Current providers
| Provider | Role | Data processed | Region | Status |
|---|---|---|---|---|
| Neon | Managed PostgreSQL database | All application data, including health data and consent records | United States (AWS us-east-1) | In use |
| Vercel | Application hosting, file storage (Blob) and cookieless aggregate analytics | Application content in transit. In private storage: payment receipts, fitness certificates, scanned consent forms and message attachments. In public storage, behind hard-to-guess links: profile pictures and the school's and instructors' logos | United States (functions and files); traffic passes through its global network | In use |
| MercadoPago | Billing the monthly subscription the school pays DojoPro | The email of the subscribing account, which DojoPro passes to it to create the subscription; the amount and status of each charge; and an internal identifier of that account, used to match payment notifications. Payment details are entered by the payer directly at MercadoPago; DojoPro never sees them. DojoPro does not store the payer's email: of each MercadoPago notification it keeps only the notification's own envelope (identifiers, type, action and dates). Receives no student data | Argentina and LATAM | In use |
"In use" means the provider receives personal data from the system today. If we add a provider, or what a listed one receives changes, we publish it here with the advance notice described below.
How we announce a change
Before adding a new subprocessor, or changing the role of an existing one, we publish the change here and notify each school at least 30 days in advance.
During that period the school may object in writing, with reasons. If we cannot find a reasonable alternative, it may cancel the service without penalty and export its data.
An urgent replacement caused by a serious provider failure may happen before the notice period ends; in that case we notify immediately and explain why.
Contractual instruments
We have each provider's data processing agreement in place. Neon and Vercel host the data in the United States, a country the Argentine authority does not consider adequate. The transfer rests on each person's express consent, which we ask for at sign-up and on a screen at sign-in (for a minor, their guardian gives it); the agreements with the providers are an additional safeguard. The details are in the Privacy notice and the Data processing agreement. Schools can ask us for copies of the publicly available agreements and for the effective hosting region.