We use a small number of carefully chosen service providers (“sub-processors”) to run the platform. Each is bound by a written data processing agreement and may only use personal data to provide its service to us. We use the same sub-processors for every school, wherever it is.
We will give schools at least 30 days’ notice before adding or replacing a sub-processor, as set out in our School Subscription Terms.
Current sub-processors
| Sub-processor | What it does for us | Personal data involved | Where data is processed | Transfer safeguard |
|---|---|---|---|---|
| Lovable [CONFIRM: legal entity] | Platform build and hosting service (Lovable Cloud) | All platform data | [CONFIRM] | [CONFIRM] |
| Supabase, Inc. (via Lovable Cloud) | Database, user sign-in and file storage | All platform data, including accounts and students’ work | [CONFIRM: project region, e.g. EU (Frankfurt) / UK (London) / US] | [CONFIRM: EU SCCs + UK Addendum, per Supabase DPA] |
| Cloudflare, Inc. | Runs the platform’s server code, delivers pages and protects against attacks | IP addresses, request data, data passing through the platform | Global network; company based in the US | UK–US Data Bridge / EU–US Data Privacy Framework; standard contractual clauses |
| Anthropic, PBC | AI marking of written answers and feedback | The text of written answers and a random reference number only — no names, emails, schools or classes | United States [CONFIRM: or regional processing if enabled] | Standard contractual clauses / UK Addendum (Anthropic DPA) |
| [CONFIRM: Email provider, e.g. Resend / Google Workspace] | Sending account emails (sign-up, password reset, reminders) and handling support email | Name, email address, message content | [CONFIRM] | [CONFIRM] |
Independent controllers
These providers handle personal data for their own purposes under their own privacy notices, not as our sub-processors.
| Company | Role |
|---|---|
| Paddle [CONFIRM: legal entity — Paddle’s buyer terms name Paddle.com Market Limited for most buyers, Paddle.com Inc. in the US and Paddle.com (Canada) Ltd in Canada] | Merchant of record for individual subscriptions — takes payment, handles tax and issues receipts. |
Not used
We do not use advertising networks, data brokers or third-party analytics services.
Questions
Email privacy@secondnaturelearning.com. Schools can also ask us to email them when this list changes.
Questions about this document? Email legal@secondnaturelearning.com. Back to the Legal hub