Legal
Subprocessors
The companies we use to run the service, what each one does, and what data it receives.
Last updated October 19, 2026. Provided by FrontRow Software LLC.
1. Subprocessors
These companies process personal data on our behalf to provide FrontRow. Each is bound by data protection terms, as set out in our data processing addendum. AI providers are used only when staff use an AI feature, and never receive data from families or students directly.
| Company | What it does for us | Data it receives | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, database, file and media storage (S3), backups, email delivery (SES and SNS), website analytics queue (SQS) and video processing (MediaConvert) | All service data | United States |
| Stripe | Card and bank payments to studios, saved payment methods, and studio subscription billing | Payer name, email, payment method and payment amounts | United States |
| Twilio | Sending and receiving text messages | Phone numbers and message text | United States |
| Amazon Bedrock (AWS) | AI model for Scout, the staff assistant, and for generating ad images | A staff member's question and the studio records needed to answer it; ad image prompts | United States |
| Amazon Rekognition (AWS) | Checking that AI-generated ad images don't show people | Generated images only | United States |
| OpenAI | AI model for Scout, where used instead of Amazon Bedrock | A staff member's question and the studio records needed to answer it | United States |
| Expo, Apple and Google | Delivering notifications to the mobile app | Device push token and notification text | United States |
| Browser push services (Apple, Google, Mozilla, Microsoft) | Delivering notifications to a browser that turned them on | Push subscription and an encrypted notification | United States |
| Have I Been Pwned | Checking new passwords against known breached passwords | The first 5 characters of a password's hash; never the password | Global |
2. Integrations a studio turns on
These services receive data only if a studio connects them, on the studio's instruction. Their own terms and privacy policies apply, and the studio can disconnect them at any time.
| Company | What it does for us | Data it receives | Location |
|---|---|---|---|
| Intuit QuickBooks Online | Posting the studio's daily accounting totals | Daily ledger totals, with no family or student names | United States |
| Meta (Facebook and Instagram) | Running the studio's ads and receiving its lead form enquiries | Ad content and results; enquiries people send through the studio's lead forms | United States |
3. Content on studio websites
Studio websites built with FrontRow may load content from these providers, which then receive the visitor's IP address under their own privacy policies. They don't receive any studio records.
| Company | What it does for us | Data it receives | Location |
|---|---|---|---|
| Google Fonts | Fonts on studio websites | Visitor IP address and browser | United States |
| Google Maps, YouTube and Vimeo | Maps and videos a studio adds to its website | Visitor IP address and browser, when the content loads | United States |
4. Updates to this list
We give studio account owners at least 30 days' notice before adding or replacing a subprocessor, and update this page. Questions: privacy@frontrowhq.com.