Current subprocessors
Vercel Inc.
Always active- Purpose
- Website and application hosting, serverless runtime, edge network, request logs, and cookie-free aggregate web analytics.
- Data
- All Service traffic. Application logs are limited to an allowlist of request metadata. Web analytics records page views without cookies or personal profiles.
- Location
- United States
Supabase Inc.
Always active- Purpose
- Managed Postgres database, backups, and user authentication.
- Data
- All Customer Data and account data. Direct browser access to the database is denied by role and row-level security.
- Location
- United States
Resend Inc.
Active for inquiries; academy email only when enabled- Purpose
- Transactional email delivery: contact-inquiry notifications and guardian or staff emails an academy approves.
- Data
- Recipient address, subject, and approved message content; delivery events.
- Location
- United States
OpenAI, L.L.C.
Per feature; each feature has its own switch and budget- Purpose
- Large-language-model inference for AI Features (request interpretation, drafting, classification, summaries).
- Data
- Minimized, task-scoped text: first names only, contact details and sensitive numbers removed. OpenAI does not use API inputs or outputs to train its models by default. OpenAI may retain API inputs and outputs for up to 30 days to monitor for abuse, unless zero data retention is approved.
- Location
- United States
Anthropic PBC
Alternative provider; used only for a feature configured to use it- Purpose
- Large-language-model inference for AI Features (request interpretation, drafting, classification, summaries).
- Data
- Minimized, task-scoped text: first names only, contact details and sensitive numbers removed. Anthropic does not train on API inputs or outputs.
- Location
- United States
Google LLC
Optional, enabled by the academy- Purpose
- Google sign-in, and Google Workspace integrations (Calendar, Gmail, Drive, Meet) when an academy connects its account.
- Data
- Identity claims for sign-in; calendar events, email drafts, files, and meeting links the academy approves. OAuth tokens are stored encrypted, server-only.
- Location
- United States and Google’s global infrastructure
Stripe, Inc.
Optional, when an academy subscribes- Purpose
- Subscription billing, hosted checkout, and customer billing portal.
- Data
- Payment details go directly to Stripe. We store the plan, status, and Stripe references.
- Location
- United States
Twilio Inc.
Optional; currently sandboxed and not sending- Purpose
- SMS delivery of messages an academy approves.
- Data
- Recipient phone number and approved message content; delivery events.
- Location
- United States
Calendly LLC
Active only when a visitor books a call- Purpose
- Scheduling of pilot discussion calls that a website visitor chooses to book.
- Data
- Name, email address, and meeting time entered on Calendly’s booking page. No academy or student data.
- Location
- United States
AssemblyAI, Inc.
Optional; enabled per academy for coaching- Purpose
- Speech-to-text for lesson coaching recordings of adult teachers.
- Data
- Audio submitted by the academy for transcription. The provider’s copy is deleted after processing; raw audio is not retained by us.
- Location
- United States (EU region available)
Change notice and objections
We give at least 30 days’ notice before adding or replacing a subprocessor by updating this page and notifying each academy’s account owner by email. An academy may object on reasonable data-protection grounds within that period as described in Section 6 of the Data Processing Addendum. Every subprocessor is bound by a written agreement with data-protection obligations no less protective than ours.
Questions about this register: usajaysim@gmail.com.