Loading…
Last updated
DrivePlan uses a small number of service providers to run the platform. This page names every one of them, so a driving school can carry out its own due diligence and any individual can see who handles their data.
Each provider is bound by a data-processing agreement, may act only on our instructions, and receives only the data its job requires.
| Provider | Purpose | Data received | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Google Cloud / Firebase — Google Ireland Limited (in use) | Application hosting, database (Firestore), file storage, authentication | All account, learner, instructor, lesson, billing and document data | United States | Standard Contractual Clauses + transfer impact assessment — The Firestore database and the Cloud Storage bucket are located in the United States. Firestore locations are immutable, so relocating would mean creating a new database and migrating into it. |
| Google Vertex AI (Gemini) — Google Ireland Limited (in use) | AI features: summarising lesson feedback | Free-text lesson reviews, which may name a learner or instructor | United States (us-central1) | Standard Contractual Clauses + transfer impact assessment — Runs on Vertex AI under the Google Cloud data-processing terms, which carry the no-training commitment the consumer AI Studio endpoint does not. The region matches the database. |
| Amazon SES — Amazon Web Services EMEA SARL (in use) | Transactional email: lesson reminders, invoices, support and contact-form messages | Name, email address, and the content of the message | United States | Standard Contractual Clauses + transfer impact assessment — Sending runs from a US region, so message content is transferred outside the EEA. TODO — record the exact AWS region identifier for this entry (AWS names them us-east-1, us-west-2 and so on). |
| Stripe — Stripe Payments Europe, Limited (in use) | Subscription billing for driving schools | School billing contact and payment details | European Union and United States | Standard Contractual Clauses + transfer impact assessment — Card details are entered on Stripe’s own pages and never reach DrivePlan’s servers. |
| Google Maps Platform (Places) — Google Ireland Limited (in use) | Address autocomplete on signup and learner forms | The partial address text typed into the field, and the IP address | European Union and United States | Standard Contractual Clauses + transfer impact assessment |
| Firebase Cloud Messaging — Google Ireland Limited (in use) | Push notifications for lesson reminders | Device token and notification content | European Union and United States | Standard Contractual Clauses + transfer impact assessment |
| Google Analytics 4 — Google Ireland Limited (optional — off unless enabled) | Marketing website audience measurement | Truncated IP address, device and page-view data | European Union and United States | Standard Contractual Clauses + transfer impact assessment — Loaded on www.driveplan.net only, and only after the visitor consents. Declining means the script is never requested. |
| AI assistant connections (MCP) — The provider of the AI assistant a school chooses to connect (optional — off unless enabled) | Letting a school operate DrivePlan through an external AI assistant, if it enables the integration | Whatever the connected assistant requests within the connecting user’s own permissions. Identity documents, dates of birth, addresses, guardian contacts and uploaded files are withheld unconditionally. | Depends on the provider | Under review — Off unless a school turns it on. A data-processing agreement with the chosen AI provider is required before enabling it. |
Items marked "under review" are transfers whose mechanism we are in the process of confirming or changing; they are listed rather than omitted so the register stays honest about work in progress.
We notify schools before a new sub-processor starts processing personal data, so there is time to object.
If a school objects on reasonable data-protection grounds and we cannot offer an alternative, it may terminate the affected service without penalty.
Write to privacy@driveplan.net for a copy of any agreement, or with an objection to a listed provider.