Subprocessors & Service Providers
The third parties that process data on our behalf to operate KudoKids
Last updated: October 6, 2026
Kudo Kids, LLC (doing business as KudoKids) uses the third-party providers listed below to operate the KudoKids app and the kudokids.org website. Each provider receives only the data necessary for its function. We keep this roster on its own page so that it stays current as routine service providers change.
Third parties that receive children's personal information are named in the Privacy Policy itself — in Section 7, “Third-Party Service Providers” — and never only on this page. Before any new provider receives children's personal information, we add it to the Privacy Policy, which re-prompts parents to accept the updated policy when the change is material.
This page is a reference roster. Where it and the Privacy Policy differ, the Privacy Policy governs.
1. Service infrastructure
Providers that process parent and family Service data. Those that receive children's personal information are also named in Section 7 of the Privacy Policy.
| Provider | What it does | What it receives | Privacy & DPA |
|---|---|---|---|
| Supabase, Inc. | Cloud database, parent authentication (email one-time passcode), file storage, and real-time subscriptions. | All family data, including children's personal information, stored on Supabase's infrastructure in the United States (AWS us-west-2 region). | Privacy Policy · DPA |
| Stripe, Inc. | Payment processing for subscriptions and one-time purchases on the website and in the app on non-iOS platforms. iOS in-app purchases go through Apple instead. Stripe also pays our partners, sales representatives and nonprofit partners: it collects the payee's identity and bank details directly through its own onboarding, and we send it our internal identifiers for the payee and the program a payment comes from, and the details it needs to make each payment (for a nonprofit, including its tax identification number). No child data is involved. | The parent's payment details (card number, billing address), sent directly to Stripe and never stored on KudoKids servers, plus, to send receipts, grant the purchase and keep our purchase records, the buyer's email address, KudoKids account and family identifiers, plan selection, the confirmations the buyer gave at checkout, and the measurement details described in Section 7 of the Privacy Policy. No child data is sent to Stripe. A gift note is passed to Stripe as the buyer wrote it, so anything the buyer types in it, such as a child's name, reaches Stripe too. | Privacy Policy |
| Resend | Email delivery to parents — approval requests, security alerts, weekly reports — to adults who write to us through our website forms, and to gift buyers, who receive their gift email to pass on. | The recipient's email address and the notification content. No child data is sent to Resend. A gift note is included in the gift email as the buyer wrote it, so anything the buyer types in it, such as a child's name, reaches Resend too. | Privacy Policy |
| Expo / Expo Application Services | Push notification delivery to devices, and delivery of over-the-air app updates. | The device push token — a persistent identifier under COPPA — and the notification content. Notification payloads may include references to child profiles. Expo delivers each notification through the device maker's push service — Apple Push Notification service on iOS, Google Firebase Cloud Messaging on Android — which receives the push token and the notification's generic text. Separately, when the app starts or returns to the foreground it checks Expo's update service for a newer version of the app's code. Each check sends the device's network address, the app's runtime version, platform, and update channel, and a random identifier that the update software creates once for each installation of the app and sends with every check, from every device, including a child's. That identifier is a persistent identifier: it is not linked to any account, family, or child, and it is used only to deliver app updates. The check carries no account, family, or child data. | Privacy Policy |
| Sentry | Error monitoring and diagnostics. | Error context (stack traces, device information and the app's state, such as its mode and connection status), our internal account and family identifiers (neither is attached while a child is using the app); from an adult's own session, performance data about how the app runs (such as how long screens and network requests take), with the same identifiers, and none while a child is using the app; and, from our servers, the details of a payment problem we need to review, such as a refused billing country or a dispute, with Stripe's reference numbers. Session replay capture is turned off — no recording of the app screen is ever made or transmitted. In child mode, the trail of actions attached to an error is limited to structural events (which screen, app start and stop, and timing), identifiers are scrubbed out of it, and child identifiers are not transmitted. | Privacy Policy |
