Legal and trust
Subprocessors and Payment Partners
Third-party providers that may process information for One Realm, including Sold through Link, LLC as merchant of record and Stripe as an independent controller.
Last updated: May 25, 2026Independent Payment Partner
| Provider | Role | Data Processed |
|---|---|---|
| Sold through Link, LLC / Stripe Managed Payments | Merchant of record for eligible purchases: payment processing, applicable indirect taxes, fraud prevention, disputes, transaction-level support, and order management. | Contact information; billing, tax, payment method, subscription, and order information; device and browser information; and fraud, dispute, refund, and support data. |
Sold through Link, LLC provides the merchant-of-record service. Stripe is the controller of personal data collected for Link and processes it for its own payment, tax, fraud prevention, order management, transaction support, and related service purposes rather than solely as a One Realm subprocessor. One Realm remains responsible for the product and product-level support.
For more information, see the Link Privacy Policy and Stripe Privacy Center.
Subprocessors
| Provider | Purpose | Data Processed |
|---|---|---|
| Firebase / Google | Authentication, email verification, session identity, Firebase user profile data. | Email, display name, profile photo, Firebase UID, auth metadata. |
| Configured object storage provider | File and asset storage. | Uploaded PDFs, generated images, map assets, user assets, extracted artifacts. |
| OpenAI | Chat, image generation, AI-assisted extraction, vision, map/placement processing, and related AI features. | Prompts, chat messages, campaign context, images, generated assets, extracted text, map data, relevant source content. |
| Mistral AI | OCR and PDF/source extraction. | Uploaded PDF pages, rendered pages, OCR inputs/outputs, extracted source text. |
| DeepSeek | Optional LLM provider for extraction analysis if enabled. | Extracted text, prompts, candidate data, campaign source context. |
| PostHog | Product analytics, cookieless public-website analytics, backend event capture, AI usage metrics, exception diagnostics, frontend analytics, autocapture, and session recording if enabled. | Product events, user identifiers, browser metadata, page paths, interaction data, AI assistant prompts, replies and tool calls with model, token, cost and latency metrics, exception data, session replay data if enabled. |
| Vercel | Public website and application frontend hosting. | Requests and hosting logs. |
| Hosting provider | Application hosting, networking, logs, runtime infrastructure. | Requests, logs, IP-derived metadata, app data in transit. |
| Database provider | PostgreSQL hosting. | Account, campaign, character, VTT, chat, extraction, credit, and subscription records. |
| Email provider | Product, support, account, or transactional email beyond Firebase auth emails. | Email address, message metadata, support content. |
AI Provider Notes
AI and OCR providers may process user content only to provide requested features. Where available, One Realm prefers provider settings that limit training use and retention.
- AI providers may vary by feature and deployment.
- Optional providers process data only when their related features are enabled or requested.
- Provider regions, retention, and training-use settings may vary by provider policy and account configuration.
Changes to Providers
One Realm may update this page when subprocessors or payment-partner roles are added, removed, or changed. For material changes, One Realm will provide reasonable notice through the app, email, or this page.
Contact
Provider and payment-partner questions: privacy@one-realm.com.