Sub-Processor Inventory

AgentChamp - Sub-Processor Inventory

Version 1.0 - effective 25 August 2026

Overview

UK GDPR Article 28 requires controllers - schools in the school flow, AgentChamp Ltd in the family flow - to know who their processor onward-engages. This inventory is the answer. It lists every third party that processes personal data in delivering AgentChamp, what each receives, and whether any child data is involved.

Authoritative version: this document. A new sub-processor is added here *before* its integration goes live, with notice to school administrators per the DPA.

AgentChamp Ltd - company number 17176256, ICO registration ZC230270.

Summary table

No child's personal data leaves the United Kingdom. The three US-processing providers receive, respectively: nothing routinely (Google - data at rest is pinned to London), an adult's email address (Stripe, Resend), and published text with no identifier attached (ElevenLabs).

1. Google Cloud (Google Ireland Ltd / Google LLC)

Location: europe-west2 (London) for every service that touches personal data. Transfer safeguard: Google LLC holds an active certification under the UK Extension to the EU-US Data Privacy Framework, adopted by Google Cloud as its transfer solution for UK customer data. Data at rest is region-pinned to London.

• Cloud SQL (PostgreSQL) - the primary database. As hosting infrastructure it stores all platform data, including pupils' names, reading records, and the consent audit trail
• Memorystore (Redis) - session revocation and rate-limit counters; ephemeral keys referencing user IDs
• Cloud Run - the application servers themselves
• Cloud Tasks - queues long-running story-generation jobs. The task payload carries content parameters only (persona, theme, reading level) - never a user identifier
• Cloud Logging - application and security logs, which include IP addresses and browser identifiers on authentication events. Retained 30 days
• Cloud Storage - story cover images (private bucket, 15-minute signed URLs) and story, quiz and dictionary audio (public-read buckets containing only synthesised speech of published text - no identifiers in file names, metadata or content)
• Cloud Text-to-Speech - receives story, quiz and dictionary text only, once at publish time; never user data
• Vertex AI - powers story and artwork generation (Google Gemini and Imagen, and Anthropic Claude models consumed through Vertex AI Model Garden). Receives content parameters only - themes, reading level, style; never anything about a user or pupil, and never any child's data

Google processes this data as infrastructure only. No Google service receives a request that identifies a pupil by name, and no children's data is used to train any model.

2. Microsoft Azure Speech (Microsoft Ireland Operations Ltd)

Location: UK South. Data does not leave the United Kingdom.

• Azure Speech - synthesises story narration audio with word-level timing, which is what allows words to highlight as they are read aloud. Receives story text only (and phonics sound data for early readers); no user identifiers appear anywhere in the request
• Microsoft's Products and Services Data Protection Addendum applies automatically to Online Services subscriptions and flows down the Article 28 obligations

No child data. Azure Blob Storage was previously used to cache narration audio; that moved to Google Cloud Storage on 5 August 2026 and no Azure storage service is now in use.

3. ElevenLabs (ElevenLabs, Inc.)

Location: United States. Transfer safeguard: the ElevenLabs Data Processing Addendum incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (version B1.0, 21 March 2022). It forms part of the terms of service rather than requiring separate signature.

• Synthesises the spoken audio for story narration, quiz questions and options, and dictionary words and definitions
• Receives published text only - the words of a story, a quiz question, or a dictionary entry. No user identifier, no pupil name, no account reference
• Audio is generated once, at publish time, and reused for every reader. Nothing about an individual child is ever sent, and no request can be attributed to a child. This is deliberate: per-child synthesis would be cheaper to build and would have meant sending a third party something tied to a reader

No child data.

4. Stripe (Stripe Payments Europe Ltd)

Location: EU, with processing in the US under Stripe's own safeguards. Transfer safeguard: belt and braces - Stripe is certified under the UK Extension to the EU-US Data Privacy Framework, and its Data Transfers Addendum incorporates the UK International Data Transfer Addendum as a fallback should the Framework ever be invalidated.

• Processes all payments: school analytics purchases, family subscriptions, teacher subscriptions, credit packs - all made by adults; children cannot purchase anything
• Receives: the paying adult's email address, our internal account reference (an opaque ID), and the transaction. Card details go directly from the payer's browser to Stripe and never touch AgentChamp's servers
• Webhook events Stripe sends back are verified against a signing secret, and the payment detail inside our stored copies is reduced to a bare summary after 180 days
• Stripe's fraud-detection component (m.stripe.network) loads inside Stripe's payment form and examines the device to distinguish a genuine payment from a stolen card. It loads only on adult checkout pages and never on any page reachable by a child. We leave it enabled because it is the protection against card fraud

No child data.

