Subprocessors
Effective date: 30 September 2026
Overview
Pamoja.ai by myGalago engages a small number of third-party providers (“subprocessors”) to deliver the service. The table below lists every provider that processes Customer Data, the purpose, the categories of data, and the location of processing. Where a location reads “Being confirmed”, we are verifying the provider’s processing region and will update this page.
We update this list when subprocessors are added or replaced. Customers under a signed Data Processing Agreement receive reasonable prior notice.
Active subprocessors
| Provider | Purpose | Data processed | Location / transfer notes | Status |
|---|---|---|---|---|
| Supabase Inc. | Database, sign-in (email links, and the Google and Microsoft sign-in broker) and file storage | All Customer Data: children’s and donors’ records, documents, photos, messages, audit logs | Switzerland, Zurich (eu-central-2) | Active |
| Vercel Inc. | Application hosting: server functions, image optimisation, scheduled jobs, logs | All data passing between users and the database; cached copies of photos shown in the app; server logs of requests and errors | Server functions in Paris, Dublin, Frankfurt and London; pages delivered through Vercel’s global edge network | Active |
| Anthropic, PBC Available to staff of every foundation; there is no per-foundation switch. | AI features used by foundation staff: reading intake dossiers, report cards and school-fee receipts; drafting student and donor narratives; the in-app data assistant; programme analysis; email drafting | Children’s intake dossiers (including family circumstances and essays), report cards, fee receipts, names and grades; donors’ names, countries and giving totals | Being confirmed (Anthropic is a US company). Processing region, retention and model-training terms are being confirmed. | Active |
| Resend | All outgoing email (sign-in links, portal messages, receipts, newsletters) and delivery and bounce notices | Recipient name and email address, subject and message body (which can name a child), delivery events | Being confirmed | Active |
| Functional Software, Inc. (Sentry) | Error monitoring | Error messages, stack traces, page paths, browser and device type. Request bodies, cookies, query strings and IP addresses are not sent; email addresses are masked before sending. | European Union (Sentry EU data region, Germany) | Active |
| Google LLC | Sign in with Google. Google Drive, where a foundation keeps student documents, photos or videos there and links them in Pamoja; Pamoja downloads intake dossiers from Drive to read them with AI. Embedded Google Maps on staff school pages. | Name and email of the person signing in; children’s documents, photos and videos the foundation stores in Drive; the viewer’s IP address for map embeds | Being confirmed | Active |
| Microsoft Corporation (Entra ID) | Sign in with Microsoft | Name and email of the person signing in | Being confirmed | Active |
| Cloudflare, Inc. (Turnstile) | Anti-bot check on public registration and event RSVP forms | IP address, browser details, challenge token | Being confirmed | Active |
| OpenStreetMap Foundation | Address lookup (geocoding) and map tiles | Geocoding: school addresses, and a child’s home town and county (no name or other details). Map tiles: the viewer’s IP address and the area shown. | Being confirmed | Active |
| CARTO | Map tiles on the donor partnership presentation | The viewer’s IP address and the area shown | Being confirmed | Active |
| unpkg (public code delivery network) | Delivers the map library used on map pages | The viewer’s IP address | Being confirmed | Active |
| Stripe, Inc. | Subscription billing for foundations | The foundation’s billing contact and payment details; no children’s or donors’ data | Being confirmed | Active |
International transfers
The database is in Switzerland and the application runs in the EU and the UK, but some subprocessors above operate from outside the EU/EEA and Switzerland, or have not yet confirmed their processing region. Where personal data is transferred outside the EEA, transfers are protected using appropriate safeguards in line with Chapter V GDPR, typically the European Commission’s Standard Contractual Clauses, supplemented by additional technical and organisational measures where required.
Customer notice and objection
Customers under a signed DPA receive reasonable prior notice when a subprocessor is added or replaced and may object on reasonable data-protection grounds. To subscribe to subprocessor change notifications, write to marcbonischarancle@gmail.com.