Register status
This register is a publication draft, not an approved data-processing agreement or completed vendor risk review. Contract owner, processing regions, transfer mechanism, provider retention, deletion evidence, security review, and notice period must be verified before it becomes effective.
Current and conditional providers
Vercel
Current hosting provider- Purpose
- Website and application hosting, request routing, and runtime logs.
- Current boundary
- Public traffic and application requests. Production log retention and region settings require launch review.
Supabase
Current production infrastructure- Purpose
- Postgres database and production authentication.
- Current boundary
- Approved workspace records and adult account identity only after customer and policy approval. Direct browser database access is denied by role and row-level security.
Resend
Conditional by feature- Purpose
- Contact inquiry notifications and approval-gated email delivery.
- Current boundary
- Adult business inquiry details when the public inbox is enabled. Parent-facing email remains separately configured, human-approved, and customer-scoped.
Stripe
Conditional by workspace- Purpose
- Optional hosted checkout, subscription status, and customer billing portal.
- Current boundary
- Used only for an authenticated Owner when billing is fully configured. Stripe receives payment details directly, while AcademyTempo stores tenant-scoped provider references and signed webhook outcomes. Billing remains disabled when configuration is incomplete.
Google Workspace
Optional customer integration- Purpose
- Optional identity, Calendar, Gmail, Meet, and Drive capabilities.
- Current boundary
- Connected only with capability-level OAuth and explicit provider-write approval. Tokens remain encrypted and server-only.
Anthropic
Restricted optional provider- Purpose
- Optional AI interpretation and drafting for approved features.
- Current boundary
- Feature-scoped minimized context only. Production parent drafting remains local, and real minor-data transfer is blocked until provider and legal approval.
Customer notice and objections
An effective register should define advance notice for material provider changes, a reasonable objection process, and the remedy if a legitimate data-protection objection cannot be resolved. Those contract terms are not yet approved.
Questions may be submitted through the privacy inquiry path without including student information.