Compliance
Sub-processors.
Last updated: 21 October 2026
The third parties listed below help us deliver Class Prayer. We name each one, what they do for us, what data they handle, and where the data sits. The list is kept in line with UK GDPR Article 28(2) and forms Schedule 2 of our school-facing Data Processing Agreement.
Current list
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Lovable Cloud (Supabase: Postgres, Auth, Storage) | Primary database, authentication and file storage. | All Class Prayer application data. | Republic of Ireland (AWS eu-west-1) |
| Lovable AI Gateway → Google (Gemini family models) | AI-assisted generation of prayer, theme and homily content. Google is the sole upstream LLM provider; no OpenAI or Anthropic models are used. | Scrubbed prompts - no pupil identifiers are sent. Inputs are not used to train models and are not retained by the model provider beyond the response. | EU (Lovable-managed routing; written confirmation available to school DPOs on request) |
| ESV API (Crossway) api.esv.org | Scripture text lookup. | Scripture reference strings only. No personal data. | United States (UK IDTA) |
| Lovable Emails (Mailgun upstream) | Account, magic-link and notification email delivery. | Recipient email address and template variables. | European Union (Mailgun EU region, Frankfurt) |
| Resend resend.com/legal/dpa | Service and product-update email to staff contacts who have opted in (mail.classprayer.app). | Staff name, work email address, school name and school code, plus delivery and unsubscribe status. No pupil data. | European Union (Resend EU region, Ireland) |
| Stripe Payments Europe, Ltd. stripe.com/gb/legal/dpa | Subscription checkout, card payment processing, invoicing and billing records. Not active until paid plans go live; no payment data is processed while the service is free. | Billing contact name and email, school name and billing address, subscription and invoice records. Card details are entered directly into Stripe's hosted checkout and never reach Class Prayer servers. No pupil data. | Republic of Ireland, with onward transfer to Stripe, Inc. (United States) under the EU/UK Standard Contractual Clauses and the UK Addendum |
Written attestations
Trust, but verify. We hold written attestations from our hosting and AI providers confirming that pupil content is never used to train models, is not retained beyond the response, and stays within the EU or another UK-adequate jurisdiction. Copies are available to school DPOs on request — see AI & hosting attestations.
Effective date
This sub-processor list is effective from 29 September 2026 and forms Schedule 2 of the Class Prayer Data Processing Agreement.
Stripe is listed in advance of paid plans going live, so that schools have the full 30 days' notice before any payment processing begins. While Class Prayer is free to use, no data is sent to Stripe.
Change notice
We give schools' nominated contacts at least 30 days' written notice before adding or replacing a sub-processor. Schools may object on reasonable data-protection grounds; if the objection cannot be resolved, the school may terminate the affected service without penalty.
Questions
Email info@classprayer.app.