Sub-processors

The third parties that process school data on Karo's behalf, and what each one receives.

Last updated 17 August 2026

Sub-processor	Purpose	Data received	Location	Status
Lovable Cloud (Supabase infrastructure)	Hosting, database, authentication, file storage, backups	All categories in section 3, at rest	European Union	Live
Africa's Talking	WhatsApp and message delivery	Recipient phone number, message body, document link	Kenya	Live
Paystack	Payment collection and settlement to the school	Payer name, email or phone, amount, school subaccount reference	Nigeria and South Africa	Live
Mailgun (via Lovable email infrastructure)	Transactional email delivery	Recipient email, subject, rendered body, document link	European Union and United States	Live
Cloudflare	Edge delivery and bot protection (Turnstile) on sign-up	Requesting IP address and challenge token. No school records	Global edge	Live
Smile ID	Identity verification, integrated but not switched on	Nothing in production. Sandbox test data only	Kenya and Nigeria	Sandbox only, no live data
GoDaddy	Domain registration and DNS for karoschool.net	No school or guardian records. Karo's own registrant and billing details only, plus DNS lookups	United States	Live

Notice before a change

Karo will give every subscribing school at least 30 days' written notice, by email to the school's registered contact and by an update to this page, before a new sub-processor begins processing school data, and before an existing one is replaced. A school that objects on reasonable data-protection grounds may raise the objection within that notice period; if the objection cannot be resolved, the school may terminate the affected service without penalty for the remainder of the paid period. Emergency substitutions to keep the service running are notified within 5 days of the change, with the same objection right.