| Apple Inc.In-app purchases (iOS) | Processes subscription and one-time purchases made inside the iOS app, via App Store / StoreKit 2. | The parent's Apple ID, device identifier, payment instrument (handled entirely by Apple — KudoKids never sees card data), transaction metadata (product identifier, purchase date), and the purchasing parent's KudoKids account identifier, which Apple returns with the transaction so we can match the purchase to that account. No child data. Purchases can only be started from the parent-gated subscription screen; child profiles cannot initiate or complete a purchase. | Privacy Policy |
| Apple Inc. / Google LLCSpeech recognition | Converts speech to text for voice features. This happens on the device; voice features require on-device speech support and no audio is transmitted. | Nothing. Recognition runs on the device under Apple's or Google's own policies. KudoKids never receives the audio and never stores audio recordings. | Apple · Google |
| Google LLCGemini API | Powers KudoKids AI — our optional, subscription-only assistant for parents — reads a chore chart a parent photographs during setup and suggests routines and tasks, generates a title for a support ticket, and, in Companion Studio, turns an adult's request into concept images, reads a companion's name aloud in one of our cast voices, suggests lines for the adult to pick from, and checks a companion for safety before anyone else sees it. Available to parents and guardians only; children can never use it. | The parent's message, any photo the parent chooses to attach, and the family's parent-written task, routine, and reward names and coin values — or, for a chore-chart import during setup, the photos the parent chooses (sent as they are) and any description the parent types, with the same family context — or, for a support ticket, the ticket text — or, in Companion Studio, the adult's request for the companion (the picker choices, including any cards a child picked, and any short description), any reference picture the adult uploads (sent as it is), the companion's name, its chosen images, backstory and written lines, and, for a trailer clip of a listed companion, its images and backstory. Children's profile names in the text we send are replaced with anonymous placeholders; photos and pictures are sent as they are, so a name or face that appears in one reaches Google. We never add your children's ages, coin balances, activity history, or messages ourselves, but anything a parent types or shows in a photo, such as a child's age, is sent as written, and so is a name we don't recognize in what a parent types. A companion's name is checked against your children's profile names before it is used, so a companion never carries a child's name. We use Google's paid API tier, whose terms prohibit Google from using this data to train its models; Google may retain prompts briefly solely for abuse monitoring. | Privacy Policy |
| Google LLCCloud Vision API | Checks a reference picture an adult uploads in Companion Studio — whether it looks unsafe and whether it shows a person or a face — so we can refuse it. Adults only; a child never reaches this step. | The picture only; nothing about the family or a child is sent with it. The picture itself can show a child (a child’s drawing, or a photo that breaks our no-people rule and is then refused). We use the answer only to decide whether to refuse the picture. When we refuse one, we keep the reason (it looks unsafe, or it shows a person) with your family's account, never where in the picture anything was found. | Privacy Policy |
| TripoVAST AI Research | Turns the concept image an adult chooses in Companion Studio into the 3D companion model your family sees in the app. Adults only; a child never reaches this step. | Only the chosen concept image — itself generated by Gemini from the adult's request — with no name, account, family, or child identifier attached. | Privacy Policy |
| Google LLC / YouTubeVideo playback | Plays videos from parent-approved sources inside KudoKids' built-in web browser, through YouTube's privacy-enhanced embed (youtube-nocookie.com). Playback happens only for sources a parent has approved. | When a child browses approved videos, thumbnails load from Google's servers, and during playback the player receives the standard technical data any embedded video player receives, such as which approved video is playing; either way, Google receives the device's network address. We never send Google the child's name, profile, or anything the child types in KudoKids, and we designate this playback as child-directed, which YouTube says turns off personalized ads in the player. | Privacy Policy |
2. Website vendors and web-app hosting
These run on the kudokids.org website. Netlify also hosts the KudoKids web app, child mode included, and the Google booking window can also be opened from adult screens in the app. Apart from those two, none of these vendors runs inside the KudoKids app, loads on any child-reachable page — the pairing, sign-in, invite, redemption, and school-join routes a child could land on, where analytics and advertising are blocked regardless of consent — or receives child data. Consent categories, defaults, and the Global Privacy Control signal are described in our Cookie Policy.
