Sub-processors

Last updated: March 25, 2026

This page lists the third-party service providers (“sub-processors”) that Tinyed uses to operate the Service. We maintain Data Processing Agreements (DPAs) with each sub-processor to ensure your data is handled in accordance with applicable privacy regulations including GDPR, COPPA, and the UK Children's Code.

Supabase (Supabase Inc.)

DPA signed

Purpose: Database hosting, user authentication, file storage, edge functions

Data Location: United States (AWS us-east-1)

Child Data Access: Nickname, age group, avatar ID, activity progress, creative content exports. No child email, location, or identifiers beyond what parents provide.

Razorpay (Razorpay Software Pvt. Ltd.)

DPA signed

Purpose: Subscription payment processing

Data Location: India

Child Data Access: None. Children never interact with payment systems. Only parent email and payment method are processed.

Vercel (Vercel Inc.)

DPA signed

Purpose: Application hosting, CDN, serverless functions, edge network

Data Location: United States (global edge network)

Child Data Access: Server access logs contain IP addresses (auto-purged after 30 days). No child PII is logged in application code.

PostHog (PostHog Inc.)

DPA signed

Purpose: Anonymized product analytics (COPPA-safe configuration)

Data Location: United States (PostHog Cloud US)

Child Data Access: Aggregated, anonymous event data only. All child-route events are stripped of identifiers via middleware. Session recording is disabled. Person profiles are disabled for child routes. Persistence is set to memory-only for child routes.

Changes to Sub-processors

We will notify registered parents via email at least 30 days before adding a new sub-processor that has access to child data. If you object to a new sub-processor, you may delete your account and all associated data before the change takes effect.

Home Privacy Policy Terms of Service