Sub-processor Register

Last updated:

Gradespace LTD uses the third-party sub-processors listed below to deliver our website, free tools, and products (TargetGrade, CareMaSym, AccountGrade, and BuildGrade). Each sub-processor is bound by a data processing agreement with obligations equivalent to those in our Data Processing Agreement, and transfers outside the UK are covered by an appropriate safeguard under UK GDPR.

We will give customers prior notice before adding or replacing a sub-processor, with a reasonable opportunity to object on data protection grounds. To receive change notifications, contact privacy@thegradespace.com.

Sub-processorPurposeData categoriesLocationTransfer safeguards
Google Cloud / FirebaseApplication hosting, database (Firestore), authentication, and file storageAccount data; product data for all Products (may include special-category care data for CareMaSym)United States / European UnionUK Addendum / SCCs; Google Cloud Data Processing Addendum
FasthostsUK virtual private server hosting for our product applications (including BuildGrade, AccountGrade services, and CareMaSym) and backupsProduct and application data hosted on our VPS infrastructureUnited KingdomUK-based processing
VercelWeb infrastructure and content deliveryWebsite usage data; request logs (IP address, user agent)United States / European UnionUK Addendum / SCCs; Vercel Data Processing Addendum
StripePayment processing and subscription billingBilling contact details and payment information (card details held by Stripe, not Gradespace)United States / European UnionUK Addendum / SCCs; PCI DSS Level 1
BrevoTransactional and service email deliveryName, email address, and message content of service emailsEuropean UnionUK adequacy for the EU; Brevo Data Processing Agreement
TwilioSMS and voice communicationsPhone numbers and message/call metadataUnited StatesUK Addendum / SCCs; Twilio Data Protection Addendum
OpenAIAI features within our products (for example, drafting and matching assistance)Content submitted to AI features; not used by OpenAI to train models under our API termsUnited StatesUK Addendum / SCCs; OpenAI Data Processing Addendum; API data not used for training
SupabaseManaged PostgreSQL database and authentication (AccountGrade)AccountGrade account and payroll data (encrypted identifiers at field level)European Union (Frankfurt)UK adequacy for the EU; Supabase Data Processing Addendum
Cloudflare (incl. R2 storage)DNS, TLS, CDN/edge in front of our applications; document/object storage (R2)Request metadata (IP address, headers) in transit; stored documents such as payslipsGlobal edge; R2 storage in Western EuropeUK Addendum / SCCs; Cloudflare Data Processing Addendum
Jitsi (8x8, Inc.)Video lessons and virtual classrooms (TargetGrade)Audio/video streams and display names during sessionsUnited States / European UnionUK Addendum / SCCs
DeepgramText-to-speech for accessibility and learning features (TargetGrade)Text submitted for speech synthesis (server-side; no student identifiers required)United StatesUK Addendum / SCCs; Deepgram Data Processing Addendum
MapboxMaps for live care operations (CareMaSym)Visit/check-in coordinates rendered on mapsUnited StatesUK Addendum / SCCs; Mapbox Data Processing Addendum
Google AnalyticsWebsite analytics on marketing pages (consent-based; not used in child-facing product surfaces)Pseudonymised usage data; loaded only after analytics consentUnited States / European UnionUK Addendum / SCCs; Google Ads Data Processing Terms
Sentry (Functional Software, Inc.)Error monitoring and application performanceError reports and diagnostic data (may include IP address and user identifiers)United StatesUK Addendum / SCCs; Sentry Data Processing Addendum
Google reCAPTCHA EnterpriseBot detection and abuse prevention on public forms and toolsDevice and interaction signals; IP addressUnited States / European UnionUK Addendum / SCCs; Google Cloud Data Processing Addendum

Related documents