used. Account settings disable provider training on customer data when applicable. | Prompts, scripts/text, audio inputs/outputs, voice metadata | Global (including USA and EU/EEA), per ElevenLabs terms. | Current |
| Google LLC / Gmail / Google Workspace | Email and customer communications | Support, onboarding, notices, customer communications | Contact details, email messages, attachments, support context, account metadata | Global (including EU/EEA and USA), per Google Workspace/Gmail terms. | Current |
| Procountor | Billing, accounting, and e-signature | Invoice-only billing, billing records, accounting records, contract signature and signed document storage | Billing contacts, invoices, payment status, tax/accounting data, contract content, signature metadata | EU/EEA (primarily Finland), per Procountor terms. | Current |
S4.3 Third-Party Services That May Not Be Processors
Some third-party services may act as independent controllers, independent service providers, or customer-selected services depending on configuration and legal role.
| Provider | Role | Notes |
|---|---|---|
| Slack / Salesforce group companies | Subprocessor / independent service provider | Pilot access is through Slack Connect into an Odd Latent Slack channel. Slack acts as Provider's subprocessor for Provider-controlled Slack processing. Customer controls its own workspace-side Slack processing, users, retention, permissions, exports, and Slack Connect participation. |
| Customer's Slack workspace providers and administrators | Customer-controlled service | Customer controls its own Slack workspace, users, retention, permissions, exports, and Slack Connect participation. |
| Procountor | Processor / independent controller | Procountor supports invoice-only billing, accounting, contract signature, and signed document storage. It acts as a processor for services performed for Provider and as an independent controller where it handles statutory accounting, payment, or compliance records under its own obligations. |
| Customer-selected storage, publishing, or connected web services | Customer-controlled service | Applies if Customer exports Outputs, publishes projects, or connects external services through Slack, OddGameMaker, or another Service interface. |
S4.4 Subprocessor Updates
Provider may update this list to add, replace, or remove subprocessors as the Service evolves.
Where required by Schedule 1 - Data Processing Addendum, Provider will notify Customer of new or replacement subprocessors that materially affect personal data processing risk and give Customer an opportunity to object on reasonable data protection grounds.
S4.5 Retention and Deletion
For pilots delivered through Slack, Provider intends to remove the client Slack Connect channel in Provider's Slack workspace no later than six months after the pilot ends, unless retention is required or permitted for legal, accounting, compliance, security, backup, archival, dispute-resolution, or abuse-prevention purposes. For pilots or services delivered through OddGameMaker, Provider handles account, project, upload, output, and metadata retention according to the Agreement, available service settings, support processes, and applicable law.
Billing, accounting, signature, and legal records may be retained for longer periods where required or permitted by law or ordinary business recordkeeping requirements.
Provider-specific retention, deletion, processing location, and training settings are subject to the applicable provider terms, account settings, and technical capabilities. Provider will use available account settings to disable provider training on Customer Content where applicable and will not use Customer Content to train general-purpose AI models unless Customer expressly agrees in writing, as stated in these Terms.