Sub-processors
Last updated: 1 June 2026 Change notification: we will notify schools at least 30 days before adding or replacing a sub-processor that processes pupil personal data.
The following sub-processors are engaged to deliver the OMNIA Inclusion service. All are bound by a Data Processing Agreement equivalent to or stronger than the one we offer schools.
Infrastructure
| Sub-processor | Service | Data category | Location | Transfer basis |
|---|---|---|---|---|
| Supabase Inc. (via Lovable Cloud) | Database hosting, object storage, authentication | All School Data | EEA — AWS eu-west-1, Ireland | UK adequacy regulation for the EEA. No IDTA or SCCs required. |
| Lovable AB | Application hosting platform and development environment | All School Data (via Supabase) | EEA — AWS eu-west-1, Ireland | UK adequacy regulation for the EEA. Lovable Business plan DPA in place. |
| Cloudflare, Inc. | Edge compute (Workers), CDN, DDoS protection | Request bodies in-memory only; no persistence at the edge | Globally distributed; EU edge nodes preferred for EU visitors | UK IDTA / EU SCCs in Cloudflare DPA |
AI
| Sub-processor | Service | Data category | Location | Notes |
|---|---|---|---|---|
| Lovable AB (AI Gateway) | LLM request brokerage | Specialist report text, free-text fields — passed through a server-side PII scrubber before leaving our infrastructure | EU | Single chokepoint for all LLM traffic |
| Google LLC (Gemini API) | LLM inference for summarisation and QFT ideas | Same as above, post-scrub | EU regions where available; subject to Google's data-residency controls | We do not opt in to model training |
| OpenAI, L.L.C. (GPT models) | LLM inference for select features | Same as above, post-scrub | EU regions where available | We do not opt in to model training |
| School-managed AI provider (BYOK, opt-in) | When a school activates Bring Your Own Key on the Connected tier, AI traffic for that school is routed to the school's own Anthropic or Azure OpenAI account instead of OMNIA's Lovable AI Gateway. The school is the controller of its provider relationship. | Same as above, post-scrub | The school's chosen Azure region (e.g. UAE North, UK South) for Azure OpenAI, or Anthropic's published regions | Per-school opt-in. API key is AES-256-GCM encrypted at rest. No auto-fallback to OMNIA's shared key — failures surface to the school's admin. |
| Sub-processor | Service | Data category | Location |
|---|---|---|---|
| Microsoft Corporation (Microsoft Graph) | Sending parent-voice and notification emails from the school's own M365 tenant where enabled | Recipient email + body | The school's M365 region |
| (Pending) Transactional email provider | Service emails sent from our domain (e.g. magic-link, beta access) | Recipient email + body | EU — provider to be confirmed before general availability |
School-controlled MIS integrations (opt-in, per school)
| Sub-processor | Service | Data category | Location | Notes |
|---|---|---|---|---|
| Go4Schools Ltd. | School MIS — source of UPN, name, DOB, year group, attainment grades, baseline grades and SEND attributes for pupils at the connecting school | Pupil identifiers and assessment data | UK | Read-only pull initiated by OMNIA using a per-school API key generated and revocable by the school's Go4Schools admin. Schools that do not connect Go4Schools send no data to this sub-processor. We do not write back to Go4Schools. |
Operational / support tools (no pupil data)
| Sub-processor | Service | Data category | Location |
|---|---|---|---|
| Stripe, Inc. | Billing (when we begin charging) | Billing contact + payment metadata only | Globally; UK/EU data centres for EU customers |
| Cloudflare Email Routing | Inbound email to *@omnia-inclusion.com | Email metadata + body | Globally distributed |
We do not engage any sub-processor in a country without adequacy or equivalent UK / EU Standard Contractual Clauses in place.
Questions
Email privacy@omnia-inclusion.com.