Sub-processors
Last updated: 26 April 2026
To deliver Ask.School we engage a small number of carefully chosen third-party sub-processors. Each provides infrastructure, communications, or analytics that is necessary for the Service. We pick partners on the strength of their security posture, reliability, and compliance with UK GDPR and the EU GDPR.
The table below lists every sub-processor that may handle personal data on our behalf, together with where they process it and the safeguards in place for international transfers.
| Sub-processor | Purpose | Processing location | Transfer safeguards | DPA in place |
|---|---|---|---|---|
| DigitalOcean, LLC | Application hosting, primary database, caching layer, background jobs | London, UK (compute & database) | Not applicable (UK-hosted) | Yes |
| DigitalOcean Spaces | Object storage for uploaded documents and encrypted backups | Frankfurt, Germany (EU) | Not applicable (EU-hosted) | Yes |
| OpenAI, LLC | Chat completions, vector stores for retrieval, content moderation | USA | UK Addendum + EU SCCs (OpenAI DPA); API content is not used to train models | Yes |
| Stripe Payments UK Ltd / Stripe, Inc. | Subscription billing and payment processing for school admins | UK and USA | UK Addendum + EU SCCs for US transfers | Yes |
| Mailjet SAS (a Sinch company) | Transactional email — invitations, safeguarding alerts, password resets | France (EU) | Not applicable (EU-hosted) | Yes |
| Wonde Ltd | Optional school MIS sync (student, parent, and staff rosters) | United Kingdom | Not applicable (UK-hosted) | Yes |
| Sentry, Inc. (when enabled) | Application error monitoring on the website and backend | USA | UK Addendum + EU SCCs | Yes |
| Google LLC (Google Analytics 4) | Aggregate analytics on the public marketing site only | USA | EU-US Data Privacy Framework + UK Extension | Yes |
| Google LLC / Microsoft Corporation / Apple Inc. (OAuth) | Optional social sign-in for school administrators | USA / EU | Identity assertion only; covered by the user's own provider terms | Not applicable |
What sub-processors never receive
- We never sell personal data and we never share it for unrelated marketing purposes.
- OpenAI does not retain API content beyond the request and does not use it to train its models.
- Google Analytics runs only on the marketing site (ask.school home pages, pricing, blog) — never inside an authenticated school dashboard or chat session. It does not see student data.
- Wonde data flows are one-way (Wonde → Ask.School) and are scoped to the fields a school selects.
Changes to this list
We may add, replace, or remove sub-processors as the Service evolves. When we make a material change we will:
- Update this page with the new sub-processor at least 30 days before they begin processing personal data.
- Notify the data protection contact for each customer school by email.
If you have a reasoned objection to a new sub-processor, contact us within 30 days of the notice and we will work with you to find a resolution. If we cannot agree, you may terminate your subscription on written notice without further fees for the unused balance of your term.
Contact
Questions about a sub-processor or a transfer mechanism: [email protected].