Subprocessors · Version 1 · Effective May 12, 2026
Subprocessors
Every third-party vendor that touches GradeEarn child data, what they do, what data they see, where they're located, and the status of our Data Processing Agreement with them.
Current subprocessors
| Vendor | Purpose | Data shared | Location | DPA |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosting + storage (Lambda compute, DynamoDB storage, S3 for toy images) | All app data (encrypted at rest) | us-east-1 (Virginia, USA) | AWS Service Terms (online; covers COPPA via DPA section) |
| OpenAI | AI model (GPT-4o-mini) for tutor + MySpace buddy + content judge | Practice questions (no kid identifiers), AI chat content (no kid identifiers — server passes first name only), and student snapshot text | USA | OpenAI API Data Usage Policy (no training on customer data — verify current terms before launch) |
| Anthropic | Cold-start question verifier (Claude Sonnet 4.5) for math accuracy review during content generation | Generated math questions only — no kid data, no identifiers | USA | Anthropic Commercial Terms of Service (no training on customer data) |
| GitHub Pages | Static site hosting (frontend HTML/CSS/JS) | No personal data — public static files only | USA | GitHub Terms of Service |
| Namecheap | Domain registrar + DNS | No personal data — DNS records only | USA | Namecheap Terms of Service |
| Google Fonts | Web fonts (Inter, Instrument Serif) | IP address only (one-shot font fetch; no cookies) | USA / EU CDN | Google Fonts API Terms (low-risk; may self-host before EU launch for GDPR-K) |
What we do NOT use
To make the absence explicit (this is what protects kids):
- No Google Analytics, Mixpanel, Amplitude, or other behavioral analytics
- No Facebook SDK, TikTok SDK, or any social-network pixel
- No advertising networks of any kind
- No A/B testing service that uses persistent identifiers
- No chat support widgets on child-facing screens
- No biometric vendors (no voice prints, no face templates)
Changes
Before adding any new subprocessor that touches kid data, we will: (a) execute a DPA, (b) update this page and increment the Privacy Policy version, (c) email parents and require re-acceptance.
Version: 1 · Effective: May 12, 2026 · Status: Pre-launch placeholder pending privacy-lawyer review.