Subprocessors
The third parties that process personal data on our behalf. We use the minimum set needed to run the product, and pick privacy-respecting options where we can.
A "subprocessor" is a third party that processes personal data on our behalf. This page lists every one, what it does, the data it handles, and where it is located. It is the companion to our Privacy Policy; for where each piece of data physically lives, see our data-residency statement.
The data controller is ARHAS INDIA (OPC) PRIVATE LIMITED (CIN U62013TS2026OPC220112), a One Person Company incorporated in India under the Companies Act 2013, registered office SY No. 4A & 4/AA, Peeramcheru, Golconda, Hyderabad 500008, Telangana, India. It is the company that operates BRUTAL Optimizer.
Core subprocessors
Always in use, because the product cannot run without them.
| Processor | Purpose | Data processed | Region |
|---|---|---|---|
| Cloudflare, Inc. | Website + API hosting (Workers/Pages), storage (KV/D1/R2), CDN/WAF, Turnstile (bot protection) and Email Sending (transactional email) | Account + license records (including your email address), SHA-256-hashed email indexes, one-way machine-id hashes, support-desk conversations, the billing ledger (including the payment events Razorpay sends us), standard request logs (IP, user-agent) and transactional email delivery | USA (global edge) |
| Razorpay Software Pvt. Ltd. | Subscription payments + renewals | Billing/payment data. Card numbers are handled entirely by Razorpay (PCI-DSS) and never reach us. We keep the subscription id ↔ license mapping, and the payment events Razorpay sends us, which include the email address and phone number you paid with and the payment method as Razorpay reports it (for example a card's network and last four digits) | India |
| Google LLC | Website analytics (Google Analytics / gtag, consent-gated) and admin-console sign-in (Google OAuth — operator only, not end-user data) | Site-usage events + analytics cookies (GA), loaded only after you accept the cookie banner | USA |
| GitHub, Inc. (Microsoft) | Weekly disaster-recovery copy of our server records, kept as a private build artifact in our private source repository, so a copy exists outside Cloudflare | A full copy of our Cloudflare KV store and D1 database — license records (including email addresses, and a name or phone number where you gave one), device seats, subscription mappings, giveaway entries, support-desk messages, and the billing ledger with the payment events Razorpay sends us. Each copy is deleted after 90 days | USA |
Feature-specific subprocessors
Only involved when you actually use that feature.
| Processor | Purpose | Data processed | Region |
|---|---|---|---|
| Google LLC (Gemini API) | Automated first-pass screening of giveaway entries (only if you enter the giveaway) | The screenshot you upload to enter the giveaway. Google processes it as our processor and we don't let it be used for anything else | USA |
| Google LLC (Gmail) | Our support inbox: a copy of each message you send us — by email, through the contact form, or with the app's Report a problem button — is kept there so we can read and answer it (only if you contact us) | Your email address, your name if you give it, your message and its attachments (including any diagnostics you chose to attach from the app) | USA |
| Akamai / Linode, Vultr, LightNode (relay/VPS providers) | Host the Smart Route (GPN) WireGuard relays that forward your game traffic (only while you have Smart Route engaged) | Transient routed network packets — relays are packet forwarders that do not log traffic content; no account or PII is stored on a relay | The relay location Smart Route engages for your game (10 locations in 8 countries; see data residency) |
BRUTAL Optimizer for Android (when it is available)
These apply only to the Android app, which has its own privacy policy describing each one in full. They are not involved when you use BRUTAL Optimizer for Windows or this website. Google Play and the sign-in providers act as independent controllers for their own processing.
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Google LLC (Google Play Billing) | Ultra purchases made inside the Android app; Google is the merchant of record | Payment and billing data, handled by Google; we receive only confirmation that a subscription exists and when it runs to | USA (global) |
| Google LLC (Google Mobile Ads SDK / AdMob, User Messaging Platform) | Rewarded ads on the Android free tier, and the EEA/UK consent form (free tier only; never on Ultra) | Advertising ID, IP address, app interactions and device identifiers as Google describes for that SDK, plus the app's device id to confirm a watched ad. Google also processes ad data for its own purposes under its own policy | USA |
| Google LLC (Google Sign-In) | Optional sign-in (only if you choose it) | Your Google account email and display name | USA |
| Discord Inc. and Apple Inc. | Optional sign-in, in builds where that provider is offered (only if you choose it) | Your account email and username (Discord) or email and name (Apple) | USA |
What we don't do
We do not sell personal data and we do not use these subprocessors to build an advertising profile. Google Analytics is used for product-usage analytics only, with Google's advertising features off, and it does not load at all until you opt in. Distribution channels (winget, the R2 download bucket) are not personal-data subprocessors — no user data flows to them.
Changes
This list is versioned in our source control and kept accurate as vendors change; material additions are announced before they take effect. Questions about this page, or a request to access, correct or delete your data, go to legal@brutaloptimizer.com.