AOS / D02 · Third-party processing list

Third-Party Processing and Sharing List

Production uses AWS, Gumroad, Resend and Google Analytics for the specific roles below. A provider is not authorised for a new purpose merely because it appears in this list.

Status
Public version
Last updated
29 September 2026
Sections
06

01 · Active integrations

Analytics is separated from sensitive page views.

The Next.js application and Go/MySQL service are first-party code. External museum and archive links open third-party websites but do not, by themselves, embed those parties' trackers. The game manifest may be fetched from a configured game origin; production must identify that operator if it is not the same Age of Seas operator.

  • +Advertising networks: none
  • +Analytics: Google Analytics 4
  • +Social login providers: none
  • +Embedded support/chat providers: none

02 · Analytics

Google Analytics 4.

Provider: Google LLC. Data may include a pseudonymous client identifier, public page path/title, referrer, device/browser attributes, language, approximate geography, timestamps and interaction events. Purpose: aggregate audience, content and game-entry performance measurement; account and advertising signals are disabled in the site configuration.

Google may process data in countries where it or its service providers operate. Browser controls can block or remove analytics storage. The operator must complete any applicable cross-border assessment and configure the shortest suitable property retention before production activation.

  • +Status: enabled with a valid deployment measurement ID
  • +Private-route page views excluded
  • +URL query strings excluded
  • +Privacy contact: info@ageofseas.com
Authority and further readingGoogle Privacy Policy

03 · Hosting and delivery

Amazon Web Services (AWS).

AWS hosts the public Next.js application, account, game and commerce API, and MySQL database in us-east-1 (United States). It may process IP address, request headers, URL, timing, response and security metadata as well as account, save, transaction and audit data.

Purpose: deliver, operate, back up and protect the service. Access is limited to delivery, maintenance, security and support needs; provider retention and international processing are governed by configuration, contract and the linked notice.

  • +Public web delivery, API and database: AWS us-east-1, United States
  • +No secondary advertising purpose authorised
  • +Cross-border safeguards apply where required
Authority and further readingAWS Privacy Notice

04 · Payment

Gumroad hosted checkout is live.

Gumroad, Inc. acts as merchant of record and non-exclusive reseller for purchases completed through its service. It may process purchase email, product, amount, currency, payment credentials, billing details, device or network data, fraud signals, tax, receipt, refund, dispute and chargeback information.

Age of Seas receives only the product, sale/order and licence references, purchase email and transaction status needed to verify ownership, bind access and reconcile refunds or disputes. Full card details and security codes are entered on Gumroad and are not received or stored by Age of Seas.

  • +Status: Age of Seas PRO checkout for all playable games
  • +Price: one-time USD 7.99
  • +Purchase email must match the verified player account
  • +Gumroad's checkout terms and privacy notice also apply

05 · Email and support

Resend transactional email; direct support mailbox.

Plus Five Five, Inc., operating as Resend, sends Age of Seas account verification and transactional messages. It may process recipient and sender addresses, message content and metadata, delivery events, IP or device information needed to provide and secure delivery.

The public support route is info@ageofseas.com. No embedded support/chat or marketing-email provider is used by the current application. Marketing, if introduced, requires a separate choice and free unsubscribe method.

  • +Account and transactional delivery: Resend
  • +Support: direct email
  • +No purchased mailing lists
  • +Transactional and marketing purposes remain separate
Authority and further readingResend Privacy Policy

06 · Legal disclosure and business change

A lawful disclosure is not a standing data feed.

We may provide the minimum relevant information to a competent authority, court, payment network or professional adviser when legally required or necessary to protect rights. We assess the authority and scope where permitted and preserve a record.

In a merger, acquisition, restructuring or asset transfer, affected users will receive notice of the recipient and choices required by law; the recipient must continue to honour this policy or obtain new consent.

Next route

Analytics behavior and browser controls are described there.

Read the Cookie Policy ↗