| Provider | What it does | What it receives | Consent gating | Privacy |
|---|---|---|---|---|
| Google LLCGoogle Analytics 4 | Aggregate website traffic analysis. | Page-view and site-usage events, with IP anonymization enabled and no advertising, remarketing, or demographic features activated. Separately, a completed purchase paid through Stripe, on this site or in the KudoKids app, is reported to this same property server-side via the Measurement Protocol as first-party measurement, with its advertising signals always marked as denied. | Analytics category. On by default for US visitors with a one-click opt-out; opt-in everywhere else. Global Privacy Control honored. Never loads on a child-reachable page. The server-side purchase measurement runs regardless of cookie choice. | Privacy Policy |
| Microsoft CorporationMicrosoft Clarity | Session analytics — heatmaps and session replays. | Recordings of scrolling, clicking, and page navigation. Text typed into forms is masked before it leaves the browser. We instruct Microsoft to deny advertising storage for every visitor. Microsoft collects this data as an independent controller. | Analyticscategory — same defaults as Google Analytics above. Never loads on a child-reachable page. | Privacy Statement |
| Meta Platforms, Inc.Pixel + Conversions API | Measurement and optimization of our Facebook and Instagram advertising. | The Pixel sets _fbp/_fbccookies and sends event data about your visit (page views, content views, checkout starts, and clicks through to the KudoKids app or an app store), which reaches Meta with your network address and browser details. When you complete a gift purchase, our server sends that purchase — the only event it sends to Meta — to the Conversions API with a SHA-256 hashed email address and a hashed KudoKids account identifier, together with the _fbp/_fbc values, so Meta can match the purchase to the browser that started it. This is a “sale” and a “share” of personal information under the CPRA and similar state laws — see Do Not Sell or Share. | Advertising category. On by default for US visitors with a one-click opt-out; opt-in everywhere else. Global Privacy Control honored. If advertising consent is not active, no Pixel event and no Conversions API event is sent. | Data Policy |
| Google LLCGoogle Calendar appointment schedules | The scheduling window behind our buttons for booking a call with KudoKids, on this site and in the app. | Whatever you fill in on Google's booking form (your name, email address, the time you pick and any answer you give), which becomes an event on our company calendar, plus the standard connection information any website receives, such as your network address and browser. Nothing you entered on this site is passed to it. Calls are held on Google Meet, which Google hosts. No child data is ever sent to Google through it. | Loads only on click. Nothing from the scheduler runs on the page before you click to book, and closing the window ends it. Google applies its own cookie and privacy settings inside that window — they sit outside this site's analytics and advertising categories. | Privacy Policy |
| Netlify, Inc. | Hosts and serves the KudoKids website and the KudoKids web app, child mode included. | When you visit kudokids.org or use KudoKids in a web browser, child mode included, the device's network address and the standard request details any browser sends, such as the page address and browser type, kept in server logs as part of standard web hosting. On kudokids.org, Netlify also estimates your approximate region from the request, which the site uses to apply the right consent defaults. Netlify is also named in Section 7 of the Privacy Policy. | Essential. Hosting is required to serve the site and the web app, so it is not a consent category. | Privacy Policy |
3. Internal and operational tooling
Listed for completeness. The asset-generation tools below are part of how we build KudoKids and receive no user, family, or child data at all. The operational tooling below is different: our staff use it to run support and day-to-day operations, so it can process what we hand it while doing that work. Each row says which is which.
| Provider | What it does | What it receives |
|---|---|---|
| Higgsfield, Inc. | Image and video generation, used as an internal tool to produce companion character art, splash assets, and celebration loops. Generated assets are uploaded once to KudoKids' own storage or bundled with the app binary. | No user-generated content, child data, or family data is ever sent to Higgsfield. Prompts describe generic art assets only and contain no user-identifying information. |
| Google LLCGemini image generation, Lyria music generation | Image and music generation, used as internal tools to produce illustrations, icons, and background music. Generated assets are uploaded once to KudoKids' own storage or bundled with the app binary. | No user-generated content, child data, or family data is ever sent to these tools. Prompts describe generic art and music only and contain no user-identifying information. (This is separate from the Gemini API entry in Section 1, which does process parent content.) |
| Anthropic PBCOperational tooling | Staff-operated AI tooling that our team uses to draft support replies and to carry out engineering and database operations. A person on our team initiates and reviews every use; it is not connected to the app and no parent or child can interact with it. | Whatever our staff supply while doing that work, such as the text of a support request and the account records needed to answer it, which can include a child's profile or activity records, and, during engineering operations, data returned by queries our staff run against our own database. Our commercial terms prohibit Anthropic from using this data to train its models. Privacy Policy |
| Google LLCGoogle Workspace (operational tooling) | Hosts our company email and calendar, so it processes what you send us by email — including requests to privacy@kudokids.org — and the calls you book with us. Our staff use it; it is not part of the app. | What you write to us and the details of a call you book with us. Privacy Policy |
Separately, several components ship inside the KudoKids app and send no user content — Apple's Quick Look AR viewer and Google's Scene Viewer for augmented-reality companion previews, Apple's Face ID / Touch ID (LocalAuthentication), on-device face detectionfor the optional wellness camera features (Google's ML Kit on iOS and Android sends Google performance and usage metrics about the detector, with a device identifier that is not linked to any account, and never an image, a face, or anything that names your child or your family), and display fonts bundled at build time. They are described under “Additional providers” in Section 7 of the Privacy Policy.
Changes to this page
Providers that will receive children's personal information are added to the Privacy Policy first — which re-prompts parents to accept the updated policy when the change is material — never only here.
- 2026-08-17— page created.
- 2026-10-06— roster updated; see Last updated above.
Questions
Email privacy@kudokids.org with any question about a provider on this page, or write to Kudo Kids, LLC, 4030 Wake Forest Road, STE 349, Raleigh, NC 27609.