Subprocessor list

Grand Cayman Group Ltd. uses the service providers below to host and operate Workflow Academy. Each entry states what that provider processes on our behalf. Providers that are not yet configured in the current deployment are marked as such rather than listed as active. Payment processing is listed separately, because our payment provider is not a subprocessor acting solely on our instructions.

Supabase — managed PostgreSQL database, authentication, and file storage. Processes account identifiers, authentication metadata, learning records, submissions, and uploaded files.

Lovable — application hosting and edge runtime for the website and server functions, and the AI gateway used by the in-course tutor. Processes request metadata, and — for tutor conversations only — the lesson context and the messages a learner sends to the tutor.

Paddle is the merchant of record for all purchases. Paddle collects and processes payment and billing data, including card details, which never reach our systems; we receive order and entitlement events. Because Paddle sets its own purposes for payment, tax, and fraud processing, it acts as an independent controller or payment service provider rather than a subprocessor acting solely on our instructions, and its own terms and privacy notice govern that processing. Paddle's hosted checkout may set its own cookies when you start a purchase.

Transactional email provider (Resend) — an email adapter is implemented in the platform, but no live provider credentials are configured in the current deployment, so no learner email is sent to a third-party provider today. This entry will become active when the operator enables it.

We do not use advertising networks, analytics providers, session-recording tools, or data brokers, and the application code contains no tracking or analytics stack. The only third-party code the application loads is Paddle’s hosted checkout, and only when a purchase is started.

Where a change to this list is material, we will publish the updated list before the change takes effect. Each published revision is retained with its effective date.

Grand Cayman Group Ltd. · info@grandcaymangroup.com