Kudopop sub-processors and data locations
Last updated: October 2026 Version: 1.0.0
This register lists the third-party infrastructure suppliers (sub-processors) engaged by Terry James Thorpe Publishing to host, deliver, and secure Kudopop.
Under GDPR Article 28, school owners (skoleeiere) acting as Data Controllers must approve any sub-processors involved in processing school or pupil data. We maintain this public register to ensure full verifiability.
Authorised sub-processors
The following suppliers are currently authorised to process data for Kudopop:
| Sub-processor | Corporate Entity & Headquarters | Service Provided | Data Handled | Processing Region | Transfer Mechanism |
|---|---|---|---|---|---|
| Supabase | Supabase Inc., San Francisco, USA | Database hosting (PostgreSQL), Authentication, Realtime sync | Teacher credentials, pseudonymous pupil progress, class settings | AWS Dublin (`eu-west-1`), Ireland (EU) | Data Processing Addendum incorporating EU Standard Contractual Clauses (SCCs) |
| Vercel | Vercel Inc., Walnut, California, USA | Static web asset hosting, Edge delivery, TLS termination | HTTP request metadata (IP address, user-agent) during asset download | EU Edge Network; primary region Dublin (`dub1`), Ireland | Data Processing Addendum incorporating EU Standard Contractual Clauses (SCCs) |
What we deliberately do not use
Many educational platforms integrate marketing tools, external analytics, or remote tracking scripts. Kudopop explicitly avoids these services:
- No commercial analytics: We do not use Google Analytics, Amplitude, Mixpanel, or similar services.
- No advertising networks: Kudopop is entirely ad-free and contains no tracking pixels, conversion tags, or retargeting scripts.
- No session-recording tools: We do not use session-replay or heatmapping tools (such as Hotjar or FullStory).
- No third-party font or video hosts: All typography (@fontsource) and landing-page videos are hosted directly from our own static distribution. Browsers make no external calls to Google Fonts, YouTube, or Vimeo.
Change notifications and objections
Kudopop maintains strict policies regarding changes to our infrastructure supply chain:
- Advance notification: We commit to giving school controllers at least 30 days' advance written notice before adding or replacing any sub-processor.
- Right to object: If a school owner objects to a proposed sub-processor on reasonable data protection grounds, we will work with the school to address concerns or allow the school to terminate the agreement without penalty.
- Due diligence: Every sub-processor must maintain rigorous technical and organisational security measures, including SOC 2 Type II or ISO 27001 certifications and verified EU data residency.
For inquiries or notification subscriptions, contact our data protection team at [privacy@kudopop.com](mailto:privacy@kudopop.com) or [schools@kudopop.com](mailto:schools@kudopop.com).