Who processes data on our behalf.
Class2Class engages a small set of trusted vendors to deliver parts of the platform — the database, the email service, the customer-support chatbot, the AI features. Every one of them is on this list, with their location, transfer mechanism, and the contractual safeguards we've put in place.
Signed DPAs
Every sub-processor has signed a written contract with Class2Class that imposes the same data-protection obligations we accept toward you, per GDPR Art. 28(2)–(4).
EU-first
Backend, data warehouse, AI frontend hosting, ETL, and email all run in the EU. US transfers use SCCs, the EU–US Data Privacy Framework where applicable, and a Transfer Impact Assessment.
No AI training
Every AI sub-processor (Chatbase, OpenAI, Google Gemini, Anthropic) is contractually prohibited from using Class2Class data to train any AI model — theirs or anyone else's.
30-day notice
Partner schools are notified of any addition, replacement, or material change at least 30 calendar days in advance, with a 15-day window to object on reasonable grounds.
Nineteen sub-processors, organised by what they do.
Click any vendor to open their privacy or DPA documentation directly.
Xano
Legacy authentication only. Xano no longer serves platform data. It is reached in two narrow cases during the Supabase migration: verifying the password of an imported account that has not yet converted, and resolving a legacy session. Both paths are being retired.
Vercel
Hosting and edge-runtime infrastructure for the Class2Class platform, and the AI Gateway that routes our AI features to their model providers.
Supabase
Platform database, authentication, file storage and realtime services. As the platform migrates off Xano, this is where account, project and message data lives.
CookieYes
Consent management platform — stores and honours your cookie-consent choices across the site. The consent cookie itself is strictly necessary.
Sentry
Error and performance monitoring — captures exception and crash reports so we can keep the platform stable. Hosted in Sentry's EU region (Frankfurt). Personal data is not sent by default and remaining event data is scrubbed before sending; events are tunnelled through a first-party proxy on our own domain. Retention is the Sentry Developer-plan default of approximately 30 days.
Chatbase
AI-powered customer support chatbot. System AI-01 in our AI Inventory.
OpenAI
LLM API reached through the Vercel AI Gateway as a fallback provider for Project Creation Assistant text generation when the default model is unavailable. Teacher-only. System AI-02.
Google (Gemini API)
Image generation for project covers (Gemini 2.5 Flash, "Nano Banana"), and a fallback text provider reached through the Vercel AI Gateway. Teacher-invoked only. Systems AI-04 and AI-02.
Anthropic (Claude)
Default model for the Project Creation Assistant text features (Claude Haiku), reached through the Vercel AI Gateway — teacher-only. Also the assistant Class2Class staff use to query the data warehouse. Systems AI-02 and AI-05.
PostHog
EU-hosted product analytics on the platform and website. Cookies, persistent storage and account identification require Statistical consent. Limited cookieless analytics uses legitimate interests for service improvement. Teacher heatmaps require Statistical consent; student heatmaps and all session recordings are disabled.
Stape
First-party server-side tagging proxy that forwards analytics events from a Class2Class subdomain, keeping tagging first-party and consent-gated.
Mixpanel
Product analytics — being retired. No longer sets cookies on the platform; historical data is retained in the data warehouse only and covered by the Privacy Policy retention schedule.
Google Analytics
Website and platform analytics. For signed-in teachers who accept Statistical cookies, linked to a pseudonymous account number. Never loaded in student sessions. IP anonymisation enabled.
Google Tag Manager
Tag management: loads the consented Google Analytics and Google Ads tags on the marketing site and the platform. Never loaded in student sessions.
Google Cloud — BigQuery
Centralised data warehouse for product, marketing, and platform-usage data. Internal analytics only.
Airbyte
ETL platform — moves data from Mixpanel, Google Analytics, Search Console, Meta Ads, and Xano into BigQuery.
Brevo
Transactional and marketing email — password-reset emails, programme announcements, opt-in newsletters.
Meta
Marketing pixel and advertising — consent-based only, never engaged without explicit cookie consent. For teachers who accepted Marketing, our server also reports sign-up and profile completion through the Conversions API (hashed email, click identifiers, IP address and browser user agent). Never students.
