Subprocessors
Last updated: August 11, 2026 · Version 2026-08-11.2
This page lists the current service providers that may handle personal data when supporting Wall St Math. Their legal role can vary by service and applicable terms: some act as processors on our instructions, while some may act independently for limited purposes described in their own terms.
It lives on its own page so that it can be kept honest. When we add a provider, this table changes — and we would rather you be able to check a short list than take our word for it buried in a longer document.
1. Current subprocessors
| Provider | What it does | Data it receives | Location | Safeguard |
|---|---|---|---|---|
| Supabase | Database, authentication, and storage — the primary system of record | Email, password hash, profile fields, drill history, analytics events; service and security telemetry may include IP address, user-agent, request time, and approximate location | United States (Oregon) | Provider security and privacy terms; retention depends on service and plan |
| Vercel | Application hosting and content delivery | Request metadata including IP address, user-agent, request time, device/browser and approximate location, processed for delivery, security, abuse prevention and diagnostics | United States, with a global edge network | Provider security and privacy terms; log retention is plan- and service-policy dependent |
| Google Analytics | Audience measurement | Page paths, referrers, events, analytics identifiers, device/browser and coarse location signals — consent-gated in strict regions and otherwise subject to the applicable analytics setting | United States | Google privacy and data-processing terms; retention and settings are service/plan dependent |
| Web3Forms | Relays feedback-form submissions to our inbox | Name, email/reply-to, subject, and message; Web3Forms also receives normal connection metadata such as IP address, user-agent and origin/referrer | United States | Provider terms; submissions may be retained up to one year on the service plan, and our inbox retains correspondence up to 24 months |
We are Canadian and our own operations sit in Canada, which the European Commission recognises as providing adequate protection for personal data.
2. Providers we anticipate adding
We are in an active growth phase and expect to introduce tooling in the categories below. Nothing here is in use today. Each will appear in the table above before it processes any personal data, and anything falling into the analytics or marketing consent categories will only operate where you have consented.
| Category | What it would receive | Consent category |
|---|---|---|
| Email delivery and marketing platform | Email address, name, engagement data | Reminder or marketing consent |
| Advertising and conversion tracking (e.g. Meta, Google Ads) | Analytics and advertising identifiers, conversion events | Marketing — off by default |
| Product analytics or session measurement | Usage events, page paths | Analytics |
| Error and performance monitoring | Error traces, which we would configure to scrub personal data | Strictly necessary |
| Payment processing | Handled entirely by the processor — we would never receive card details | Strictly necessary |
| Customer support tooling | Your correspondence and email address | Strictly necessary |
Search-engine and SEO tooling we use operates on aggregate site data from Google Search Console and does not receive personal data, so it does not appear as a subprocessor.
3. Our provider review standard
Provider contracts and dashboard settings must be verified operationally. When we onboard or renew a provider, our review covers:
- An applicable data processing agreement where the provider acts as our processor
- Appropriate contractual and technical safeguards, reviewed before onboarding
- Appropriate technical and organisational security measures
- An obligation to notify us of a security breach where the provider terms require it
- Deletion or return commitments where provided by the applicable service terms
- A restriction on engaging their own subprocessors without notice
4. Changes and objections
This page is versioned with the date at the top. If you object to a new subprocessor, write to hello@wallstmath.com. We will explain the role it plays and, where the processing rests on your consent, you can simply withhold it. Where you object to a provider that is essential to operating the service, the practical remedy is to close your account — which you can do yourself, with a full data export first, from your privacy settings.
Full context on how we use data is in the Privacy Policy.