Version 1.1, Effective 2026-11-06

Reeplayer, Inc. (“Reeplayer,” “we,” “us,” or “our”) is a Delaware corporation with its principal place of business at 4213 Jackson Avenue, Culver City, California 90232, USA. Our Privacy Policy promises that every vendor that processes personal data on our behalf operates under a written data processing agreement, that we maintain a published list of our sub-processors, and that we apply extra care to data relating to minors. This document is how we keep that promise, and Section B.14 names each place where a sub-processor’s current terms, or the lack of a signed agreement, do not yet meet it. It has two parts.

Part A is the Sub-processor List: the categories of outside vendors (sub-processors) we use to provide Reeplayer, what each category does, and what categories of data it touches. Part B is the Data Processing Addendum: the commitments that bind every sub-processor in Part A, whatever the category.

This document is consistent with, and should be read together with, our Privacy Policy (in particular Section 5 on biometric information, Section 6 on AI and machine learning, and Section 8 on how we share information) and our Terms of Service. Capitalized terms we do not define here have the meaning given in the Privacy Policy and the Terms of Service. “Personal data” and “personal information” are used interchangeably and have the broad meaning the applicable privacy law gives them.

This is Version 1.1, Effective 2026-11-06. We may update it as described in Section A.3.

Part A. Sub-processor List

A.1 What a sub-processor is, and why we use them

A sub-processor is an outside company that processes personal data on our behalf to help us provide Reeplayer. We use sub-processors for things we do not run entirely ourselves, such as hosting and storing footage, delivering video, running live streams, running AI and computer-vision processing, checking the age and identity of a user who streams from a phone or other device that is not a Reeplayer camera (a phone stream), measuring usage, supporting customers, sending email, and taking payments. Using sub-processors is normal and necessary to run a modern service. It does not change our promises to you. Every sub-processor is bound by the commitments in Part B, except where Section B.14 names a gap in a sub-processor’s current terms or a missing signed agreement, and we remain responsible to you for the personal data we entrust to them.

The list below describes the categories of sub-processors we use, and for each category the purpose, the categories of data involved, the specific vendor, and the region where it processes data. The Region column gives each vendor’s main processing location; a vendor’s own sub-processors may process data in other countries, as Privacy Policy Section 13 describes. We keep this list current, and we may add or change a category or vendor as described in Section A.3.

A.2 The categories of sub-processors we use

Category: Cloud hosting and storage
What it does (purpose): Hosts and stores Reeplayer’s systems and your footage, runs our application and database infrastructure, and keeps backups.
Categories of data it may process: Footage (video and audio), performance and game statistics, account and profile information, device and camera data, usage and analytics data, approximate location or region, and support communications. May include personal data of account holders, minors as filmed subjects, and bystanders.
Named vendor: Amazon Web Services (AWS) and Google Cloud Platform
Region: United States

Category: Content delivery
What it does (purpose): Delivers and streams footage, clips, and highlights to viewers reliably and quickly, including caching content closer to viewers.
Categories of data it may process: Footage (video and audio), clips and highlights, device and connection data, IP address, and approximate location or region.
Named vendor: Amazon Web Services (AWS) and Google Cloud Platform
Region: United States

Category: Video hosting and delivery
What it does (purpose): Hosts recordings from Reeplayer cameras, clips, and highlights and delivers them to viewers.
Categories of data it may process: Footage (video and audio), clips and highlights, and device and connection data. May include minors as filmed subjects and bystanders.
Named vendor: Mux
Region: United States

Category: AI and computer-vision processing
What it does (purpose): Helps run and improve the AI and computer-vision features that detect plays, track the ball and action, cut clips and highlights, and compute statistics.
Categories of data it may process: Footage (video and audio), performance and game statistics, and derived tracking data. May include footage of minors as filmed subjects. Identity stays on jersey number, roster, and account, never on a learned face.
Named vendor: Amazon Web Services (AWS) and Google Cloud Platform
Region: United States

Category: Analytics
What it does (purpose): Measures how the app and website are used and how the service performs, so we can fix problems and improve Reeplayer.
Categories of data it may process: App and website usage and analytics data, account identifiers, email address, device identifiers, IP address, approximate location or region, and diagnostic and crash data.
Named vendor: PostHog and Google
Region: United States

