Every service that can touch personal data, with what it does and where it sits.
Last updated: 2026-07-26
| Service | What it does | Where it sits | State |
|---|---|---|---|
| Web font delivery | Serves the page fonts to your browser. Your IP address is visible to it, the way it is to any service your browser fetches from. | Outside our sovereign estate. | Live on this website. Being replaced by self hosted fonts. |
| Sovereign hosting | Runs the API and stores operator configuration and logs. | Sovereign, non US. The exact jurisdiction goes to your DPO. | Live. |
| Sovereign transactional email | Sends account and service email to operator staff. | Sovereign, non US. The exact jurisdiction goes to your DPO. | Live. |
Our privacy policy promises a subprocessor list, and this is it. Each row names a service that can touch personal data, what it does, and where it sits.
Naming a hosting jurisdiction in public tells anyone who wants to pressure a supplier exactly where to aim. Your Data Protection Officer receives the full pack under the agreement, with legal entity names, jurisdictions, and the data processing agreement for each one. Write to dpo@mgrator.com and we send it.
A new subprocessor appears here within 30 days of going live, and named customers receive notice in advance so there is time to object.
The web font row above sits outside the sovereign estate today. It affects visitors to this marketing website only, and it touches no operator or player data. Self hosted fonts remove it.