Google Ads
Ad measurement for teachers who accepted Marketing: sign-up reports with a hashed email and the ad's click identifier (enhanced conversions). Never students.
All 19 sub-processors in one place.
For partner schools, regulators, and auditors who want the comprehensive view in a single table.
| # | Sub-processor | Service | Location | Transfer mechanism | Reference |
|---|---|---|---|---|---|
| 1 | Xano (Xano, Inc.) | Legacy authentication tail only: password verification for imported accounts that have not converted, and legacy session resolution | European Union | Not applicable — EU storage | Privacy notice |
| 2 | Brevo (Sendinblue SAS) | Transactional & marketing email | European Union | Not applicable — EU storage | Privacy policy |
| 3 | Mixpanel (Mixpanel, Inc.) | Product analytics — being retired; superseded by PostHog (historical data only) | United States | SCCs + TIA | DPA |
| 4 | Google Analytics (Google LLC) | Website and platform analytics; for signed-in teachers with Statistical consent, linked to a pseudonymous account number; never students | United States | EU–US DPF (Google LLC) + SCCs fallback + TIA + IP anonymisation | Privacy |
| 5 | Meta (Meta Platforms, Inc.) | Marketing pixel, advertising and Conversions API (consent-based); for teachers, server events carry a hashed email, click identifiers, IP address and user agent; never students | United States | SCCs + TIA | DPA |
| 6 | Chatbase (Chatbase, Inc.) | AI customer-support chatbot (system AI-01) | United States | SCCs + TIA + contractual no-AI-training | Privacy |
| 7 | OpenAI (OpenAI, L.L.C.) | Fallback LLM provider for project creation assistant text generation, via the AI Gateway; teacher-only (system AI-02) | United States | SCCs + TIA · standard API: no-training-by-default · 30-day retention for abuse monitoring | Privacy & DPA |
| 8 | Google — Gemini API (Google LLC) | Image generation for project covers (system AI-04); fallback text provider via the AI Gateway (system AI-02); teacher-only | United States | EU–US DPF (Google LLC) + SCCs fallback + TIA + contractual no-AI-training | DPA |
| 9 | Vercel (Vercel, Inc.) | Hosting & edge-runtime for the platform; AI Gateway routing AI features to model providers | European Union | Not applicable — EU regions configured | DPA |
| 10 | Google Cloud — BigQuery (Google LLC) | Data warehouse for product, marketing, and platform-usage analytics; staff-only | European Union | EU regions configured · DPF (Google LLC) for any control-plane processing | GDPR overview |
| 11 | Airbyte (Airbyte, Inc.) | ETL platform — moves data into BigQuery on a schedule | EU region | SCCs + TIA if any US transfer occurs; otherwise EU residency | Data protection |
| 12 | Anthropic (Anthropic PBC — Claude) | Default LLM for project creation assistant text generation via the AI Gateway, teacher-only (system AI-02); staff data-warehouse assistant (system AI-05) | United States | SCCs + TIA + Anthropic Commercial Terms with no-AI-training | Legal |
| 13 | PostHog (PostHog, Inc.) | EU-hosted product analytics on the platform and website. Cookies, persistent storage and account identification require Statistical consent. Limited cookieless analytics uses legitimate interests for service improvement. Teacher heatmaps require Statistical consent; student heatmaps and all session recordings are disabled. | European Union (EU Cloud, Frankfurt) | Not applicable — EU Cloud configured; SCCs fallback for any US control-plane access; contractual no-AI-training | DPA |
| 14 | CookieYes (Synconize Solutions Pvt. Ltd.) | Consent management platform — stores and honours cookie-consent choices | India | SCCs + TIA | DPA |
| 15 | Stape (Stape OÜ) | First-party server-side tagging proxy — forwards analytics events | European Union (Estonia) | Not applicable — EU storage | Terms |
| 16 | Sentry (Functional Software, Inc.) | Error & performance monitoring — no PII by default + scrubbed event data; retention ≈ 30 days (Developer-plan default) | European Union (EU region, Frankfurt) | Not applicable — EU region configured; SCCs fallback for any US control-plane access | DPA |
| 17 | Supabase (Supabase, Inc.) | Platform database, authentication, file storage & realtime services | European Union | Not applicable — EU region (eu-west-1) | DPA |
