We use essential and analytics cookies by default to improve your experience. Accept to also enable session recording and marketing cookies, or reject to disable all optional cookies. Cookie Policy
Sub-processors
Last updated: August 2026
A sub-processor is a third party that processes personal data on our behalf to deliver part of the GradeOrbit service. We list every sub-processor we use, their role, and their jurisdiction below. This page is the authoritative source — we update it whenever the list changes.
Under our Data Processing Agreement, which forms part of our Terms, schools are entitled to advance notice of any change to this list and may object before the change takes effect. A school’s Data Protection Officer can review the Data Processing Agreement at any time.
Wonde
School information system (MIS) sync — classes and student roster
Jurisdiction
UK — Wonde Ltd
Transfer mechanism
UK processing; no international transfer
Data accessed
Student names, year groups, class membership and school email addresses, read from the school’s own MIS. We do not request attendance, behaviour, medical, SEN, free school meals, safeguarding data, parent contacts or photos. Read-only: GradeOrbit never writes back to the MIS.
Only if you turn it on
Only where a school chooses to connect the Wonde integration. If a school does not connect it, no data from that school reaches Wonde through GradeOrbit. The school authorises the access itself in its own Wonde portal and can revoke it there or in GradeOrbit at any time.
Supabase
Authentication, primary database, file storage
Jurisdiction
EU (Frankfurt) — operated by Supabase Inc., US
Transfer mechanism
UK IDTA + EU SCCs
Data accessed
Account email and hashed credentials for teacher, school-staff, learner and (school tier) pupil logins; application records (assessments, criteria, credit balances). For schools on a DPA, also un-redacted student work, real student names and marking / AI-detection results, stored in private buckets under the school’s retention window. Learner-account work is also stored, unredacted, under the learner’s own consent, until the learner deletes their account. Solo and Team student work is redacted client-side and is not stored.
Google Gemini
AI marking, AI detection, transcription, suggested improvements
Jurisdiction
US — Google LLC
Transfer mechanism
UK IDTA + EU SCCs, no-training contractual stance
Data accessed
Solo tier: redacted student work pages (PII burnt out client-side), mark schemes, reference texts. School tier: unredacted student work pages under DPA, persisted in our storage for the active life of the assessment run only (default 90 days from completion, then deleted). Learner tier: unredacted work pages saved under the learner’s own account, until the learner deletes it. Inputs are not used to train Google’s foundation models under their no-training contractual stance. Per-school fine-tuning of a tenanted marking agent (school tier only) is documented in the Transparency Pack.
Google Cloud Vision
OCR for mark scheme and reference text uploads
Jurisdiction
US — Google LLC
Transfer mechanism
UK IDTA + EU SCCs
Data accessed
Mark scheme documents and reference text images uploaded by teachers. No student work is sent to Vision.
Resend
Transactional and product email delivery
Jurisdiction
US — Resend Inc.
Transfer mechanism
UK IDTA + EU SCCs
Data accessed
Recipient email address and message content (e.g. invites, receipts, account notifications). For schools that give pupils logins, this includes pupil email addresses, used only to send two transactional messages — a set-password link and a “your result is ready” notification. Grades and feedback are never included in email content.
Stripe
Payment processing for credit purchases and subscriptions
Jurisdiction
US / Ireland — Stripe Payments Europe Ltd.
Transfer mechanism
UK IDTA + EU SCCs (Stripe acts as an independent controller for payment data)
Stack traces, browser metadata, anonymised user IDs on opt-in feedback only. Default PII is disabled; session replay is not enabled.
Vercel
Application hosting, edge runtime, cron, geo-IP
Jurisdiction
US — Vercel Inc.
Transfer mechanism
UK IDTA + EU SCCs
Data accessed
HTTP request metadata (IP, user agent, country code) needed to serve the application and enforce UK-only access.
What we do not use
We do not use third-party advertising networks or behavioural analytics platforms beyond what is disclosed below. Analytics, session-recording, and marketing tools (Google Analytics 4, Hotjar, Meta Pixel, Google Ads) are disclosed in our Cookie Policy. Google Analytics 4 runs by default under the UK Data Use and Access Act 2025 statistical exception unless you decline it; session-recording and marketing tools (Hotjar, Meta Pixel, Google Ads) only run after you explicitly accept. Marketing tools never track student-role accounts.
