What Subprocessors Are
Subprocessors are the third-party vendors Blueprint uses to run the service, and that may process personal data on our behalf as part of that work. This page is the current register of every subprocessor we use.
This register was last updated on July 16, 2026.
Current Subprocessors
Vercel
- Purpose
- Application hosting, AI Gateway routing, first-party web analytics, and invisible bot protection
- Data processed
- Application traffic; AI prompts and responses in transit; aggregated, cookieless page-view analytics; browser signals used for automated-abuse detection on signup, sign-in, and contact forms
- Location
- United States
Supabase
- Purpose
- Primary database and file storage
- Data processed
- Account and student data stored in Blueprint
- Location
- United States
Anthropic
- Purpose
- AI text processing
- Data processed
- AI prompts that may include student-written content, and generated responses
- Location
- United States
Google
- Purpose
- AI text processing
- Data processed
- AI prompts that may include student profile data, and generated responses
- Location
- United States
PostHog
- Purpose
- Product analytics and session replay
- Data processed
- Pseudonymized usage events and device metadata
- Location
- United States
Sentry
- Purpose
- Error tracking
- Data processed
- Error reports and request metadata
- Location
- United States
Resend
- Purpose
- Transactional email
- Data processed
- Recipient email address and email content
- Location
- United States
Stripe
- Purpose
- Payment processing
- Data processed
- Billing and payment details (Blueprint never stores card numbers)
- Location
- United States
Upstash
- Purpose
- Rate limiting and abuse prevention
- Data processed
- Client IP addresses and request counters
- Location
- United States
GeoNames (Unxos GmbH)
- Purpose
- International city autocomplete in the College Matchmaker quiz
- Data processed
- User-typed city search text and a country code, sent through a Blueprint server-side proxy; no account identifiers or client IP addresses are forwarded
- Location
- Switzerland
Meta Platforms, Inc.
- Purpose
- Advertising conversion measurement (server-side Conversions API)
- Data processed
- A hashed (SHA-256) email address from a waitlist signup or an account signup, the signup timestamp, a per-signup reference number used to de-duplicate, a short label for which part of Blueprint it came from, and when available an IP address, browser user-agent, and the address of the page the signup happened on, sent server-to-server to attribute signups to advertisements. No age is ever sent. No student work, quiz answers, essays, college lists, or profile data is ever sent; accounts provided by a school are never included; and nothing is sent about anyone under 13. Opt out at /do-not-share (recorded per browser)
- Location
- United States
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Application hosting, AI Gateway routing, first-party web analytics, and invisible bot protection | Application traffic; AI prompts and responses in transit; aggregated, cookieless page-view analytics; browser signals used for automated-abuse detection on signup, sign-in, and contact forms | United States |
| Supabase | Primary database and file storage | Account and student data stored in Blueprint | United States |
| Anthropic | AI text processing | AI prompts that may include student-written content, and generated responses | United States |
| AI text processing | AI prompts that may include student profile data, and generated responses | United States | |
| PostHog | Product analytics and session replay | Pseudonymized usage events and device metadata | United States |
| Sentry | Error tracking | Error reports and request metadata | United States |
| Resend | Transactional email | Recipient email address and email content | United States |
| Stripe | Payment processing | Billing and payment details (Blueprint never stores card numbers) | United States |
| Upstash | Rate limiting and abuse prevention | Client IP addresses and request counters | United States |
| GeoNames (Unxos GmbH) | International city autocomplete in the College Matchmaker quiz | User-typed city search text and a country code, sent through a Blueprint server-side proxy; no account identifiers or client IP addresses are forwarded | Switzerland |
| Meta Platforms, Inc. | Advertising conversion measurement (server-side Conversions API) | A hashed (SHA-256) email address from a waitlist signup or an account signup, the signup timestamp, a per-signup reference number used to de-duplicate, a short label for which part of Blueprint it came from, and when available an IP address, browser user-agent, and the address of the page the signup happened on, sent server-to-server to attribute signups to advertisements. No age is ever sent. No student work, quiz answers, essays, college lists, or profile data is ever sent; accounts provided by a school are never included; and nothing is sent about anyone under 13. Opt out at /do-not-share (recorded per browser) | United States |
AI Providers and Data Retention
Every Blueprint AI request to Anthropic and Google goes through the Vercel AI Gateway with zero data retention. Student content sent for AI processing is not retained by those providers beyond the request, and it is never used to train models.
Changes to This List
We give schools at least 30 days’ notice before adding or replacing a subprocessor. This page always reflects the current register.
Questions
If you have questions about our subprocessors, or if your school or district needs our FERPA Data Processing Agreement (DPA) template, contact us at support@applywithblueprint.com.