| 18 | Google Ads (Google LLC) | Enhanced conversions for ad measurement, for teachers who accept Marketing only: hashed email, click identifiers, browser user agent, and IP address outside the EEA, UK and Switzerland; never students | United States | EU–US DPF (Google LLC) + SCCs fallback + TIA | DPA |
| 19 | Google Tag Manager (Google LLC) | Tag management that loads the consented analytics and advertising tags on the marketing site and the platform; never loaded in student sessions | United States | EU–US DPF (Google LLC) + SCCs fallback + TIA | DPA |
What "sub-processor" means in plain language
A sub-processor is a third-party service we use to deliver some part of the Class2Class platform — for example, the database that stores your account, the email service that sends you a password-reset link, or the analytics tool that helps us understand which features teachers actually use. Every sub-processor on this list:
- Has signed a written contract with Class2Class that requires them to protect your data to the same standard we do
- Is on this list because they perform a specific role we cannot perform ourselves at our scale
- Is reviewed before engagement and at least annually thereafter
We do not sell your personal data to anyone, and no sub-processor on this list uses Class2Class data to train AI models — whether their own or any third party's.
International transfers and Transfer Impact Assessments
Where a sub-processor is established outside the European Economic Area (EEA), we rely on a valid transfer mechanism under Chapter V of the GDPR. The mechanisms we use, in order of preference:
- EU–U.S. Data Privacy Framework (DPF) — for sub-processors who are certified under the DPF, the European Commission's Adequacy Decision (EU) 2023/1795 of 10 July 2023 provides an adequacy basis for transfers to the U.S. Google LLC (covering Google Analytics, Google Ads, Google Tag Manager, Google Cloud / BigQuery, and Google's Gemini API) is DPF-certified.
- Standard Contractual Clauses (SCCs) — used as the primary mechanism for non-DPF-certified U.S. sub-processors (Mixpanel, Meta, Chatbase, OpenAI, Anthropic) and for CookieYes (India), and as a fallback for DPF-certified ones and for EU-hosted providers' incidental control-plane access (e.g. PostHog, Sentry).
- Transfer Impact Assessment (TIA) — supplemented across the board, in accordance with the Schrems II judgment and EDPB Recommendations 01/2020. The TIA is maintained internally and provided to partner schools on reasonable request.
AI sub-processors — additional safeguards
Class2Class uses AI features in line with the principle "You Decide. AI Helps." — teachers and staff remain the decision-makers, AI is assistive only. Where an AI sub-processor processes personal data on our behalf:
- The contract prohibits the sub-processor from using Class2Class data to train any AI model, whether their own or any third party's
- The AI system is classified as non-high-risk (or limited-risk for systems that interact directly with users) under the EU AI Act, and is documented in our AI System Inventory and Article 6(3) assessment
- Where a system interacts directly with a natural person, it identifies itself as AI before the conversation starts, in accordance with EU AI Act Article 50
The current AI sub-processors on this list are Chatbase (limited-risk, customer support — system AI-01), OpenAI (LLM API, teacher-only, non-high-risk under Art. 6(3)(b) — system AI-02), Google (Gemini) (image generation, teacher-only, non-high-risk under Art. 6(3)(b) — system AI-04), and Anthropic (Claude) (internal analytics, staff-only, no Annex III applicability, no Article 50 obligation — system AI-05).
Vercel, Google Cloud (BigQuery), and Airbyte are not AI sub-processors — Vercel is hosting infrastructure, BigQuery is a data warehouse, and Airbyte is an ETL platform. None of them train AI models on Class2Class data.
Questions partner schools and regulators ask.
Why are some sub-processors based in the United States?
Some specialised services we depend on (LLM APIs, certain analytics tools, the customer-support chatbot) are not available with EU-only operations at our scale. Where we transfer to the US, we rely on the EU–US Data Privacy Framework (where the vendor is DPF-certified), Standard Contractual Clauses, and a Transfer Impact Assessment supplemented per Schrems II and EDPB Recommendations 01/2020.
