Current status
This register describes the application and the supplier evidence available on 25 October 2026, with the GitHub testing and Claude beta updates of 26 October 2026. School adoption is not approved. Contracts, plan settings and deployed behaviour must be verified before a school's supplier annex is accepted. UK hosting alone is not a guarantee about all processing or international access.
| Service | Purpose and data | Location and safeguards / outstanding evidence |
|---|---|---|
| Vercel | Hosting, request/security logs; optional public-page analytics and performance measurement | This release configures functions for London; the earlier production deployment observed on 25 October 2026 reports the US region iad1. London execution awaits release verification. CDN, support and subprocessors can operate internationally. Current plan is Hobby; coverage under Vercel's published Pro/Enterprise DPA is not established. Eligible agreement/hosting and UK transfer safeguards are required. |
| Supabase | Teacher accounts, authentication, saved resources, history, feedback, usage records and private files | Project region verified as London (eu-west-2). The Free plan and built-in email were observed on 25 October 2026. Included project backups are unavailable; recovery covering database and uploaded file bytes is not established. Confirmation and TOTP are enabled, but production application enforcement, password/session suitability and log retention still need acceptance. Applicable DPA, UK transfer terms/assessment and international support/email processing remain to be recorded. |
| Anthropic | AI prompts, relevant permitted page context and text/vision responses for the default Claude models | Beta default from 26 October 2026. Anthropic acts as our processor under the Data Processing Addendum incorporated into its Commercial Terms, with UK Addendum transfer terms. It does not train models on API content. It deletes API inputs and outputs within 30 days by default, but content flagged by its safety systems can be kept for up to 2 years. Claude requests are processed in any of Anthropic's global regions; no EU or UK processing option is available. Zero data retention is not in place. Requests set global processing. The subprocessor list and the operator's Console agreement and settings are recorded separately. School adoption is not approved for this route. |
| OpenAI | AI prompts, relevant permitted page context, text/vision responses and generated images, for confirmed testers only | Existing approved testers can use the standard API endpoint while school-rollout approval is pending. EU routing is enabled only with the corresponding approved processing and retention settings. On 25 October 2026 the owner-confirmed production project showed Global residency and Standard retention, with API data sharing disabled. Provider approval, agreement, model eligibility and deployed release settings remain unverified. No promise of zero retention. UK safeguards/assessment must cover any applicable international access. |
| Supabase built-in authentication email | Sign-in and security email addresses/messages | The dashboard confirms built-in email and no custom SMTP. It warns this rate-limited service is unsuitable for production. A suitable production provider arrangement, contract, locations, delivery-log retention and transfer safeguards are a launch gate. |
| tldraw | Canvas software, licence validation | Canvas fonts/icons are served by Tumble. Hobby/trial licence telemetry can include the page URL; browser policy blocks it. A vendor-permitted configuration and suitable licence/contract remain unresolved. Blocking a request is not contractual approval. |
| Wikimedia Commons | Subject searches and image requests sent by Tumble's server | Wikimedia sees the search term/image path and server connection. The relay does not forward your browser IP, cookies, user agent or referrer. Wikimedia's infrastructure/terms apply; do not search for personal information. Image attribution/licences remain attached. |
| GitHub | Code hosting; automatic eligible tester feedback copies as private issues/comments and rating tallies | Owner confirmed GitHub Free and no agreed DPA on 26 October 2026. Designated adult testers can have new feedback copied after publication and notification, under an explicit testing policy. Copies are accessible to the operator and authorised repository collaborators. The personal-information filter can miss information; contract and international-transfer safeguards remain unresolved. Testing does not establish legal compliance or school approval. Other users and earlier feedback remain excluded; approved general export requires a separate evidenced decision. Historic and testing copies need separate review/removal. |
| Google email | Privacy/support correspondence sent to tumble.tools@gmail.com | The published contact is a Gmail address. Account/contract coverage, access/MFA, transfers and retention for business correspondence remain unverified. Send minimal initial details; do not send pupil records, credentials or identity documents unless a suitable secure route has been agreed. |
| Google sign-in | Optional identity service chosen by you | Google receives a request when you choose Google sign-in and processes it under its own terms. No background Google profile pictures are loaded. This is distinct from an automatically authorised school subprocessor. |
Gemini is retired from the application runtime. Historic assets and usage labels may still refer to it. Deployed removal, redundant-key revocation and any provider-side historical retention must be verified; retiring a provider does not erase earlier copies automatically.
Agreements and restricted transfers
The operator must preserve applicable executed agreements, subprocessor details, locations, UK safeguards (such as approved contractual provisions where appropriate), transfer assessments and review dates before school adoption. We do not claim a particular certification, adequacy decision or executed mechanism without evidence. The school receives the confirmed annex before signing. Published supplier terms can be read at Vercel DPA, Supabase DPA and OpenAI DPA; a link alone does not prove account coverage.
Get notice of supplier changes
Email tumble.tools@gmail.com with your work contact address and, if relevant, the school controller name. Ask to receive supplier change notices. We confirm receipt and registration; opening an email link does not subscribe you. Notices are operational, not marketing. Reply to stop voluntary notices or update the address. Accepted schools must maintain a reachable contractual privacy contact.
For accepted schools, the DPA requires at least 30 days' advance notice and a route to object before a new or replacement subprocessor is used. Proposed changes and objection outcomes are recorded. Urgent changes need specific written authorisation or suspension of affected processing.