Sub- processors.
Last updated 6 September 2026
These are the companies that process personal data on our behalf so Bluestift can work. Each one is here for a single named purpose and has no right to use the data for anything else.
Where we are today. Bluestift has just launched. We are working through each provider's data processing agreement, including the standard contractual clauses that cover transfers out of the EEA and the UK. Until this page says a given agreement is in place, assume it is still in progress — and if that matters to your decision, ask us and we'll tell you exactly where it stands. We would rather be checkable than sound finished.
Current sub-processors
| Provider | What it does | Data it sees | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage — the system of record | Everything stored: accounts, conversations, uploads, learning signals | EU |
| Vercel | Application hosting and scheduled jobs | Requests in transit, server logs | EU / US |
| Railway | Hosts the Kernel — the cognitive engine that reads each tutoring exchange and maintains the model of what a learner understands | The text of tutoring turns sent for analysis, learning signals, an account identifier | US |
| Google (Gemini) | Generates Raya's replies | The text of a tutoring turn and the context sent with it | US |
| Groq | Fallback model for replies, and speech-to-text for voice | The text of a tutoring turn; recorded audio when voice is used | US |
| PostHog | Product analytics — only for accounts that opted in, never under-18s | Page views, a few product events, an account identifier | EU |
| Cloudflare | Turnstile bot protection on public forms and sign-up | A challenge token and network metadata | Global |
| Resend | Transactional email — join requests and their decisions, plan activation, payment receipts | Email address and the message content | EU / US |
| CinetPay | Card and mobile-money payments | Payment details and the amount. We never store full card numbers | Africa / EU |
| Stripe | Card payments outside the mobile-money regions | Payment details and the amount. We never store full card numbers | EU / US |
| Google Classroom | Optional LMS import, only for schools that connect it | Course and roster data the school chooses to share | US |
What we require of them
- They process data only on our documented instructions, for the purpose named above.
- We use model providers on their API terms, which do not feed content into training of their public models.
- Transfers outside the EEA or the UK must be covered by Standard Contractual Clauses or an adequacy decision — see the note above on where we are with that.
- They are bound to confidentiality and to appropriate security.
Changes
We update this page before a new sub-processor starts handling school data, and notify school administrators by email. A school may object on reasonable data protection grounds — see the data processing addendum.
Raya works without several of these. A school that has not connected Google Classroom is never touched by that row; an account that declined analytics is never touched by PostHog.
Questions: hello@thebluestift.com.