⚠️ DRAFT — entries in [brackets] are placeholders pending contracts and GATE 2 procurement.
Last updated [DATE]. We will update this page before adding or changing any processor.
These are the only third parties that process personal data on our behalf. Each operates under a data-processing agreement. We share data with no one else, unless the law requires it or a child's safety demands it.
| Processor | What they do | Data involved | Location & safeguards |
|---|---|---|---|
| Anthropic | Generates Max's tutoring replies | Chat messages and recent conversation context | USA — [DPA + UK IDTA/Addendum to be executed; no-training / zero-retention API terms to be recorded] |
| Stripe Payments UK Ltd | Subscriptions and payments | Adult billing details (card data never touches SumSpark) | UK — Stripe standard DPA |
| [Hosting provider TBC] | Runs our servers and database | All service data (encrypted at rest) | [UK/EU — DPA to be executed at procurement] |
| [Email provider TBC] | Sends receipts, digests, password resets | Adult email addresses and message content | [TBC — DPA to be executed at selection] |
Questions: privacy@sumspark.co.uk · Privacy notice