Vendor Transparency

Subprocessors

Last updated: February 5, 2026

We use a small set of vetted service providers to run the Lemonade Stand Business Plan. Below is the current, complete list — each is bound by contract to handle data per our Privacy Policy and applicable laws (FERPA, COPPA, GDPR).

Emergent Cloud

Purpose: Application hosting (Kubernetes)
Data processed: All platform data, in transit and at rest
Location: United States

MongoDB Atlas

Purpose: Primary database
Data processed: User accounts, lesson responses, business plans
Location: United States

OpenAI

Purpose: LemonBot AI coach, voice (TTS), and Whisper STT
Data processed: Chat prompts, lesson context (no PII), audio for transcription
Location: United States

SendGrid (Twilio)

Purpose: Transactional email — magic links, password reset, parent share
Data processed: Email address, name
Location: United States

Sentry

Purpose: Error tracking and monitoring (PII fields redacted at source)
Data processed: Error messages, stack traces, user ID (no PII)
Location: United States

PostHog

Purpose: Privacy-respecting product analytics
Data processed: Anonymized page views, feature usage (no PII)
Location: United States

Google Analytics 4

Purpose: Aggregated visitor metrics
Data processed: Anonymized IP, page views, referrer
Location: United States

Changes to this list

We notify school customers by email at least 30 days before adding or removing a subprocessor that handles student data. To subscribe to subprocessor change notices, email privacy@thewementality.com.