Trust
Declare AI processes the absolute minimum personal data needed to provide the service. All data stays inside the UK and EEA. This page lists the sub-processors we share data with, our registrar of record, and a Record of Processing Activities (ROPA) placeholder for the LTI tool compute environment.
Sub-processors
Each sub-processor acts on our documented instructions under a written Article 28 contract. We notify institutional customers at least 30 days in advance of any sub-processor change.
| Sub-processor | Service | Region | Lawful basis |
|---|---|---|---|
| Supabase | Managed PostgreSQL (student declaration data, audit chain, admin auth) | European Union — Frankfurt | UK GDPR Article 28 (processor) |
| Render | LTI tool compute (app.declareai.co.uk) | European Union — Frankfurt | UK GDPR Article 28 (processor) |
| Sentry | Application error telemetry — PII scrubbed at SDK level | European Union | UK GDPR Article 28 (processor) |
| Vercel | Marketing-site hosting (declareai.co.uk) — no personal data | European Union | UK GDPR Article 28 (processor) |
| GitHub | Source code and CI | United States / EU | UK GDPR Article 28 (processor) |
Registrar of record
GoDaddy is the DNS registrar of record for declareai.co.uk and declare-ai.co.uk. GoDaddy holds no personal data and is not a sub-processor.
Record of Processing Activities — Render (placeholder)
- Sub-processor
- Render (Frankfurt)
- Data category
- Pseudonymous student LTI launch context
- Retention
- Per audit chain WORM — indefinite
- Region
- EU — Frankfurt
- Lawful basis
- UK GDPR Article 6(1)(e) — public task
- Onboarding date
- 2026-05-15
Permanent Record of Processing Activities lives in our compliance documentation; this page carries the placeholder until that document is published.