Subprocessors
This page lists the subprocessors that may process personal data on behalf of SCORM Craft customers. It is incorporated into the Data Processing Addendum.
Current subprocessors
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, Workers, Containers, R2 object storage, email sending and network security | Global network; primary storage in the configured R2 jurisdiction | Data-processing agreement; Standard Contractual Clauses where required; security programme |
| Dodo Payments | Payment checkout, card processing, fraud prevention and payment records | United States and global | PCI DSS programme; data-processing agreement; Standard Contractual Clauses where required |
| GitHub, Inc. | Source-code hosting and CI/CD for deployments; no customer course content is intentionally stored there | United States | Data-processing agreement; access controls |
We do not use advertising, analytics or data-broker subprocessors. We do not sell personal data.
Changes and objections
We may add or replace a subprocessor as the service evolves. We will update this page and, where required by the DPA, give at least 30 days’ notice before a new subprocessor processes Customer Content. A customer may object on reasonable data-protection grounds by emailing privacy@scormcraft.app. If we cannot resolve the objection, the customer may terminate the affected Services as described in the DPA.
Contact
Questions about subprocessors: privacy@scormcraft.app.