Category: Website hosting and analytics
What it does (purpose): Hosts reeplayer.com, serves its pages, and measures visits to it.
Categories of data it may process: IP address, device and browser information, pages viewed, and visit data.
Named vendor: Framer
Region: United States, with hosting infrastructure in Europe and Asia-Pacific

Category: Referral tracking
What it does (purpose): Records which referral or partner link brought a visitor to reeplayer.com and whether the visit led to a purchase.
Categories of data it may process: A referral cookie and identifier, IP address, device and browser information, pages viewed, and purchase attribution.
Named vendor: Dub
Region: United States

Category: Logging and monitoring
What it does (purpose): Receives app and server logs so we can find and fix problems.
Categories of data it may process: Account and device identifiers, app and device versions, diagnostic data, and the request web addresses and request contents the app logs, which can include search text, location coordinates used to find nearby teams, and sign-up details. These logs are kept for a limited time.
Named vendor: Better Stack, and Datadog for camera logs
Region: Better Stack: the European Union (Germany) and the United States. Datadog: United States

Category: Error tracking
What it does (purpose): Receives error reports and performance traces from our servers, our website, and Reeplayer cameras so we can find and fix faults and measure performance.
Categories of data it may process: Account and device identifiers, IP address, the web address and details of a request that failed or that we trace to measure performance, which can include location coordinates used to find nearby teams, and diagnostic data. These reports are kept for a limited time.
Named vendor: Sentry
Region: United States and the European Union

Category: Customer support
What it does (purpose): Runs our support tools so we can answer questions, resolve issues, and handle privacy and rights requests.
Categories of data it may process: Account and profile information, support communications, and the details a person includes when they contact us, including a parent or guardian acting for a child.
Named vendor: Google and Intercom
Region: United States

Category: Communications and email
What it does (purpose): Sends service messages, account and transactional emails, and, where permitted, marketing about Reeplayer, sends push notifications to your device, and handles related messaging.
Categories of data it may process: Account and profile information, email address, contact details, push notification tokens, and message content and engagement data.
Named vendor: Google (including Firebase Cloud Messaging for push notifications), Intercom and Postmark
Region: United States

Category: Email outreach
What it does (purpose): Sends follow-up emails to a person who started a checkout on reeplayer.com and did not finish it, and sends business outreach emails to contacts at clubs, teams and brands.
Categories of data it may process: Name, email address, checkout details, message engagement data, and, for business outreach, job title and organization.
Named vendor: Instantly
Region: United States

Category: Text messages
What it does (purpose): Sends sign-in codes by text message.
Categories of data it may process: Phone number and message content.
Named vendor: Twilio
Region: United States

Category: Internal team messaging
What it does (purpose): Carries internal notices to our team about new orders.
Categories of data it may process: Buyer name, email address, phone number, and order details.
Named vendor: Slack
Region: United States

Category: Location lookup
What it does (purpose): Estimates your general area from your IP address when you search for a location for an event or a team.
Categories of data it may process: IP address and the general area derived from it.
Named vendor: ip-api.com and freeipapi.com
Region: ip-api.com: servers in several countries. freeipapi.com: company in Germany; it does not publish its server locations

Category: Deep links
What it does (purpose): Opens shared links in the right place in the app and counts link opens, and builds the sign-in links we email to you.
Categories of data it may process: Device identifiers, IP address, link and app-open data, the one-time sign-in codes carried in sign-in links, and the preview details of a shared link or invitation: the sharer’s name and username; the name, username and photo of a shared profile; the identifier, title, date, time and image of a shared event or clip; the identifier, video time point and author’s name of a shared comment; the name, handle and image of a shared team; and, for camera invitations and plan renewal links, the camera’s name and serial number.
Named vendor: Branch
Region: United States

Category: Payment processing
What it does (purpose): Processes payments for subscriptions, hardware, and advertising and handles billing.
Categories of data it may process: Billing contact details, limited payment information (such as the last digits and type of card and confirmation of payment), and purchase records. We do not store full payment card numbers ourselves.
Named vendor: Stripe
Region: United States

Category: Subscriptions and in-app purchases
What it does (purpose): Manages subscriptions and in-app purchases made through the Apple App Store and Google Play and confirms what a user has bought.
Categories of data it may process: Account identifiers, name, username, email address, and purchase and subscription records.
Named vendor: RevenueCat
Region: United States

