Sub-Processor List
Last Updated: July 16, 2026
ClassThought uses a small number of third-party service providers ("sub-processors") to operate the Service. This page lists the sub-processors we use, what they do for us, what categories of data they may process, and when they are used. It is referenced by our Privacy Policy.
Our commitments: we do not sell, rent, or trade personal information or student data; we do not use student data for advertising or profiling; and sub-processors may use data only to provide their services to us.
Changes: when we add, replace, or remove a sub-processor, we update this page and its "Last Updated" date. Questions or objections about any sub-processor can be sent to admin@classthought.com.
Core Infrastructure
Supabase
- Purpose:
- Database, authentication, file storage, and real-time infrastructure. Hosts all Service data.
- Data it may process:
- All account data and User Content, including teacher and student records, classes, assignments, files, audio recordings, annotations, messages, and activity records. Student files and recordings are stored in private buckets served via short-lived signed links.
- Processing location:
- United States
- When it is used:
- Always (core infrastructure)
Vercel
- Purpose:
- Web hosting and content delivery. Also provides Vercel Web Analytics, a privacy-focused, cookie-free analytics service.
- Data it may process:
- All web traffic to the Service (as host); aggregate page-view and visit statistics; approximate location (country/region/city) derived from IP address. Web Analytics is disabled on student surfaces: the student dashboard, the student QR login surface, and any page viewed while a student is signed in on a device are not reported to it.
- Processing location:
- United States
- When it is used:
- Always (core infrastructure)
Document Preview Processing
Render
- Purpose:
- Hosts our document-conversion worker, which converts uploaded Word documents (.docx) into page-image previews using a document engine (LibreOffice) that we operate ourselves.
- Data it may process:
- The contents of Word documents uploaded to assignments, which may include student data if the uploader includes it. Documents are processed transiently — each conversion runs in a temporary workspace that is deleted immediately afterward; the worker does not retain files. Converted page images are stored in our own private storage, not on Render.
- Processing location:
- United States
- When it is used:
- Only when a Word document is uploaded to an assignment and its preview pages are generated (once per document)
Payments
Stripe
- Purpose:
- Payment processing for Teacher and school subscriptions, including checkout and the billing portal.
- Data it may process:
- Teacher name, email, payment card details (collected and stored by Stripe directly — ClassThought never receives full card numbers), subscription plan and status. Students are not charged and cannot make purchases.
- Processing location:
- United States
- When it is used:
- Only when a Teacher or school purchases a subscription
Resend
- Purpose:
- Delivery of account emails to Teachers: password resets, email confirmations, and security notices.
- Data it may process:
- Teacher email addresses and the contents of account emails. Account emails are not sent to Students.
- Processing location:
- United States
- When it is used:
- When account emails are sent to a Teacher
Hostinger
- Purpose:
- Email infrastructure for our administrative mailbox (admin@classthought.com) and administrative communications with Teachers.
- Data it may process:
- Teacher email addresses and the contents of correspondence with our administrative mailbox. Correspondence may include student data if the sender chooses to include it.
- Processing location:
- United States / European Union
- When it is used:
- When you email us or we email you administratively
Mobile App & Notifications
Apple
- Purpose:
- Mobile app distribution (App Store, TestFlight) and push notification delivery via the Apple Push Notification service (APNs).
- Data it may process:
- Device push notification tokens and notification message content. Notification messages can include classroom context such as a student’s first name and the activity type (for example, "submitted a reading log"). Used solely to deliver notifications to the recipient’s device.
- Processing location:
- United States
- When it is used:
- Only when a user installs the mobile app and enables notifications
Optional Integrations (used only when a user actively uses the feature)
Google — Translation
- Purpose:
- Translates text in the built-in translator and dictionary tools.
- Data it may process:
- The text a user types into the translator or dictionary (which may be typed by a student using those tools), plus the selected languages. No account identifiers are sent.
- Processing location:
- United States
- When it is used:
- Only when a user actively uses the translator or dictionary tools
Google — YouTube
- Purpose:
- Plays teacher-assigned videos and powers video search in the video library.
- Data it may process:
- Video identifiers and search terms; when a video plays, the viewer’s browser connects to YouTube directly and YouTube’s own privacy policy applies to that connection.
- Processing location:
- United States
- When it is used:
- Only when a Teacher assigns or a user plays a YouTube video
Google — Drive & Sign-In
- Purpose:
- Lets Teachers pick files from their own Google Drive and optionally sign in with a Google account.
- Data it may process:
- Files the Teacher explicitly selects from their Drive, which may contain student data if the Teacher chooses to import such a file; Google account identity for Teachers who choose Google sign-in.
- Processing location:
- United States
- When it is used:
- Only when a Teacher uses the Drive picker or Google sign-in
Microsoft — Office Viewer & Sign-In
- Purpose:
- Renders previews of uploaded Word, Excel, and PowerPoint files using Microsoft’s online document viewer; optionally lets Teachers sign in with a Microsoft account.
- Data it may process:
- When an Office document is previewed, the document is retrieved and rendered by Microsoft’s viewer (the document contents pass through Microsoft for rendering). Microsoft account identity for Teachers who choose Microsoft sign-in.
- Processing location:
- United States
- When it is used:
- Only when an Office document is previewed or Microsoft sign-in is used
MyMemory (Translated S.r.l.)
- Purpose:
- Backup translation service used by the translation tools if the primary service is unavailable.
- Data it may process:
- The text being translated and the selected languages. No account identifiers are sent.
- Processing location:
- European Union
- When it is used:
- Only as a fallback during active use of translation features
LibreTranslate
- Purpose:
- Secondary backup translation service used by the translation tools if other services are unavailable.
- Data it may process:
- The text being translated and the selected languages. No account identifiers are sent.
- Processing location:
- European Union
- When it is used:
- Only as a fallback during active use of translation features
Change History
July 16, 2026 — Added Render (hosting for our Word-document preview conversion worker; transient processing only, no file retention).
July 16, 2026 — Initial publication of this list. Added Resend (Teacher account email delivery, replacing part of the role previously served by our general email infrastructure).