Subprocessors
Third parties that process personal data on Pro Coach Studio's behalf.
Last reviewed: 2026-09-29.
This is not legal advice. It is an engineering record of what the code actually sends where.
Current subprocessors
| Provider | Purpose | Data it receives | May receive student data | Location |
|---|---|---|---|---|
| Google Cloud Platform / Firebase (Google LLC) | Hosting (Cloud Run), database (Firestore), authentication (Firebase Auth), asynchronous jobs (Cloud Tasks, Cloud Scheduler) | Everything the product stores | Yes | United States (Cloud Run us-west1; Firestore nam5 US multi-region) |
| Google Gemini API (Google LLC) | Generating practice plans, message drafts, documents, fundraising and travel content; extracting rosters and box scores from uploads; the Assistant Coach chat | Whatever a coach types into a tool; uploaded roster/box-score images and documents in full; up to 25 roster names sent as matching hints during box-score extraction | Yes | United States |
| Resend (Resend, Inc.) | Delivering team emails | Recipient email address, message subject and body, coach's name and reply-to address | Yes | United States |
| Google Maps Places API (Google LLC) | School-name autocomplete on signup, profile, admin and travel screens | A school-name or address search string, sent from the visitor's browser only after they have typed at least 3 characters and paused. Never a per-keystroke stream | No | United States |
| Google Identity Toolkit (Google LLC) | Sending password-reset and email-verification messages | Email address | No | United States |
| Google Workspace / Gmail SMTP (Google LLC) | Delivering the in-app feedback form | Submitter's name, email address, and message | No | United States |
| Twilio (Twilio Inc.) | SMS delivery | Configured but not sending: the outbound SMS channel is a hard stub and no message has been sent through it. The inbound STOP webhook is live so carrier opt-outs are honoured if it is ever enabled | Not currently | United States |
| Google Analytics 4 (Google LLC) | Marketing-site traffic measurement | Page views and standard GA identifiers, on the marketing site only, and only after a visitor accepts in the cookie banner | No | United States |
| ipapi.co | Country lookup during account creation, enforcing the US/CA/MX signup allowlist | The visitor's IP address, sent server-side on every signup attempt | No | Not verified - see note below |
ipapi.co is the one row here that is not fully answerable. Its operating entity and data-processing location are unverified, and a district security questionnaire will ask for both.
What is not a subprocessor
- The signed-in application runs no third-party analytics. GA4 was removed from every app template on 2026-09-25 and its hosts were dropped from the Content-Security-Policy, so a page that tried to reload it would be blocked rather than silently start reporting on signed-in coaches.
- The signup page no longer calls ipapi.co from the browser. That call was removed on 2026-09-25. ipapi.co is still a subprocessor and is listed in the table above: the server-side eligibility check, which was always the real gate, sends the visitor's IP to ipapi.co on every signup attempt. Only the browser-side call went away. (Earlier wording here read as though the server-side check resolved the IP locally. It does not - it is an outbound transfer to a third party.)
- The per-request geographic block makes no third-party call. It uses
geoip2fast, which bundles its own offline country database, so the EU/EEA/UK/Swiss block that runs on every request sends nothing anywhere. - No object storage of user uploads. Roster photos and documents are read into memory, sent to Gemini, and discarded. Only extracted text is kept.
AI processing
Gemini is currently reached through the Gemini Developer API using an API key, not Vertex AI. The two have different data-use terms, and this distinction is the honest answer to the first question on every district security questionnaire.
Until a migration to Vertex AI lands, the accurate statement is: content submitted to AI features is processed by Google under the Gemini API terms, and Pro Coach Studio does not use it to train any model.