Category: Live streaming
What it does (purpose): Receives live streams from Reeplayer cameras and phone streams, prepares them for playback, delivers them to viewers, and writes the recording of each stream to storage for later playback.
Categories of data it may process: Footage of live streams and their recordings (video and audio), stream and device identifiers, connection data, and IP address. May include personal data of the person streaming, minors as filmed subjects, and bystanders.
Named vendor: Streamline Digital Holdings, LLC (Native Frame)
Region: United States

Category: Identity and age verification
What it does (purpose): Checks that a user who wants to start a phone stream is a real person who matches a genuine identity document, reads the date of birth on that document, and helps prevent fraud on that check. When we ask a user to confirm their age or identity, as our Terms of Service allow, the check runs before the user’s first phone stream, and again only if the user withdraws consent or a check must be repeated; never on every stream. It never runs on footage, on viewers, or on anyone other than the user who chooses to take it.
Categories of data it may process: Images of the front and back of the identity document; a selfie and a short video of the session, which may include audio; the information read from the document, such as name, date of birth, and document number; the face data derived from the selfie and the document photo to compare them, which is biometric information; the result of the check; and device and connection data, including IP address. Only users who choose to take the check before a phone stream.
Named vendor: Veriff
Region: Storage in the EEA (Ireland); processing in the EEA, the United Kingdom, the United States, and Brazil; human review support in India (see the note below)

Veriff’s own sub-processors. Veriff uses further sub-processors of its own, which it lists at https://help.veriff.com/s/article/Sub-processors-used-by-Veriff. Its list dated September 24, 2026 names, among others, Amazon Web Services EMEA SARL and Google Cloud EMEA for storage and computing in the EEA; EXLService (Ireland) Limited, which provides review support for verifications, with processing primarily in India, so a person working for that company may see a streamer’s identity document and selfie when a check goes to human review; and Hotjar Limited, which helps Veriff fix bugs and may also process data in the United States. Veriff’s own list is the current one and may change.

Google website tags. Google tags on reeplayer.com that also send visit data for advertising, as Privacy Policy Section 8 item 8 describes, act as third parties for that website data and not as our sub-processor, and Sections B.1 to B.3 do not apply to that data.

PostHog on reeplayer.com. At our instruction, PostHog also sends website visit data to Reddit, through the Reddit Pixel, which PostHog loads in the visitor’s browser, and the Reddit Conversions API, which PostHog’s servers call, so that we can measure our advertising, as Privacy Policy Section 8 item 8 describes. Reddit receives that data as a third party and not as our sub-processor, and Sections B.1 to B.3 do not apply to Reddit for that data.

Google Places. When you search for a location for an event or a team, the app sends Google’s Places service either your general area or the text you type. Google receives that data under the Google Maps Platform Terms of Service and Google’s Controller-Controller Data Protection Terms, as an independent controller and not as our sub-processor, and Sections B.1 to B.3 do not apply to Google for that data.

Shipping carriers. When hardware travels between you and us, for a delivery, a return, the return of a leased camera, a camera you sell back to us, or a warranty claim, including on a prepaid label we send you, the shipping carrier receives your name, your address, and the details on the label. The carrier receives that data under its own terms, as an independent controller and not as our sub-processor, and Sections B.1 to B.3 do not apply to the carrier for that data.

A.3 We maintain this list and give notice of new sub-processors

We maintain this Sub-processor List and keep it current. When we add a new sub-processor, or change one in a way that materially affects the personal data it processes, we update this list and its version and effective date, and we give any further notice that applicable law or an agreement we have with you requires. An update to this list does not change our Terms of Service or Privacy Policy, and you do not need to accept them again because of it. Where we provide a way to subscribe to changes to this list, you can use it to receive notice. We apply extra care to data relating to minors when we select, engage, and oversee sub-processors. Nothing in this list is a representation that we use every category at all times; we use the categories needed to provide the service.

