What Subprocessors Are
Subprocessors are the third-party vendors Blueprint uses to run the service, and that may process personal data on our behalf as part of that work. This page is the current register of every subprocessor we use.
This register was last updated on October 18, 2026.
Current Subprocessors
Vercel
- Purpose
- Application hosting, AI Gateway routing, first-party web analytics, and invisible bot protection
- Data processed
- Application traffic; AI prompts and responses in transit; aggregated, cookieless page-view analytics; browser signals used for automated-abuse detection on signup, sign-in, and contact forms
- Location
- United States
Supabase
- Purpose
- Primary database and file storage
- Data processed
- Account and student data stored in Blueprint
- Location
- United States
Anthropic
- Purpose
- AI text processing
- Data processed
- AI prompts that may include student-written content, and generated responses
- Location
- United States
Google
- Purpose
- AI text processing
- Data processed
- AI prompts that may include student profile data, and generated responses
- Location
- United States
PostHog
- Purpose
- Product analytics and session replay
- Data processed
- Pseudonymized usage events and device metadata
- Location
- United States
Sentry
- Purpose
- Error tracking
- Data processed
- Error reports and request metadata
- Location
- United States
Resend
- Purpose
- Transactional email
- Data processed
- Recipient email address and email content
- Location
- United States
Stripe
- Purpose
- Payment processing
- Data processed
- Billing and payment details (Blueprint never stores card numbers)
- Location
- United States
Upstash
- Purpose
- Rate limiting and abuse prevention
- Data processed
- Client IP addresses and request counters
- Location
- United States
GeoNames (Unxos GmbH)
- Purpose
- International city autocomplete in the College Matchmaker quiz
- Data processed
- User-typed city search text and a country code, sent through a Blueprint server-side proxy; no account identifiers or client IP addresses are forwarded
- Location
- Switzerland
Google Workspace
- Purpose
- Business email for Blueprint's support and contact addresses
- Data processed
- Messages sent to Blueprint's email addresses, including the sender's email address and anything they write
- Location
- United States
Cal.com
- Purpose
- Scheduling calls booked from Blueprint's contact page
- Data processed
- The name, email address, organization, role, school size, and notes a person enters when booking a call, any guests they add, the meeting time and time zone, and a cancellation reason if one is given
- Location
- United States
Linear
- Purpose
- Internal follow-up tasks for booked calls
- Data processed
- The same booking details (name, email address, organization, role, school size, notes, guests, meeting time and link, and any cancellation reason), copied into an internal follow-up task
- Location
- United States
Meta Platforms, Inc.
- Purpose
- Advertising conversion measurement (server-side Conversions API)
- Data processed
- For an account signup or a purchase: a hashed (SHA-256) email address, the event time, a reference number used to de-duplicate, and a short label for which part of Blueprint it came from; a purchase also carries its amount and currency. A completed College Matchmaker quiz may be reported the same way without any email. When available, each event also carries an IP address, browser user-agent, the address of the page it happened on, and Meta's own browser and ad-click identifiers (the _fbp and _fbc cookies). Sent server-to-server to attribute signups and purchases to advertisements. No age is ever sent. No student work, quiz answers, essays, college lists, or profile data is ever sent; accounts we know were provided by a school are excluded; and nothing is sent about anyone under 13. Opt out at /do-not-share (recorded per browser)
- Location
- United States
| Vendor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel | Application hosting, AI Gateway routing, first-party web analytics, and invisible bot protection | Application traffic; AI prompts and responses in transit; aggregated, cookieless page-view analytics; browser signals used for automated-abuse detection on signup, sign-in, and contact forms | United States |
| Supabase | Primary database and file storage | Account and student data stored in Blueprint | United States |
| Anthropic | AI text processing | AI prompts that may include student-written content, and generated responses | United States |
| AI text processing | AI prompts that may include student profile data, and generated responses | United States | |
| PostHog | Product analytics and session replay | Pseudonymized usage events and device metadata | United States |
| Sentry | Error tracking | Error reports and request metadata | United States |
| Resend | Transactional email | Recipient email address and email content | United States |
| Stripe | Payment processing | Billing and payment details (Blueprint never stores card numbers) | United States |
| Upstash | Rate limiting and abuse prevention | Client IP addresses and request counters | United States |
| GeoNames (Unxos GmbH) | International city autocomplete in the College Matchmaker quiz | User-typed city search text and a country code, sent through a Blueprint server-side proxy; no account identifiers or client IP addresses are forwarded | Switzerland |
| Google Workspace | Business email for Blueprint's support and contact addresses | Messages sent to Blueprint's email addresses, including the sender's email address and anything they write | United States |
| Cal.com | Scheduling calls booked from Blueprint's contact page | The name, email address, organization, role, school size, and notes a person enters when booking a call, any guests they add, the meeting time and time zone, and a cancellation reason if one is given | United States |
| Linear | Internal follow-up tasks for booked calls | The same booking details (name, email address, organization, role, school size, notes, guests, meeting time and link, and any cancellation reason), copied into an internal follow-up task | United States |
| Meta Platforms, Inc. | Advertising conversion measurement (server-side Conversions API) | For an account signup or a purchase: a hashed (SHA-256) email address, the event time, a reference number used to de-duplicate, and a short label for which part of Blueprint it came from; a purchase also carries its amount and currency. A completed College Matchmaker quiz may be reported the same way without any email. When available, each event also carries an IP address, browser user-agent, the address of the page it happened on, and Meta's own browser and ad-click identifiers (the _fbp and _fbc cookies). Sent server-to-server to attribute signups and purchases to advertisements. No age is ever sent. No student work, quiz answers, essays, college lists, or profile data is ever sent; accounts we know were provided by a school are excluded; and nothing is sent about anyone under 13. Opt out at /do-not-share (recorded per browser) | United States |
AI Providers and Data Retention
Every Blueprint AI request to Anthropic and Google goes through the Vercel AI Gateway with zero data retention. Student content sent for AI processing is not retained by those providers beyond the request, and it is never used to train models.
Changes to This List
We give schools at least 30 days’ notice before adding or replacing a subprocessor. This page always reflects the current register.
Questions
If you have questions about our subprocessors, or if your school or district needs our FERPA Data Processing Agreement (DPA) template, contact us at support@applywithblueprint.com.