Subprocessors

The third-party service providers Algebro uses to operate its platform.

Last updated: October 11, 2026

What is a subprocessor?

A subprocessor is a third-party company that Algebro hires to help run the platform. When you use Algebro, some of your data is processed by these companies on our behalf. For example, our database is hosted by Supabase, and the AI guide is powered by OpenAI.

We publish this list so that schools, districts, parents, and teachers can see exactly who handles student data, what they do with it, and how to verify their security and privacy practices. This is part of our commitment to transparency and to supporting district vendor vetting under FERPA, COPPA, and Florida student data privacy requirements.

Algebro maintains a Data Processing Agreement (DPA) with each subprocessor: executed directly with Supabase and OpenAI (July 2026), and incorporated into the service terms of Clerk, Vercel, Stripe, Resend, and Better Stack. Each subprocessor is contractually required to process data only as needed to provide its service to Algebro and to maintain appropriate security controls.

Where data is kept. Student records are stored in the United States (Supabase, us-east-1). Clerk hosts primarily in the United States. The AI provider (OpenAI) does not commit to a processing location; Algebro adds no student name or account id to AI requests.

Current subprocessors

OpenAI

Purpose: Powers the Bro AI guide and the teacher tools: Brofessor (the teacher assistant), AI set building, and Import from a PDF.
Data processed: For students: math problems, student answers, lesson context, and prior messages from the current tutoring session. For teachers: the teacher’s messages, class names, assignment and set titles, question text, the pages of a worksheet they import, and, for Brofessor, results about individual students under private codes: percent correct by skill, each assignment’s status and score, FAST practice scores and levels, working levels from the placement test and the diagnostic, the day they joined and last worked, and questions answered. Algebro never sends a student’s name, username, email address, or account identifier.
Location: OpenAI does not commit to a processing location. Algebro adds no student name or account id to AI requests.
Resources: DPA: View DPA
Privacy Policy: View privacy policy
Security / Trust: View trust page

Note: Algebro executed OpenAI’s Data Processing Addendum in July 2026. Algebro never adds a student’s name, username, or account identifier to a request. In Brofessor, every student name on the teacher’s rosters, including one the teacher types, is replaced with a private code before sending, and the teacher’s screen turns the codes back into names; a nickname or misspelling Algebro cannot match to a roster name is sent as typed. Response storage is disabled on every API call; API data is not used to train OpenAI models and is retained by OpenAI for up to 30 days for abuse monitoring, then deleted.

Clerk

Purpose: User authentication, session management, and account security.
Data processed: Account identifiers (name, username, email for parents and teachers), password hashes, session tokens, and authentication metadata. For students, an email address is held only when the student signs up with their school Google account or connects a Google account (email, name, and profile photo from Google; available unless the school turns Google sign-in for students off), or when the school signs students in through ClassLink. Both are the school's decision; username and password always works and carries no email.
Location: Primarily the United States
Resources: DPA: View DPA
Privacy Policy: View privacy policy
Security / Trust: View trust pageSOC 2 Type 2.

Vercel

Purpose: Web hosting, serverless compute, CDN, and performance monitoring (Analytics & Speed Insights).
Data processed: All data transmitted to and from the platform passes through Vercel infrastructure. Analytics and Speed Insights (page views, performance metrics, IP addresses) run only on public marketing pages and adult (teacher, parent, admin) surfaces. They are never loaded on student surfaces or for student sessions.
Location: United States (primary), with global CDN edge locations
Resources: DPA: View DPA
Privacy Policy: View privacy policy
Security / Trust: View trust page

Supabase

Purpose: Primary database, file storage, and backend infrastructure.
Data processed: All educational records persisted by Algebro: student names, usernames, lesson progress, quiz scores, practice answers, and virtual currency balances.
Location: United States (us-east-1)
Resources: DPA: View DPA
Privacy Policy: View privacy policy
Security / Trust: View trust page

Note: Algebro executed Supabase’s customer DPA in July 2026. Supabase maintains its own subprocessor list (including AWS and Cloudflare) in Schedule 3 of its DPA.

Stripe

Purpose: Payment processing for parent subscriptions only. Stripe is not used for student, teacher, or school-issued accounts.
Data processed: Parent email address, billing address, and payment method details. Algebro stores only Stripe customer IDs and subscription status; no card numbers ever touch Algebro servers. No student, teacher, or school account data is sent to Stripe.
Location: United States
Resources: DPA: View DPA
Privacy Policy: View privacy policy
Security / Trust: View trust page

Note: Stripe acts as an independent controller for some activities (fraud prevention, regulatory reporting, and improvement of its own payments services) as described in its DPA and Privacy Center. For everything else related to Algebro subscriptions, Stripe acts as a processor.

Resend

Purpose: Email delivery for account notifications and the opt-in newsletter, sent to adult account holders only (parents, teachers, and school administrators).
Data processed: Recipient email address, recipient name, and the content of each email. Students never receive email: the send layer refuses to send to any student account, including students who have a school email on file from Google or ClassLink sign-in.
Location: United States
Resources: DPA: View DPA
Privacy Policy: View privacy policy
Security / Trust: View trust page

Note: Added August 2026. Every newsletter email carries a working unsubscribe link, and every send is logged on our side. Transactional notices (for example, a receipt-style account notification) go only to the account holder they concern.

Better Stack

Purpose: Uptime monitoring, the public Algebro status page, and error tracking (reports of crashes so we can fix them).
Data processed: Error reports: the error message, the code location (stack trace), the page address, the pages and network requests leading up to the error, and the browser and operating system type. Page addresses can contain internal record IDs, never names. Error reports leave out names, email addresses, cookies, request headers, request bodies, console output, and button labels, and invite links are scrubbed before sending. When a report is sent from a browser, Better Stack also sees that device’s IP address. Uptime checks only visit public pages and receive no user data.
Location: United States
Resources: DPA: View DPA
Privacy Policy: View privacy policy
Security / Trust: View trust page

Note: Added September 2026.

Notification of changes

Before adding a new subprocessor or materially changing the role of an existing one, Algebro will provide advance notice by:

Updating this page with the new subprocessor and the “Last updated” date
Notifying customers who have signed a data privacy agreement requiring such notice, on the timeline set in that agreement
Notifying customers who have opted in to subprocessor change emails (see below)

If a customer reasonably objects to a new subprocessor on data protection grounds, we'll work with the customer in good faith to resolve the concern. If we cannot reach a resolution, the customer may terminate their subscription and receive a pro-rated refund of any prepaid fees.

Get email notifications

To request email notifications of subprocessor changes (including if you are a school district privacy officer who is not the primary account holder), email privacy@algebro.ai with the subject line “Subprocessor change notifications” and we'll add you to the notice list.