Legal
Every third party that touches Gigsup user data, what it does for us, and where it runs. Last updated November 3, 2026.
A subprocessor is a vendor we use to deliver the service that may process personal information on our behalf. Every subprocessor is bound by contract to the same commitments we make to you: no sale of personal information, no advertising use, no profiling of students for non-educational purposes, and security obligations at least as protective as our own. We review each vendor before use and annually after that.
| Subprocessor | What it does | Data it touches | Region |
|---|---|---|---|
| Cloud hosting provider Named in the signed DPA schedule and confirmed before each school deployment | Application hosting, database, and backups | All service data, encrypted in transit and at rest | |
| Resend | Transactional and consented lifecycle email delivery | Email address, name, message content. Nothing is sent without a consent record. | United States |
| ZeroBounce | Checks that an email address can still receive mail before we email it, so messages don't bounce | Email address only. No name, date of birth or other account details. We delete the file once the results are back, and ZeroBounce deletes any copy within 30 days. | United States |
| Google Google Analytics and Google Ads | Measures visits to our public marketing pages and our Google advertising, with Google cookies only after you choose Accept. In Canada outside Quebec and in the United States it also runs before that, with no cookies: cookieless measurement signals only. When an account is created, our server also counts the sign-up in Google Analytics with the ad or link that led to it, and for a person 19 or older who accepted cookies, reports it to Google Ads. | On public pages: page address, referring page, browser and device details, IP address and, after Accept, Google cookies. From our server: whether the sign-up came from an ad and, for people 19 or older, the ad, link or campaign, the Google Analytics visit id and the ad's click ID. Never a name, email, date of birth, IP address or account. | United States |
| Meta Meta Pixel and Conversions API | Measures our Facebook and Instagram advertising, on public marketing pages only, and only after you choose Accept: under "Your privacy choices" in the footer in Canada outside Quebec and in the United States, or in the cookie banner elsewhere. Never when your browser sends Global Privacy Control. For a form submitted, or an account created by a person 19 or older, after you choose Accept, our server sends Meta the same conversion so it is counted once. | Page address, browser and device details, IP address and Meta cookies; from our server, the same browser details and IP address, your email hashed (never in plain text) and the ad's click ID. No name or form answers. | United States |
| TikTok TikTok Pixel and Events API | Measures our TikTok advertising, on public marketing pages only, and only after you choose Accept: under "Your privacy choices" in the footer in Canada outside Quebec and in the United States, or in the cookie banner elsewhere. Never when your browser sends Global Privacy Control. For a form submitted, or an account created by a person 19 or older, after you choose Accept, our server sends TikTok the same conversion so it is counted once. | Page address, browser and device details, IP address and TikTok cookies; from our server, the same browser details and IP address, your email hashed (never in plain text) and the ad's click ID. No name or form answers. | United States |
| LinkedIn Insight Tag | Measures our LinkedIn advertising, on public marketing pages only, and only after you choose Accept: under "Your privacy choices" in the footer in Canada outside Quebec and in the United States, or in the cookie banner elsewhere. Never when your browser sends Global Privacy Control. Never loaded in the student, parent or counsellor portals or on the sign-up form. | Page address, referring page, browser and device details, IP address and LinkedIn cookies. No name, email or form answers. | United States |
| Anthropic | AI processing for guidance features (career matching explanations, planning assistance) | Assessment and plan text processed transiently to generate results. Contractually excluded from model training: no student data is ever used to train AI models. | North America |
We add a subprocessor only after due diligence, and this page is updated before the change takes effect. Schools and districts with a signed agreement receive prior written notice of any new subprocessor and may object as their agreement provides. Anyone can ask questions about this register at hey@joingigsup.com with the subject line "Privacy Officer".
This document is a working draft prepared for review by qualified counsel in Canada and the United States before public launch. Hosting entries are confirmed at contract signing. Not legal advice.