The vendors behind the service.
These are the third parties that help us run Photo Chalk, what each one does, and what data it can see. We add a vendor only when the service needs it — and we minimize what each one receives.
We’re finalizing this disclosure with legal counsel ahead of school agreements. It reflects how Photo Chalk operates today. Questions? Email privacy@photochalk.com.
| Vendor | Purpose | Data category | Region |
|---|---|---|---|
| Amazon Web Services (AWS) | Compute, storage, database, identity, encryption, logging, and email delivery (invites, reminders, receipts) | Rosters, photos, account data, and recipient email — encrypted at rest with tenant-scoped keys | United States |
| Optional “Sign in with Google” for photographer accounts | Photographer name and email for sign-in — no student data | United States | |
| Expo Application Services (EAS) | Build pipeline for the photographer mobile app | App source code only — no student data flows to EAS | United States |
| PostHog | Product-usage analytics and feature flags | Session and device metadata only — no student names or identifiers | United States |
| Stripe | Card processing and payouts to photographers | Parent payment details, tokenized on the device — card data never touches our servers | United States |
| WHCC (White House Custom Colour) | Printing and shipping photo orders | An EXIF-stripped print image and a shipping address — no student names or identifiers | United States |
Payments (Stripe) and print fulfillment (WHCC) begin processing data only once your school turns on those features.
Data minimization
Every vendor receives only the minimum data needed for its job. Analytics receives no student personal information — only opaque identifiers. Our print lab receives an EXIF-stripped image (no location metadata) and a shipping address, never student names or school identifiers. We don’t collect student birthdates, home addresses, medical info, or Social Security numbers at all.
Last updated: April 25, 2026
Need this for a vendor review?
Pair this list with our security posture and DPA process in the Trust Center.