Subprocessor Register

This page lists all third-party vendors ("subprocessors") that may receive or process student data when CultivatEd is in use. We update this list when subprocessors change. Schools will be notified of material changes.

Last updated: April 2026

Anthropic

Purpose

AI inference — generates teacher-facing insights and suggestions

Data received

A narrowly scoped subset of student context when AI features are enabled: first/preferred name, grade level, student-selected interests and preferences, academic goals, pulse check scores (1–5 integers), non-anonymous check-in responses, interaction log categories, and relationship notes where the teacher has explicitly opted in. Demographic data, last names, disability status, and family contact information are never included.

Processing location

United States

Anthropic's commercial API terms do not use inputs or outputs for model training by default. CultivatEd does not currently hold a zero-retention agreement with Anthropic — Anthropic may retain request data for up to 30 days for trust and safety purposes under their standard commercial terms.

Supabase

Purpose

Managed PostgreSQL database hosting

Data received

All application data, including all student records, teacher notes, interaction logs, and audit logs. This is the primary data store.

Processing location

United States (AWS us-east-1 by default)

Data is encrypted at rest and in transit. Supabase is SOC 2 Type II certified.

Vercel

Purpose

Application hosting and edge infrastructure

Data received

HTTP request metadata (IP addresses, headers, request paths). Does not have access to database contents. Request logs may include URL parameters.

Processing location

United States (global edge with primary in US)

No student record content passes through Vercel's edge layer — only API routes and page renders.

Clerk

Purpose

Teacher authentication and session management

Data received

Teacher account data only: email address, name, and authentication tokens. Student data is never sent to Clerk.

Processing location

United States

Students do not have Clerk accounts. Only teacher (staff) users authenticate through Clerk.

No analytics or advertising providers

CultivatEd does not currently use third-party analytics, advertising, or tracking services. No student data flows to marketing or analytics platforms.

Questions or objections

If your school has questions about a specific subprocessor or wishes to object to its use, contact privacy@cultivated.app.