Back to Privacy
Sub-processors
SchoolMorph relies on a small number of vendors to deliver the service. Each one handles a specific function; collectively they are the only third parties that ever see any part of your project's data. We publish this list so schools can review it during procurement or vendor privacy reviews.
Supabase
- Function:
- Database, file storage, authentication
- Location:
- Sydney, Australia (AWS region ap-southeast-2)
- What they see:
- All project data: photos, student names, parent and teacher email addresses. Supabase holds SOC 2 Type II and ISO 27001 certifications; SchoolMorph runs on a paid Pro tier instance in the AWS Sydney region, so student data never leaves Australia.
Resend
- Function:
- Transactional email delivery (invites, reminders, 'video ready' notifications)
- Location:
- United States
- What they see:
- Parent and teacher email addresses plus the content of the messages SchoolMorph sends. No photos.
Stripe
- Function:
- Payment processing (where applicable)
- Location:
- United States / Ireland
- What they see:
- Payer name, email address, payment card details (handled directly by Stripe, SchoolMorph never sees card numbers), and the item being purchased, which for parent keepsake orders may include a student's name. No photos.
Vercel
- Function:
- Web application hosting + edge CDN
- Location:
- Regional edge, closest to the visitor
- What they see:
- HTTP request traffic in transit, including photo uploads passing through on their way to Supabase storage. No persistent storage on Vercel.
Fly.io
- Function:
- Runs the image-morphing worker that generates each student's video
- Location:
- Sydney, Australia (Fly.io 'syd' region)
- What they see:
- Each student's two photos during the brief window the worker is generating that student's morph (typically ~20 seconds per student), all within Sydney, so no student photo leaves Australia during processing. Nothing is retained on Fly after the worker uploads the finished clip back to Supabase.
Changes to this list
We update this page before adding, removing, or materially changing a sub-processor. If you have an active engagement with us under a written service agreement, we also notify you by email of material changes.
For a vendor security questionnaire response, data-processing agreement, or any other formal documentation, email schoolmorphing@gmail.com.
Last updated: 9 October 2026