Sub-processor List
Third-party services engaged by Igloo Labs in the provision of the Spell & Grow for Schools service. Last updated February 2026.
Summary
| Sub-processor | Purpose | Data Centre Location | Personal Data? |
|---|---|---|---|
| Supabase Inc. | Database hosting, user authentication, file storage, and serverless edge functions | AWS eu-west-2 (London, United Kingdom) | Yes (limited) |
| ElevenLabs Inc. | Text-to-speech audio generation for words and sentences in spelling lists | United States | No |
| Vercel Inc. | Hosting and delivery of the teacher portal website and marketing website | Edge network (United Kingdom as preferred region) | No |
| Stripe Inc. | Subscription billing, payment processing, and invoice management for school subscriptions | EU / United Kingdom | Yes (limited) |
Detailed information
Full details for each sub-processor including data categories, purpose, and security certifications.
Supabase Inc.
supabase.comRegistered location
San Francisco, California, United States
Processing location
AWS eu-west-2 (London, United Kingdom)
Purpose
Supabase is our core infrastructure provider. It hosts the PostgreSQL database containing all school, class, teacher, and pupil data. It also provides user authentication (Supabase Auth) for teacher accounts, file storage for generated audio files, and serverless edge functions for application logic.
Data processed
Teacher accounts (email, name, hashed password), school configuration, class data, pupil records (first name, anonymous ID), pupil spelling progress, audio files
Security
SOC 2 Type II certified. Data encrypted at rest (AES-256) and in transit (TLS 1.2+). Row-level security policies enforce data isolation between schools.
ElevenLabs Inc.
elevenlabs.ioRegistered location
New York, New York, United States
Processing location
United States
Purpose
ElevenLabs provides text-to-speech audio generation. When a teacher creates a spelling list, the word text and example sentences are sent to ElevenLabs to generate spoken audio files. These audio files are then stored on Supabase Storage (in the UK) and served to the mobile app.
Data processed
Word and sentence text only (e.g., "necessary", "It is necessary to wear a coat in winter."). No teacher, pupil, school, or any personal data is transmitted to ElevenLabs.
Security
Only plain English word text and sentence text are transmitted. No personal or identifying information is included in any request.
Vercel Inc.
vercel.comRegistered location
San Francisco, California, United States
Processing location
Edge network (United Kingdom as preferred region)
Purpose
Vercel hosts the Next.js teacher portal and marketing website. It serves the web application, handles server-side rendering, and delivers static assets. Teacher account data (email, name, progress data) is fetched directly from Supabase by the client, not stored on Vercel.
Data processed
Teacher portal session data (encrypted authentication tokens in transit). Static marketing content. No pupil data is processed by or stored on Vercel.
Security
SOC 2 Type II certified. All traffic served over HTTPS with TLS 1.2+.
Stripe Inc.
stripe.comRegistered location
San Francisco, California, United States
Processing location
EU / United Kingdom
Purpose
Stripe processes school subscription payments, manages billing, and generates invoices. Schools interact with Stripe’s hosted payment pages and customer portal for subscription management.
Data processed
School billing contact name, billing email address, payment method details. No pupil data and no teacher account data is transmitted to Stripe.
Security
PCI DSS Level 1 certified (highest level of payment security certification). SOC 2 Type II certified.
Change notification policy
In accordance with our Data Processing Agreement, Igloo Labs will notify subscribing schools at least 30 days before engaging any new sub-processor or making material changes to existing sub-processor arrangements.
Notifications will be sent to the school administrator email address on record. If a school objects to a new sub-processor on reasonable data protection grounds, Igloo Labs will work with the school to find an alternative arrangement, as described in Section 8 of the DPA.
This sub-processor list is maintained as part of our Data Processing Agreement. A DPA between Igloo Labs and each sub-processor is in place.
DPA contact: schools@spellandgrow.app
This list is reviewed and updated whenever changes are made, and at least annually. Last updated: February 2026.
Questions about our sub-processors?
Contact us at schools@spellandgrow.app and we will respond within 2 working days.