Sub-processors
Version 2026-09-21 · Updated 21 September 2026
We use a small number of third-party providers to deliver SchoolRota. Each is engaged under a written agreement with confidentiality and data protection terms, processes personal data only on our instructions, and is assessed before onboarding. This list forms part of our Data Processing Agreement.
Core infrastructure
These providers are used for every customer.
| Provider | Purpose | Data processed | Hosting |
|---|---|---|---|
| Fly.io | Application and database hosting | All customer data held in the service | United Kingdom, London (lhr) |
| Stripe | Subscription billing and payment processing | Billing contact name and email, school name, subscription and payment records | EU, UK, and US |
| Resend | Transactional email (invitations, publish notices, digests, rota PDFs) | Recipient name and email, message content and any attached rota PDF | EU and US |
Optional and marketing
These are used only where a school enables the feature, or only on our public website. AI features can be disabled for a tenant on request.
| Provider | Purpose | Data processed | Hosting |
|---|---|---|---|
| OpenAI | Optional AI assistance during setup and data import, and the optional assistant | Only the text or spreadsheet an administrator chooses to submit. Not used to train models | US |
| Apple Push Notification service | Staff companion app alerts on iOS and iPadOS when a school enables the app | Device push token and a generic alert body with no assignment detail | US |
| Google Firebase Cloud Messaging | Staff companion app alerts on Android when a school enables the app | Device push token and a generic alert body with no assignment detail | US |
| Expo | Relay staff-app push to Apple and Google | Expo push token and generic alert body | US |
| Google Analytics | Website analytics on our public marketing pages only | Marketing site usage, set only if a visitor accepts analytics cookies. No tenant data | EU and US |
Customer-initiated integrations
If you connect your identity provider, calendar, or management information system (for example Microsoft Entra ID, Google Workspace, Okta, or your MIS), data flows to and from that system under your own agreement with that provider. Those providers are not our sub-processors: you control the connection and can disconnect it at any time.
Where your data is stored
All production customer data is currently hosted in the United Kingdom (London), whichever country your school is in. We will update this page and notify account owners before customer data moves to any additional region. Our support and engineering team is based in the United Arab Emirates and may access data remotely to provide support, under confidentiality obligations, appropriate transfer safeguards, and audit logging. See the security page for controls and the privacy policy for transfer detail.
Changes to this list
We will update this page before a new sub-processor starts processing customer data, and notify account owners by email where the change is material. If you have a reasonable data protection objection to a new sub-processor, tell us at hello@schoolrota.com within 30 days and we will work with you on an alternative or, if none is available, you may terminate the affected subscription.