Subprocessors
Who handles data for us
The services Money Matters uses, what each one gets and when. We tell schools with a signed agreement before we add a new one.
| Service | What it does | Data it handles | When |
|---|---|---|---|
| Cloudflare | Hosting, content delivery and the server functions | All traffic passes through it. IP addresses are used only for short rate limits (counters that expire within an hour) and are not saved with any account or record. | Always |
| Supabase | Database for accounts and progress | Adult accounts; student records encrypted (AES-256-GCM) before they are stored | Always (hosted accounts) |
| Resend | Email to adults | Adult email address and the message (welcome, reset codes, security notices, renewal reminders). Students get no email. | Always |
| Stripe | Card payments | The buyer’s name, email and payment details. Card numbers go to Stripe only. | Only when an adult pays by card |
| Clever, ClassLink | School single sign-on and rostering | The roster the district shares: names, grades, classes | Only when the school turns it on |
| Google, Microsoft, Facebook | Sign-in for adults | Name and email the adult agrees to share | Only when an adult uses it |
| Google Classroom | Sending grades to a teacher’s Google Classroom | The teacher’s class list and each matched student’s grade; the teacher’s browser talks to Google directly | Only when a teacher sends grades |
| Canvas, Schoology (LTI 1.3) | Assignments and gradebook scores | The score for each assignment | Only when the school connects it |
| Cloudflare Web Analytics | Page visit counts | No cookies, no local storage, no fingerprinting | Only when the site owner turns it on |
A downloaded copy of the app keeps its data on the device and uses none of these. Questions: [email protected].