HallPal Subprocessors

Suggested public route: /subprocessors Last updated: 2026-08-08 Effective: {{EFFECTIVE_DATE}}

What this page is

This page lists every third-party service ("Subprocessor") that HallPal engages to process Customer or Student Personal Data on our behalf. Each Subprocessor is bound by contract to data-protection terms substantively equivalent to those HallPal offers you, including:

• Processing only on our documented instructions.
• Confidentiality obligations.
• Appropriate technical + organizational security measures.
• Cooperation with Data Subject requests.
• Deletion or return of Personal Data on termination.
• Timely Security Incident notification.

If you're evaluating HallPal, this page is the definitive answer to "who touches our data?"

1. Current subprocessors

#	Subprocessor	Purpose	Data categories	Location	Transfer mechanism
1	Vercel, Inc.	Web application hosting, CDN, serverless functions	All data in transit; short-lived logs	USA (primary regions: {{VERCEL_REGIONS}})	EU SCCs + Data Privacy Framework (DPF) certified
2	{{COMPANY_LEGAL_NAME}} (own infrastructure)	Self-hosted Supabase (Postgres 15, GoTrue Auth, Realtime, Storage, PostgREST) on colocated hardware	All data at rest	USA ({{DB_HOSTING_LOCATION}})	N/A (Processor's own infrastructure)
3	Anthropic, PBC	AI chat assistant (Claude language models)	Chat prompts + minimal school context (see PRIVACY.md §6)	USA	EU SCCs; contractually committed not to train on Customer inputs
4	Cloudflare, Inc.	Bot protection (Turnstile), HTTPS tunneling, CDN	For Turnstile: IP + browser fingerprint (verdict-only returned to HallPal); for tunneling: TLS-encrypted traffic only	Global CDN; primary origin USA	EU SCCs + Data Privacy Framework (DPF) certified
5	Resend, Inc.	Transactional email delivery (sign-in magic links, invites, notifications)	Recipient email address + message contents	USA	EU SCCs
6	Google LLC	Google OAuth sign-in (optional; only for admins who choose Google sign-in)	Email address + display name + Google avatar URL of admins signing in via Google	Global	EU SCCs + Data Privacy Framework (DPF) certified

Notes on specific entries:

• Entry 2 (self-hosted Supabase) is not, strictly, a third-party Subprocessor — HallPal operates the infrastructure on its own hardware. It is listed here for transparency + to make clear where the data resides.
• Entry 3 (Anthropic) applies only if an LEA has enabled the AI chat assistant. LEAs can disable the assistant from the settings page; when disabled, no data flows to Anthropic.
• Entry 4 (Cloudflare Turnstile) sees browser signals from sign-in page visitors but returns only a verdict token to HallPal. See PRIVACY.md §5 + https://www.cloudflare.com/en-gb/turnstile-privacy-policy/ for what Cloudflare specifically retains.
• Entry 6 (Google OAuth) applies only to admins who opt into Google sign-in. Magic-link sign-in via email does not touch Google.

2. What HallPal does NOT use

Explicitly not on the subprocessor list — HallPal does not use:

• Any advertising network, tracker, or analytics service that correlates users across sites.
• Any social-media SDK or pixel.
• Any AI model provider other than Anthropic (no OpenAI, no Gemini, no self-hosted LLM).
• Any customer-data-warehouse or data-brokering service.

We list this here because "what's not on the list" is often as useful to a procurement review as "what is".

3. Change-notification subscription

Per our commitments in DPA.md §5 and STUDENT_DATA_AGREEMENT.md §5, HallPal provides at least 30 days' advance notice of any material change to this list (adding, removing, or replacing a Subprocessor; changing the location or transfer mechanism of an existing one).

To subscribe:

• Email privacy@hallpal.divz.io with the subject line "Subscribe: Subprocessor updates" and the email address the notifications should go to.
• We'll confirm receipt within 5 business days.

To unsubscribe: reply to any notification email with "Unsubscribe" in the body.

Notifications go out via a plain-text email + a matching update posted to this page. RSS / Atom feed is planned; ETA TBD.

4. How to object

If you object to a new or changed Subprocessor within the 30-day notice window, email privacy@hallpal.divz.io with:

• Your school district or organization name.
• The specific Subprocessor at issue.
• The basis for your objection.

HallPal will work with you to address the concern (typically by scheduling a call within 5 business days). If the objection cannot be resolved within 30 days of the objection, per DPA.md §5 you may terminate the affected services without penalty + we will proceed to deletion of your Personal Data per DPA.md §7.

5. Change history

The most recent change is listed first. Every entry names the change, the effective date, and the notification date to subscribers.

Effective	Notified subscribers	Change
{{EFFECTIVE_DATE}}	(initial publication)	Initial subprocessor list published.

<!-- Every future change adds a row here. Preserve prior rows — this is an append-only history that districts audit. Example entries (delete when publishing): | 2026-09-01 | 2026-07-31 | Added: PostHog Inc (product analytics; aggregate + anonymized only; USA; DPF-certified) | | 2026-08-15 | 2026-07-16 | Replaced: Mailgun → Resend for transactional email. Data categories unchanged. | | 2026-06-14 | (n/a — remediation) | Removed: SendGrid (temporary provider during a Mailgun outage; all data purged from SendGrid within 24h of restoration). | -->

Contact

Subprocessor + privacy questions: privacy@hallpal.divz.io Legal + contracting: legal@hallpal.divz.io