Part B. Data Processing Addendum

This Part B sets out the commitments that bind each sub-processor in Part A. We require these commitments from every sub-processor through a written data processing agreement as the condition of handling personal data on our behalf, and Section B.14 names each place where a sub-processor’s current terms do not yet meet them or no signed agreement is yet in place. We refer to a sub-processor here as the “Processor” and to Reeplayer as the “Controller,” using the meanings the applicable privacy law gives those terms. These commitments are the baseline; a given agreement may add more, but it may not fall below this baseline except where Section B.14 says so.

B.1 Process only on Reeplayer’s instructions, and only to provide the service

The Processor processes personal data only to provide its services to Reeplayer, and only on Reeplayer’s documented instructions, including with respect to transfers of personal data, unless a law the Processor is subject to requires otherwise, in which case the Processor informs Reeplayer of that legal requirement before processing, unless the law prohibits that notice on important grounds of public interest. The Processor does not process the personal data for any other purpose. Section B.14 names the current exceptions.

B.2 No reuse for the Processor’s own purposes

The Processor does not use, retain, disclose, or otherwise process the personal data for its own purposes or for the benefit of anyone other than Reeplayer. The Processor does not sell the personal data, does not “share” it for cross-context behavioral advertising, and does not combine it with personal data the Processor receives from or on behalf of others, or collects on its own, except as permitted by the applicable privacy law to provide the service to Reeplayer. The Processor is prohibited from the activities the CCPA and CPRA prohibit for a service provider or contractor with respect to the personal data. Section B.14 names the current exceptions.

B.3 No training of the Processor’s own models

The Processor does not use the personal data to train, develop, fine-tune, or improve its own artificial intelligence or machine-learning models, or any model offered to anyone other than Reeplayer. This limit applies to footage and to all other personal data. It restates, at the sub-processor level, the line drawn in Sections 6 and 8 of our Privacy Policy: an outside service may process the data to provide its services to Reeplayer, but it may not turn that data into its own model or product. Section B.14 names the current exceptions, including Veriff’s use of identity-verification data, which our Privacy Policy also names.

B.4 Confidentiality

The Processor keeps the personal data confidential and ensures that the people it authorizes to process the data are bound by an appropriate duty of confidentiality, whether by contract or by a statutory duty, and process the data only as needed to perform their work for Reeplayer.

B.5 Security: appropriate technical and organizational measures

The Processor implements and maintains appropriate technical and organizational measures to protect the personal data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure, taking into account the nature of the data and the risks of the processing. These measures include, as appropriate, access controls, encryption in transit, segregation of data, logging and monitoring, secure development and configuration, personnel security, and regular testing and review of the measures. The Processor applies extra care to the measures that protect data relating to minors.

B.6 Assistance with data-subject requests

The Processor assists Reeplayer, by appropriate technical and organizational measures and taking into account the nature of the processing, in responding to requests from individuals to exercise their rights under the applicable privacy law, such as the rights to access, correct, delete, restrict, port, or object. If an individual sends a rights request directly to the Processor, the Processor does not respond on its own (except to confirm the request relates to Reeplayer) and promptly forwards the request to Reeplayer.

B.7 Assistance with security, breach, and impact-assessment obligations

The Processor assists Reeplayer in meeting Reeplayer’s own obligations relating to security of processing, notification of personal-data breaches to regulators and affected individuals, data protection impact assessments, and prior consultation with a supervisory authority, in each case taking into account the nature of the processing and the information available to the Processor. The Processor makes available to Reeplayer the information reasonably necessary to demonstrate compliance with these commitments and allows for and contributes to audits or inspections that Reeplayer or its authorized auditor reasonably conducts, on reasonable notice and subject to confidentiality.

B.8 Breach notification without undue delay

The Processor notifies Reeplayer without undue delay after becoming aware of a personal-data breach affecting the personal data, and in any event in time for Reeplayer to meet its own notification deadlines. The notice includes the information reasonably available to the Processor about the breach, including its nature, the categories and approximate number of individuals and records affected to the extent known, the likely consequences, and the measures taken or proposed to address it and to mitigate harm. The Processor applies extra care, and treats the matter with added urgency, where a breach could affect data relating to minors.

B.9 Deletion or return on termination

On termination or expiry of its services to Reeplayer, the Processor, at Reeplayer’s choice, deletes or returns the personal data it processes on Reeplayer’s behalf and deletes existing copies, unless a law the Processor is subject to requires it to keep the data, in which case the Processor keeps it only as long and only to the extent that law requires and continues to protect it under these commitments.

