Version: 2026.08 · Last updated August 24, 2026
| Vendor | Role | Purpose | Data processed | Student information | Website |
|---|---|---|---|---|---|
| Supabase | Subprocessor | Application database, authentication, and private file storage | All district-entered data, including student records, staff accounts, family contacts, uploaded plan documents, and audit records. Encrypted in transit and at rest. | Can include student information | supabase.com |
| Cloudflare | Infrastructure provider | Edge hosting, CDN, TLS termination, and DDoS protection | HTTP requests and IP addresses. Request content is processed in transit and in memory during request handling, and is not stored by this service. | Can include student information | cloudflare.com |
| Lovable | Infrastructure provider | Build, deployment, and hosting platform for the application and its server functions | Application builds and deployment configuration, server-side secrets, and operational logs. Logs record identifiers and outcomes rather than record content. | Can include student information | lovable.dev |
| Lovable AI Gateway | Subprocessor | The single approved boundary for AI requests; proxies to the model provider | Educator-authored text with student names replaced by placeholders, except two declared exceptions — district-uploaded plan documents and administrator-supplied staff lists — which are transmitted as provided and require human review before use. | Can include student information | lovable.dev |
| Google (model provider, reached only through the Lovable AI Gateway) | Subprocessor | Language and vision model inference for summaries and document extraction | The content described in the AI Gateway row above. StorylineIQ has no direct connection to this provider; provider-side retention and training-exclusion terms are documented by the provider, not by StorylineIQ. | Can include student information | ai.google.dev |
| Resend | Subprocessor | Transactional email: invitations, notifications, reports, and alerts | Recipient names and email addresses, plus message subject and body. Family-facing messages can include a student's first name. | Can include student information | resend.com |
| Stripe | Subprocessor | Subscription billing and payment processing | Billing contact details and subscription or payment metadata. No student information is transmitted to this service. | No student information | stripe.com |
How to read this list
"Subprocessor" means the provider processes district data on StorylineIQ's behalf under contract. "Infrastructure provider" means the provider runs or delivers the platform itself. Both categories are listed so district reviewers see the full set of services involved, not only the ones that store records.
Notification of changes
Districts under a Data Processing Agreement receive advance notice of material subprocessor changes per the terms of that agreement.