Subprocessors

Last updated 2026-09-09 (version 1.1). We list a provider only after confirming it is actually used in production.

Lovable / Lovable Cloud

Purpose: application hosting, database, authentication, file storage and server functions for ThatPlay.

Data: account data, analysis data and technical logs described in the Privacy Policy.

Location and transfer mechanism: being confirmed with the provider; see the note below.

Provider information: lovable.dev

Google (Sign in with Google)

Purpose: optional federated sign-in. Used only if you choose to sign in with Google.

Data: authentication identifiers and the profile data Google returns for sign-in.

Provider information: policies.google.com/privacy

YouTube / Google (embedded reference videos)

Not a subprocessor of your ThatPlay data. When you add a YouTube reference video, the video is loaded from YouTube in privacy-enhanced mode and your device communicates directly with Google. ThatPlay stores only the reference metadata.

Not currently used

• Email marketing provider — none connected.
• Third-party analytics — none. Optional first-party product analytics, when enabled, is stored with the same ThatPlay Cloud provider described above; no separate analytics provider or analytics SDK is used. Device-local feature counters stay in the browser.
• Third-party error monitoring — platform-level error reporting only, provided as part of the hosting platform.

Pending verification

Hosting region, sub-infrastructure providers and the applicable international transfer mechanism for Lovable Cloud are being confirmed with the provider. We publish them here once verified rather than stating something unverified.