Subprocessors
Effective: April 27, 2026 · Last updated: May 14, 2026
BellPlan engages the third parties below to deliver the service. Each is contractually bound to data-protection terms equivalent to our Data Processing Addendum and processes data only on BellPlan’s documented instructions. This page is the canonical, current list — the DPA and Privacy Policy both point here.
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase | Database, authentication, and file storage | School operational data, staff identity data, authentication metadata | United States (East) |
| Vercel | Web hosting and edge delivery | Request metadata; no data at rest | Global edge, primary United States |
| Resend | Transactional email (task assignments, reminders, alerts) | Staff name and work email, message content | United States |
| Stripe | Subscription billing and customer portal | Billing-contact data and payment method tokens only — no school operational data | United States |
| Sentry | Error reporting and monitoring | Stack traces and request metadata; PII filtered before send | United States |
| PostHog | Product analytics | Hashed user identifier only — no raw email or name | United States |
BellPlan does not process student personally identifiable information, FERPA-covered education records, or COPPA-covered data, and none of the subprocessors above receive such data.
We will provide thirty (30) days’ notice before adding or materially changing this list. To receive change notices or object to a subprocessor, email privacy@bellplan.app.