Legal
Sub-processors
This list forms Schedule 2 of the Reading Fluency Data Processing Agreement.
Nectarwood Ltd uses the following sub-processors to deliver Reading Fluency. We will update this page whenever we add or change a sub-processor. For any questions, contact support@readingfluency.co.uk.
| Sub-processor | Purpose | Location | Data types | Safeguards |
|---|---|---|---|---|
| Supabase | Database hosting and authentication | UK (London) | All core data | SOC 2 Type II, GDPR compliant |
| Vercel | Application hosting and CDN | US | Metadata only | ISO 27001, SOC 2 Type II |
| Stripe | Card payment processing | US | Billing data | PCI DSS Level 1, EU-US DPF certified, UK Extension |
| Resend | Transactional email (confirmation, password reset) | US | Email addresses | EU-US DPF certified, UK Extension |
| Brevo | Marketing and onboarding email | EU (France) | Email addresses, names | GDPR compliant, ISO 27001 |
| Google Analytics | Usage analytics, marketing site only (with consent) | US | Usage data | EU-US DPF certified |
Google Analytics is used on the marketing site only (readingfluency.co.uk). It is not used within the authenticated application where pupil data is present.
We will notify schools at least 30 days before adding or replacing a sub-processor.
Last updated: 7 June 2026