Sub-processors
Last updated 2026-10-28
These are the companies that help us run OneLMS. Those marked “Yes” may handle the class and student data that schools keep on OneLMS, as sub-processors under our Data Processing Addendum (version 2.1). We have a contract with each that requires it to protect the data, and we stay responsible for them.
| Company | What it does | Location | Handles school data |
|---|---|---|---|
| Supabase | our main database and the sign-in system (accounts, enrolments, payments, class records) | South Korea | Yes |
| Vercel | hosts the website and the apps, and runs our servers | South Korea, with a global delivery network | Yes |
| Cloudflare | stores uploaded files such as images, documents, videos and recordings (R2 storage), and manages domain names and secure connections for school sites | global network | Yes |
| Zoom | runs live classes when a teacher or institute uses Zoom; your name, email and join details are shared so you can enter the class | several countries, including the United States | Yes |
| YouTube (Google) | plays or streams class videos and live classes when a teacher uses YouTube | several countries, including the United States | Yes |
| Google Gemini | powers the AI tutor: the questions you type to the AI tutor, and the study material the teacher supplied, are sent to Google to produce an answer (only where your teacher has switched the AI tutor on) | several countries, including the United States | Yes |
| Notify.lk and Dialog eSMS | send SMS messages such as sign-in codes, guardian approval codes, alerts and teacher notifications; they receive the mobile number and the message text | Sri Lanka | Yes |
| Our email provider (currently Hostinger mail servers; Google Gmail where configured) | delivers emails such as account, receipt and reset emails; it receives the email address and the message | outside Sri Lanka | Yes |
| Marx (payment gateway) | takes card and online payments; it receives the payment details you enter on its page and the amount and order reference | Sri Lanka | Yes |
| Browser push services (Google, Apple, Mozilla, Microsoft) | deliver browser notifications, only if you switch them on | several countries | Yes |
| Upstash (where switched on) | rate limiting: short-lived counters keyed on IP address and sign-in details, to stop attacks and abuse | outside Sri Lanka | Yes |
| Sentry (where switched on) | error monitoring; reports are scrubbed of phone numbers, email addresses, ID numbers and tokens before they leave our servers | outside Sri Lanka | Yes |
| Google Analytics, Meta and TikTok | measure visits and sign-ups and the performance of advertising, only if you accept advertising and analytics cookies; our server sends them the page address and a random event number | several countries, including the United States | No |
Changes
When we add or change a sub-processor in a material way, we give schools at least 14 days’ notice by email or on their dashboard. A school that objects for a good reason can close its account. Questions about this list can go to our privacy contact at support@onelms.lk.
Panoralink Business Solutions (pvt) Ltd (PV 00286766)