The TIA is maintained internally and shared with partner schools on reasonable request.
How will I be notified when this list changes?
Partner schools are notified at least 30 calendar days in advance through the contact on file under their signed Data Processing Agreement. Schools may object to a proposed change on reasonable data-protection grounds within 15 calendar days.
Individual users (teachers, parents) who want to be notified of material changes can write to dpo@class2class.org and we'll add you to the notification list.
Do any of these sub-processors train AI models on our data?
No. The four AI sub-processors we use — Chatbase, OpenAI, Google Gemini, and Anthropic — are each contractually prohibited from using Class2Class data to train any AI model, whether their own or any third party's.
For OpenAI specifically, we use the standard API which is no-training-by-default; OpenAI retains API request/response data for 30 days for abuse monitoring (as processor, security purpose) and then deletes it. Our DPA Appendix D.6 has the contractual detail.
Where is my school's student data actually stored?
The primary location for account data, project content, and platform messages is Supabase in the EU (region eu-west-1). Xano still holds legacy authentication data in the EU until its remaining auth paths retire. Some operational and analytics data flows through US-based sub-processors under the safeguards described above.
For schools where US transfers are not acceptable for any data type, write to dpo@class2class.org — we can discuss what data flows can be turned off (analytics, marketing pixel) while keeping the core platform functional.
Can I get a copy of the Transfer Impact Assessment?
Yes — partner schools can request a copy of the current TIA from dpo@class2class.org. It's reviewed annually and on every change to a sub-processor's data location or contractual terms.
How do I object to a sub-processor change?
Partner schools have 15 calendar days from notification to object on reasonable data-protection grounds. Write to dpo@class2class.org with the basis for your objection and we'll work with you on a path forward — that may be additional contractual safeguards, an alternative sub-processor, or, in rare cases, terminating the relationship.
Have a sub-processor question?
Whether you're a partner school doing due diligence, a regulator running an audit, or a teacher wanting to understand who handles your data — we're happy to answer. Write to our DPO directly.
- Data Protection OfficerGiancarlo Mena — dpo@class2class.org
- Partner schoolsYour designated account manager, or dpo@class2class.org
- General concernsupport@class2class.org
- Concern about the CEOIndependent Reviewer — class2class.org@gmail.com
- Lodge a complaintDatatilsynet — dt@datatilsynet.dk
PostHog product analytics and heatmaps
We use PostHog EU Cloud for product-usage and performance analytics on the platform and public website. With Statistical consent, it may use first-party cookies and browser storage; platform account identification is limited to consented sessions. Without that consent, limited cookieless analytics help us improve the service under our legitimate interests. We assess necessity, proportionality and your rights separately from consent for storage or access to your device. You may object by contacting dpo@class2class.org.
In cookieless mode we do not assign a persistent browser identifier or create an account-linked person profile. PostHog processes the IP address and browser user-agent to calculate a server-side hash with a daily rotating salt. This is limited measurement, not advertising, and does not support tracking the same visitor across days or devices. Statistical cookies remain subject to consent. Browser privacy signals are respected.
Platform heatmaps capture interaction coordinates for signed-in teachers with Statistical consent. Student, signed-out and unresolved sessions are excluded from heatmaps. Text and element attributes are masked. Project Viewed and Join Project Clicked are product events with the project id, sent only to PostHog for signed-in teachers with Statistical consent; these events are not sent to advertising platforms.
Session recordings and replay remain switched off. Before any recording pilot, we will complete DPIA screening, publish the approved configuration and updated notices, and give users 14 days and partner schools 30 days notice. The proposed pilot covers consented signed-in teachers only, with fully masked text, inputs and images, excluded sensitive content, no network or console capture, restricted product-team access and 30-day retention. No recording is enabled by this notice.
Looking for the full Data Processing Agreement?
If your school is preparing to onboard with Class2Class, write to our DPO at dpo@class2class.org for the current DPA template. It covers every sub-processor on this list in Appendix C, with SCCs, transfer mechanisms, breach notification SLAs, and AI-specific Technical and Organisational Measures.
Email the DPO