Subprocessors
Vendors Viva Longer LLC, doing business as Ashby Care, uses to provide the service. Version subprocessors-2026-09-09.
Effective: 9 September 2026. Version: subprocessors-2026-09-09.
Viva Longer LLC, doing business as Ashby Care, uses these vendors to provide the service. This list is the source of truth published at ashbycare.com/legal/subprocessors. Material additions are noticed under the DPA (email to the owner of record or an in-app banner).
Child-sensitive data is limited as noted. We do not put children’s names, photos, or care notes in email bodies or in product analytics.
| Vendor | Role | Data that may be processed | Where data is processed | Integral to core service? |
|---|---|---|---|---|
| Google Cloud (GCP) | Hosting: Cloud Run, Cloud SQL PostgreSQL, Cloud Storage (photos), Secret Manager, logging | Application data as stored in the product, including child and family records the Center submits; logs scrubbed of child-sensitive content | United States (us-west1) | Yes |
| Firebase Authentication (Google) | User sign-in (UID, email) | Adult account identifiers. Roles and child records live in our database, not in Firebase custom claims | United States | Yes |
| Stripe | Tuition and Ashby subscription payments | Adult billing identity, tokenized payment methods. No raw card numbers on Ashby servers | United States | Yes for billing |
| Twilio SendGrid | Transactional email to adults | Adult email address; message metadata. Do not put child-sensitive content in email bodies (link to log in instead) | United States | Operational email |
| OpenAI | Optional AI draft text, only after owner acceptance | Selected activity categories and draft length, or generic message purpose or school-announcement topic, plus tone; no child identifiers, profiles, medical details, photos, URLs, or conversations. Announcement dates, times, event choices, supplies, owner-approved school facts, and private saved wording stay inside Ashby and are not sent to OpenAI. No training; standard abuse-monitoring retention up to 30 days, with legal and safety exceptions. See Optional AI Terms. | Per OpenAI’s applicable terms; no regional-residency promise | No — off by default; separate owner opt-in |
| Product analytics (if enabled) | Feature telemetry | Feature events, error IDs. Zero child or adult personal information. If a vendor cannot guarantee that, we do not enable it | Per vendor | No |
Changes: material additions get notice under the DPA. Questions: privacy@ashbycare.com.
Marketing website measurement, separately from processing school records: Google Analytics and Google Ads (Google) receive public page and signup-event signals, browser/device and connection information. Advanced Consent Mode sends limited cookieless signals before a cookie choice and after Decline. Accept additionally enables analytics/advertising cookies and bounded ad-click/campaign attribution. No school records or form contents are sent; personalized ads, Google signals, and enhanced conversions are disabled. Cookie settings on marketing pages changes the cookie choice. See the Privacy Policy for details.
Terms · Privacy · DPA · Subprocessors · Optional AI terms