5. Resend (Resend, Inc.)

Location: United States. Transfer safeguard: Resend's Data Processing Addendum incorporates the EU Standard Contractual Clauses as amended by the UK Addendum.

• Our only email transport. Sends service emails to adults: account verification, password reset and password-changed notices, existing-account notices, purchase confirmations, subscription reminders
• Receives: the recipient adult's first name and email address, plus email content (which may include a school's name)
• Children have no reachable email address on the platform, so no email path can reach a child
• Resend's delivery webhooks are logged by domain only - we do not store the recipient address from them

No child data.

6. Resources the browser fetches directly

One, and only on adult checkout pages.

• Stripe.js (js.stripe.com, hooks.stripe.com, m.stripe.network) - the payment form and its fraud-detection component, loaded when an adult is entering card details

Everything else comes from us. Fonts, scripts and interface graphics are served from our own application origin.

One nuance stated precisely, because it is the kind of thing an inventory should not gloss: story cover images and story, quiz and dictionary audio are fetched by the reader's browser from `storage.googleapis.com` - our own Cloud Storage buckets. Google therefore sees the request, including the device's IP address. That is not a fifth-party exposure: Google Cloud is our hosting provider and is section 1 of this inventory. The distinction that matters is that no company outside this document sees a child's device - no advertiser, no analytics provider, no font host, no CDN.

Cover images are served through 15-minute signed URLs from a private bucket. The audio buckets are public-read and contain only synthesised speech of published text, with no identifier in any file name, metadata or content.

This was not always true. Until 25 August 2026 the display typefaces loaded from Google Fonts and the accessibility typefaces (OpenDyslexic, Atkinson Hyperlegible, Lexend) from the jsDelivr CDN, on every page including children's, and a placeholder image service served one fallback graphic. All four were removed and the files brought in-house.

7. Dormant and retired integrations

Retired - code and configuration removed; no data flows:

• Merriam-Webster (dictionary definitions and pronunciation audio, US) - removed 23 August 2026. The integration is deleted, both hosts are struck from the outbound allow-list and the content security policy, the API keys are abandoned, and the 635 cached rows were purged. Definitions are now written in-house and stored in our own database; pronunciation audio is synthesised and served from our own storage. This removed a sub-processor and a third-country transfer, and stopped a US host seeing children's device IP addresses
• Azure Blob Storage - narration audio cache; moved to Google Cloud Storage on 5 August 2026
• Azure Service Bus, App Configuration, Key Vault - SDKs deleted 4 August 2026

Dormant - configuration exists, no live code path calls them. Each would be added to the table above before any activation:

• Azure OpenAI - a question-generation path that was never enabled; quizzes use platform-authored questions marked server-side

Never used: advertising networks, behavioural analytics (Google Analytics, Mixpanel, Segment, PostHog, Hotjar and the like), social-media pixels, and third-party error-tracking or session-replay services. There is no third-party analytics or tracking code anywhere in the product, and none has ever been removed - there was never any to remove.

Onward-engagement process

When AgentChamp engages a new sub-processor:

• Legal and security review of the provider and its DPA, including its transfer safeguard
• Entry added to this inventory with all fields populated, before the integration goes live
• Schools notified 30 days before the integration goes live, per the DPA
• A school objecting on reasonable data-protection grounds may terminate the affected service if no resolution is found

A structural test in our test suite asserts that every third-party origin the application is permitted to contact appears in this document, so the inventory cannot silently drift out of date as the product changes.

Raising a concern

• Schools and their DPOs - privacy@agentchamp.co.uk
• Parents of school pupils - via your school's Data Protection Officer, who escalates to us
• Family subscribers - privacy@agentchamp.co.uk directly
• Regulators - this inventory sits alongside our Record of Processing Activities, which is our Article 30 record

Version history

• 1.0 (25 August 2026) - first published inventory. Merriam-Webster and Azure Blob Storage removed; ElevenLabs added; Google Cloud entry expanded to name Cloud Run, Cloud Tasks and Cloud Logging; browser-fetched third parties reduced to Stripe on adult checkout only, following the move to self-hosted fonts and images. Supersedes the 2026-04-14 and 2026-08-04 internal drafts, retained unedited in archive/