Legal
Sub-processors
This list forms Schedule 2 of the Reading Fluency Data Processing Agreement.
Nectarwood Ltd uses the following sub-processors to deliver Reading Fluency. We will update this page whenever we add or change a sub-processor. For any questions, contact support@readingfluency.co.uk.
| Sub-processor | Purpose | Location | Data types | Safeguards |
|---|---|---|---|---|
| Supabase | Database hosting and authentication | UK (London) | All core data | SOC 2 Type II, GDPR compliant |
| Vercel | Application hosting, CDN and cookieless web analytics (marketing site only) | US | Metadata only | ISO 27001, SOC 2 Type II |
| Stripe | Card payment processing | US | Billing data | PCI DSS Level 1, EU-US DPF certified, UK Extension |
| Resend | Transactional email (confirmation, password reset) | US | Email addresses | EU-US DPF certified, UK Extension |
| Brevo | Marketing and onboarding email | EU (France) | Email addresses, names | GDPR compliant, ISO 27001 |
| Google Analytics 4 (Google LLC) | Usage analytics, marketing site only, loaded only with the visitor's consent | US | Pages viewed, page titles, referrer, campaign tags and short fixed event labels | EU-US DPF certified |
Google Analytics 4 is used on the marketing site only (readingfluency.co.uk), and only for visitors who choose “Accept all” on the cookie banner; a visitor who chooses “Essential only” causes no Google script to be requested and no Google cookie to be set. It receives pages viewed, page titles, the referring site, any campaign tags on the arriving link, and a small number of named events carrying short fixed labels only. It is never sent a name, an email address, a school, or free text. It is not used within the authenticated application where pupil data is present, and it is never present on any page showing pupil data.
Vercel Web Analytics is used on the marketing site only. It is cookieless: it sets no cookies, stores nothing on the visitor's device and does not track visitors across websites. Visits are counted using anonymised, aggregated data.
We will notify schools at least 30 days before adding or replacing a sub-processor.
Last updated: 1 October 2026