Subprocessors
Vendors Viva Longer LLC, doing business as Ashby Care, uses to provide the service. Version subprocessors-2026-10-28.
Effective: 28 October 2026. Version: subprocessors-2026-10-28.
Viva Longer LLC, doing business as Ashby Care, uses these vendors to provide the service. This list is the source of truth published at ashbycare.com/legal/subprocessors. Material additions are noticed under the DPA (email to the owner of record or an in-app banner).
Child-sensitive data is limited as noted. We do not put children’s names, photos, or care notes in email bodies or in product analytics.
| Vendor | Role | Data that may be processed | Where data is processed | Integral to core service? |
|---|---|---|---|---|
| Google Cloud (GCP) | Hosting: Cloud Run, Cloud SQL PostgreSQL, Cloud Storage (photos), Secret Manager, logging | Application data as stored in the product, including child and family records the Center submits; logs scrubbed of child-sensitive content | United States (us-west1) | Yes |
| Firebase Authentication (Google) | User sign-in (UID, email) | Adult account identifiers. Roles and child records live in our database, not in Firebase custom claims | United States | Yes |
| Google Cloud Vertex AI (Google) | Hey Ashby (the “Chat”), the chat for every Center’s staff and families (and the sign-up chat, when the person setting up a Center chooses it). Google’s Gemini models only | Masked chat text: the person’s words and earlier turns, with names replaced by placeholders and phone numbers, email addresses, street addresses, birth dates, and ID, case, card, and account numbers replaced by tags; the parts of a sentence about health, allergies, diet, medicine, injuries, custody, or incidents held back. Masking is automatic and can miss unusual wording. Masked facts from the Center’s records needed to answer, such as dates, times, amounts, counts, statuses, and the names of the Center, its locations, and its rooms, and staff-written titles such as event and rate names. No photos, files, child profiles, or medical records; private details typed into chat forms go only to Ashby. No training; Google may cache inputs and outputs for up to 24 hours and log prompts for abuse monitoring under its Google Cloud terms; not Zero Data Retention. See Section 9 of the Privacy Policy. | United States (Vertex AI us location) | Yes — used for the Chat, part of every Center’s service |
| Stripe | Tuition and Ashby subscription payments | Adult billing identity, tokenized payment methods. No raw card numbers on Ashby servers | United States | Yes for billing |
| Twilio SendGrid | Transactional email to adults | Adult email address; message metadata. Do not put child-sensitive content in email bodies (link to log in instead) | United States | Operational email |
| OpenAI | Optional AI draft text, only after owner acceptance. (OpenAI also measures ChatGPT ads for Ashby’s own marketing; see Advertising measurement below.) | Selected activity categories and draft length, or generic message purpose or school-announcement topic, plus tone; no child identifiers, profiles, medical details, photos, URLs, or conversations. Announcement dates, times, event choices, supplies, owner-approved school facts, and private saved wording stay inside Ashby and are not sent to OpenAI. No training; standard abuse-monitoring retention up to 30 days, with legal and safety exceptions. See Optional AI Terms. | Per OpenAI’s applicable terms; no regional-residency promise | No — off by default; separate owner opt-in |
| Product analytics (if enabled) | Feature telemetry | Feature events, error IDs. Zero child or adult personal information. If a vendor cannot guarantee that, we do not enable it | Per vendor | No |
Changes: material additions get notice under the DPA. Questions: privacy@ashbycare.com.
Advertising measurement
These vendors help us measure our own website and ads. They are not used to process school records and receive no Customer Data. Personalized ads, Google signals, and enhanced conversions are off, and Google Ads runs with restricted data processing turned on. Cookie settings at the bottom of marketing pages changes the cookie choice. A Global Privacy Control signal from the browser counts as Decline on ashbycare.com and in the Ashby app. Details are in Section 4 of the Privacy Policy.
| Vendor | Purpose | Data that may be processed | Where data is processed | When |
|---|---|---|---|---|
| Google Analytics and Google Ads (Google) | Measure ashbycare.com page views and signup-button clicks | Event, public page address, consent state, and browser, device, and connection information such as IP address. After Accept also: Google cookies, Google ad-click identifiers, allowlisted campaign labels, and the referring site’s domain. No form contents | Per Google’s applicable terms; no regional-residency promise | Limited cookieless signals before a choice and after Decline; cookies only after Accept |
| Google Ads (Google) | Count four sign-up milestones from the Ashby app (sign-up form shown, account created, email verified, school created) through a separate page on ashbycare.com, so the Google tag never runs in app pages | The milestone, that page’s fixed ashbycare.com address, that it was opened inside app.ashbycare.com (never which app page), consent state, and browser, device, and connection information. With consent also: Google Ads cookies and a random one-time ID for a created school. No app page addresses, form values, names, email addresses, or account or school identifiers | Per Google’s applicable terms; no regional-residency promise | New-school sign-ups; without advertising cookies unless you accepted them; never for invitation or join sign-ups |
| OpenAI (ChatGPT Ads) | Count new schools that came from a ChatGPT ad | Sent from Ashby’s server, one event per new school: a random event ID, the time, a fixed source address, and the ChatGPT ad click reference (oppref) if one was saved. No names, email addresses (plain or hashed), phone numbers, account or school identifiers, addresses, IP addresses, or child data. Marked with OpenAI’s opt-out flag | Per OpenAI’s applicable terms; no regional-residency promise | Only with cookie consent and never for invitation or join sign-ups. No OpenAI script runs on ashbycare.com or in the app |
Terms · Privacy · DPA · Subprocessors · Optional AI terms