Subprocessors

This page lists the third parties ("Subprocessors") that MyLittleWorld Inc. engages to process personal data on behalf of the childcare Organizations that use our platform, in connection with our Data Processing Agreement. It is incorporated into that DPA by reference.

1. Vercel Inc.

Purpose: Application hosting, edge network, and CDN delivery of the MyLittleWorld platform.

Personal data involved: All personal data transmitted through the application in the course of normal use, including child profile data, health data, daily report data, photos/media, guardian contact data, and staff data, as it passes through or is cached at the hosting/edge layer.

Processing location: Global edge network; primary application compute is typically located in the United States.

2. Supabase Inc.

Purpose: Managed Postgres database hosting, user authentication, and file/object storage (including uploaded photos and media).

Personal data involved: Child profile data, health data, daily report data, photos/media, guardian/parent contact and payment history, and staff employment/scheduling data — effectively the full set of personal data categories processed by the Services, as this is our primary data store.

Processing location: Canada (ca-central-1 region).

3. Stripe, Inc.

Purpose: Payment processing for Organization subscription billing and, where enabled, guardian tuition/invoice payments.

Personal data involved: Guardian/parent contact information and payment/billing history (transaction records, payment method metadata). Stripe is PCI-DSS Level 1 certified; MyLittleWorld does not store full card numbers.

Processing location: United States (with Stripe's own global infrastructure as disclosed in Stripe's own subprocessor and privacy documentation).

4. Resend

Purpose: Transactional email delivery, including account verification, in-app notifications, and payment receipts.

Personal data involved: Guardian and staff contact information (name, email address) and the content of transactional notifications, which may reference child names or account activity.

Processing location: United States.

No advertising or data-broker subprocessors

None of MyLittleWorld's Subprocessors are engaged for advertising, data brokering, or resale of personal information. As of the date of this list, no AI/large-language-model subprocessor processes personal data on MyLittleWorld's behalf. If this changes in the future, this Subprocessor List and the DPA will be updated, and Organizations will be notified in accordance with the change-notification process below.

Notice of changes

MyLittleWorld will provide at least 30 days' advance notice (as set out in Section 5.3 of the Data Processing Agreement) before adding a new Subprocessor or replacing an existing one, by updating this page and, for Organizations subscribed to update notifications, by email.

Questions about this list can be directed to privacy@mylittleworld.ca.