Sub-Processors
Last updated: 29 October 2026
We engage the following organisations to help us deliver the Services. Each is bound by a written processing agreement that obliges them to protect your personal data, use it only on our documented instructions, and apply appropriate security.
Where data is transferred outside the United Kingdom we apply one of the safeguards described in our Privacy Policy — typically the UK-US Data Bridge (for certified US providers) or the UK International Data Transfer Addendum (IDTA) layered onto EU Standard Contractual Clauses.
We will update this page when sub-processors are added, removed, or when their role materially changes.
| Sub-processor | Purpose | Country of processing | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Web and serverless hosting | USA (with EU edge regions) | UK-US Data Bridge (US adequacy) / SCCs + IDTA |
| Neon, Inc. | PostgreSQL database hosting | EU (Ireland) / USA | UK-EEA adequacy / SCCs + IDTA for US regions |
| Clerk, Inc. | User authentication and account management | USA | UK-US Data Bridge / SCCs + IDTA |
| Stripe Payments Europe, Ltd. | Payment processing, billing and fraud detection | Ireland (with US affiliates) | UK-EEA adequacy / SCCs + IDTA |
| Twilio Inc. | WhatsApp and SMS transactional messaging | USA (with EU regions) | UK-US Data Bridge / SCCs + IDTA |
| Resend, Inc. | Transactional email delivery | USA | UK-US Data Bridge / SCCs + IDTA |
| Anthropic, PBC | AI processing for reports, practice content and message triage | USA | UK-US Data Bridge / SCCs + IDTA. Configured to disable training on customer data. |
| OpenAI, L.L.C. | Audio transcription of selected lesson recordings | USA | UK-US Data Bridge / SCCs + IDTA. Configured to disable training on customer data. |
| TypeSafe AI, Inc. (via Vercel AI Gateway) | Trial classification of inbound WhatsApp messages, measured alongside our existing triage. Names, phone numbers and email addresses we hold are masked before sending | USA | Accessed through Vercel under Vercel's data processing agreement. Zero data retention is requested on every call; no training on customer data. |
| Sanity, Inc. | Content management for marketing pages | EU (Netherlands) | UK-EEA adequacy |
| Cloudflare, Inc. | Object storage (Cloudflare R2) for lesson recordings available to rewatch | EU jurisdiction | UK-EEA adequacy (EU-jurisdiction bucket); Cloudflare standard DPA |
| Upstash, Inc. | Rate limiting and ephemeral caching | EU / USA | UK-EEA adequacy / SCCs + IDTA for US regions |
| Google LLC (Workspace, Drive, Meet) | Email, video lessons (Meet), file storage for transcripts, notes and safeguarding lesson recordings | USA / EU regions | UK-US Data Bridge / SCCs + IDTA |
| Slack Technologies, LLC | Internal operations, safeguarding alerts, and inbound parent message content forwarded for triage | USA | UK-US Data Bridge / SCCs + IDTA |
| Functional Software, Inc. (Sentry) | Error and performance monitoring. Technical data about errors in the Platform (browser, page address, error details). Personal data is not sent by default | Germany (EU data region) | UK-EEA adequacy; Sentry standard DPA |
| Microsoft Corporation (Azure Blob Storage) | Encrypted off-site backups of the Platform database | United Kingdom (UK South, replicated to UK West) | Not applicable: data stays in the UK; Microsoft DPA |
| Calendly LLC | Booking recruitment interviews with tutor applicants. Data shared: tutor applicant name and email address (pre-filled into the booking form), and any booking details the applicant enters | United States | UK-US Data Bridge / SCCs + IDTA |
Former sub-processors
Snowflake Inc. (data stored in the UK, AWS London region) — internal financial reporting. Between 27 July 2026 and 22 August 2026 we copied billing records to Snowflake each day: invoice, refund and subscription details, parent names and email addresses, and student names. No phone numbers or addresses were copied. The last copy was made on 22 August 2026, and we removed the integration on 5 October 2026. We will delete the copies held there and record the deletion date on this page. This processing was not listed here at the time, and we apologise for that omission.
Questions or objections to a particular sub-processor? privacy@redrobinlearning.com.