Wendel, Inc.
Subprocessors
Effective: May 16, 2026Last revised: May 16, 2026Version: 0.1 (draft)
§1Purpose
Wendel uses a small number of third-party service providers ("Subprocessors") to deliver the Services. This page identifies each current Subprocessor, the purpose for which Wendel uses the Subprocessor, the region in which the Subprocessor stores or processes data, and the category of data the Subprocessor receives. Schools may request a copy of the executed data-processing agreement with any Subprocessor by contacting privacy@trywendel.com.
§2Current subprocessors
| Subprocessor | Purpose | Region | Status |
|---|---|---|---|
| Supabase, Inc. | Primary Postgres database, object storage (uploaded club files), authentication infrastructure. | US (us-east-1) | Active |
| Vercel Inc. | Application hosting, serverless function compute, edge cache. | US (iad1) | Active |
| Resend, Inc. | Transactional email delivery (sign-in links, announcement emails, system notices). | US (us-east-1) | Pending DPA |
| Apple Inc. (Apple Push Notification service) | iOS push notification fan-out. | Apple-managed | Active |
| Google LLC (Google Identity) | OAuth identity provider for Google Workspace sign-in (when the School enables it). | Google-managed | Active |
§3Data category by subprocessor
Each Subprocessor receives only the categories of data necessary to perform its function. The applicable category is identified in the table above. Wendel does not authorize any Subprocessor to use Personally Identifiable Information from Education Records for any purpose other than the provision of services to Wendel, and each Subprocessor is bound by contractual data-protection obligations that flow through from Wendel's agreement with the School.
§4Notice of changes
Wendel will provide each subscribing School with at least thirty (30) days' advance written notice before adding a new Subprocessor that will process Personally Identifiable Information from Education Records, except where a Subprocessor is added on an emergency basis to prevent or remediate a security incident, in which case Wendel will provide notice as soon as reasonably practicable.
§5Right to object
A School may object in writing to the use of a proposed new Subprocessor that will process Personally Identifiable Information from Education Records. If the School and Wendel cannot agree on an acceptable alternative, the School may terminate the affected Services for cause and receive a pro-rata refund of any prepaid, unused fees attributable to the terminated Services.
§6Contact
Questions or objections regarding this Subprocessors list may be directed to privacy@trywendel.com.