B.10 Engaging further sub-processors only under equivalent terms, with notice

The Processor does not engage another sub-processor to process the personal data without prior authorization from Reeplayer, which may be specific or general. Where Reeplayer gives general authorization, the Processor informs Reeplayer of any intended addition or replacement of a further sub-processor in time for Reeplayer to object. When the Processor engages a further sub-processor, it does so under a written agreement that imposes data-protection commitments at least equivalent to those in this Part B, and the Processor remains fully responsible to Reeplayer for that further sub-processor’s performance.

B.11 Extra care for data relating to minors

Reeplayer is used to record and stream youth sports, so much of the personal data relates to children, including children who appear only as filmed subjects and never held an account. The Processor applies extra care to data relating to minors across every commitment in this Part B, including by limiting access to that data to those who need it, applying heightened security to it, treating any breach that may affect it with added urgency, and assisting Reeplayer with its obligations to children and their parents and guardians under laws such as the Children’s Online Privacy Protection Act. The Processor does not use data relating to a minor for any purpose other than providing its services to Reeplayer, and the prohibition on training the Processor’s own models in Section B.3 applies with particular force to data relating to minors.

B.12 International transfers

Where the personal data is transferred from the EEA, the United Kingdom, or another region whose law restricts cross-border transfers, the Processor processes it only under an appropriate transfer mechanism, such as the Standard Contractual Clauses approved by the European Commission and the UK addendum or an equivalent mechanism, together with any additional measures the law requires. This Part B is intended to support and operate alongside those mechanisms.

B.13 Order of precedence

These commitments are the baseline for every sub-processor. If a written data processing agreement with a sub-processor conflicts with this Part B, the provision that gives greater protection to the personal data, and to data relating to minors in particular, controls. Nothing in a sub-processor agreement may reduce the protections described in our Privacy Policy. Where a sub-processor’s current terms, or the lack of a signed agreement, fall below this baseline, we do not rely on this Section to cure it; we name the gap in Section B.14 instead.

B.14 Where a sub-processor’s current terms, or the lack of a signed agreement, fall below this baseline

We name here each place where a sub-processor’s current terms, or the lack of a signed agreement, do not yet meet this Part B, so that no gap is silent. When a signed agreement closes a gap, we remove it from this Section and update this document as described in Section A.3.

1. Veriff (identity and age verification). Veriff’s standard data processing terms allow it to use the personal data it processes for us for its own permitted business purposes, which include machine learning, data annotation, testing, and training. Veriff’s privacy notice leaves the biometric identifiers and other information of Illinois and Texas residents out of that use. Veriff’s published terms also allow it to keep personal data for its own purposes beyond the retention period set for our account. We use Veriff on these terms as they are, so these rights are an exception to Sections B.1, B.2, B.3, and B.9, and, should a person under 18 ever reach the check, to Section B.11, and only for the identity-verification data described in Section A.2. Veriff never receives footage. Our Privacy Policy explains how long identity-verification data is kept and names this exception.

2. Streamline Digital Holdings, LLC (Native Frame) (live streaming). Our agreement with Streamline does not yet set out every commitment in this Part B. Until a written data processing agreement with Streamline does, the commitments in this Part B that the agreement does not contain are our requirement of Streamline, not terms Streamline has signed.

3. ip-api.com and freeipapi.com (location lookup). We do not have a written data processing agreement with either service. For each of them, until we have a signed agreement or stop using it, the commitments in this Part B are our requirement of that service, not terms it has signed.

Closing note: a customer-facing DPA is a separate B2B variant

This document covers Reeplayer’s sub-processors, the vendors that process personal data on Reeplayer’s behalf when Reeplayer is the controller. It is a different document from a customer-facing data processing addendum, which is the agreement Reeplayer would sign when an enterprise customer, such as a school, a club, a league, or a district, is the controller and Reeplayer acts as a processor for that customer. That customer-facing DPA is a separate B2B variant, with its own controller-to-processor commitments, its own description of the processing, and its own transfer terms. We will add it when an enterprise relationship needs it. Until then, the consumer and participant relationship is governed by our Terms of Service and Privacy Policy, and this document governs our use of sub-processors.