Subprocessors
Report-O-Matic Ltd uses the following categories of service providers to operate Report-O-Matic. School customers authorise these subprocessors under the Data Processing Agreement. This list may be updated; material changes will be reflected here.
| Provider | Purpose | Typical data | Location / transfers |
|---|---|---|---|
| Supabase | Database, authentication storage, and application hosting infrastructure | Account, school workflow, and report data stored in the service | Region depends on project configuration; may involve transfers outside the UK/EEA with appropriate safeguards |
| Resend | Transactional email (invites, security codes, account notices) | Email addresses and message content for operational emails | See Resend privacy/DPA documentation for locations and transfer mechanisms |
| OpenAI | Optional AI-assisted report comment drafting when enabled | Pupil first name (not surname), numeric rubric scores, subject context, and prompt instructions — as described in the privacy notice | May process in the United States or other regions; API terms apply |
| Cloudflare | Edge security and Turnstile human verification on the sign-in page | IP address, device signals, and challenge metadata | Global network; see Cloudflare privacy policy |
| Paddle | Merchant of Record for card checkout, tax calculation, and payment processing for report credit packs | Billing contact, payment method tokens, transaction metadata, and tax jurisdiction signals | Paddle entity and transfer mechanisms depend on account configuration; see Paddle privacy/DPA documentation |
| Wise | Operator business banking account for receiving Paddle payouts (not used for customer checkout on the site) | Business banking identifiers and payout records between Paddle and the operator | Banking relationship only; pupil report content is not stored with Wise |
For more detail on how personal data is used, see the privacy notice and data protection overview.
Last updated: 2026-05-30.