Legal
Sub-processors
Last updated: 15 June 2026
iyarn Pty Ltd (ACN 622 358 212) uses the third-party service providers listed below (“sub-processors”) to deliver the iyarn platform. Each sub-processor processes or stores data on iyarn’s behalf only to the extent needed to perform its function, under contractual terms that require appropriate security and privacy protections. This page is referenced from our Privacy Policy.
Core student and wellbeing data, and the application database, are stored and processed only in Australia (Amazon Web Services Sydney and MongoDB Atlas Sydney). The sub-processors below that operate outside Australia handle ancillary operational data only (for example transactional email, payment details, error telemetry and staff correspondence), not the student wellbeing dataset.
| Sub-processor | Purpose and data types processed | Lawful basis | Processing / storage location | More information |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting of the iyarn platform, including application servers, file storage, backups and email relay. Processes all platform data: account details (name, email), wellbeing check-in scores and comments, usage logs. | Performance of contract (service delivery) | Australia (Sydney, ap-southeast-2) | aws.amazon.com/privacy |
| MongoDB Atlas (MongoDB, Inc.) | Managed database hosting of platform data: account details, wellbeing check-in data, school/tenant configuration. | Performance of contract (service delivery) | Australia (Sydney) | mongodb.com/legal/privacy-policy |
| Stripe | Payment processing for subscriptions. Processes billing contact details and payment card information. iyarn does not store card numbers. | Performance of contract (billing) | Australia / United States | stripe.com/au/privacy |
| Twilio SendGrid | Transactional email delivery (invitations, password resets, notifications). Processes recipient names and email addresses and email content. | Performance of contract (service delivery) | United States | twilio.com/legal/privacy |
| Sentry (Functional Software, Inc.) | Application error monitoring. Processes technical error data and may incidentally process user identifiers contained in error context. | Legitimate interests (service reliability and security) | United States | sentry.io/privacy |
| Google Workspace (Google LLC) | Business email and document collaboration for iyarn staff, including customer support correspondence containing customer names and email addresses. | Legitimate interests (business operations) | United States / European Union | policies.google.com/privacy |
| GitHub (GitHub, Inc.) | Source code hosting and CI/CD for the iyarn platform. Does not process customer personal information in the ordinary course; access is restricted to iyarn engineering. | Legitimate interests (service development) | United States | github.com privacy statement |
| Intruder Systems Ltd | Continuous vulnerability scanning of iyarn’s external infrastructure. Processes technical infrastructure data only; no customer personal information. | Legitimate interests (security) | United Kingdom | intruder.io/privacy-policy |
| Cloudflare, Inc. | Bot protection (Turnstile CAPTCHA) on login and signup pages. Processes IP addresses and browser characteristics of visitors to those pages. | Legitimate interests (security) | United States (global edge network) | cloudflare.com/privacypolicy |
| WP Engine, Inc. | Hosting of the iyarn.com website, including the Friendly Schools online store (purchaser names, email addresses and order details). | Performance of contract (website and store operation) | United States | wpengine.com/legal/privacy |
| Anthropic (Claude models), accessed via Amazon Bedrock | AI assistance for drafting customer-support responses, and an optional staff content-authoring tool. Processes de-identified support-request text (identity details removed) and staff-entered prompt text only. No student personal information or wellbeing data is sent. The provider does not retain the data or use it to train models. | Legitimate interests (service delivery and support efficiency) | Australia (Sydney, ap-southeast-2) | anthropic.com/legal/privacy |
Changes to this list
iyarn reviews this list when sub-processors are added, replaced or removed, and updates this page accordingly. Material changes to how personal information is handled are notified as described in our Privacy Policy.
Questions
Contact our Privacy Officer at privacy@iyarn.com.au.