Fuzzy EdTech Inc ("FuzzyEd") uses the service providers below to run Pomegranate. Each one acts as a sub-processor: it processes personal data only on our instructions, only for the purpose shown, and under a written data processing agreement. Pomegranate is for teachers and school staff; it holds no student data.
Our live service is hosted by Amazon Web Services in Ireland, with backups in Sweden. Some providers below are based in, or process data in, the United States. See section 5 of our Privacy Policy for how each transfer is protected.
Sub-processors that receive personal data
| Provider | Purpose | Personal data it receives | Where data is processed | Lawful basis (UK GDPR) |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the live service: application servers, database, file storage, cache, content delivery, sign-in and logs | Teacher name, email, school and role; sign-in records, password hashes and two-factor settings; IP address; boards, lessons and uploaded files; logs | Ireland (eu-west-1); content delivery through the AWS global edge network | Contract |
| Amazon Web Services EMEA SARL | Backups and disaster recovery | Copies of the data above, kept for up to 90 days | Sweden (eu-north-1, Stockholm) | Contract; legitimate interests (keeping the service resilient) |
| Cloudflare, Inc. | DNS, content delivery and bot protection (Turnstile) on sign-up and contact forms | IP address and request details | Global edge network, including the United States; United States company | Legitimate interests (security and delivery of the website) |
| MailerSend (MailerLite group) | Transactional email only: sign-up, password reset, security codes and invitations. No marketing | Teacher name, email address and message content | European Union | Contract |
| PostHog, Inc. | Website analytics, only if you accept analytics cookies | Pseudonymous device ID, pages viewed, browser and device details | European Union (PostHog EU Cloud) | Consent |
| Mezmo, Inc. | Application log management | Pseudonymous request data: user ID, partly masked IP address, browser details and pages requested. No names or email addresses. Kept 14 days | United States | Legitimate interests (operating the service) |
| Functional Software, Inc. (Sentry) | Application error monitoring | Error details and browser type. User details, request bodies and IP storage are turned off. Kept 30 days | European Union (Sentry EU region) | Legitimate interests (operating the service) |
| Google LLC (Google Workspace) | Staff email and support email from schools | Name, email address, school and the content of support emails | Google data centres worldwide, including the United States | Contract; legitimate interests (support) |
| Slack Technologies, LLC | Internal staff chat and support discussion | Name, email address, school or user ID, only when a support case needs it. Deleted after 2 years | United States | Legitimate interests (support) |
| Notion Labs, Inc. | Internal documentation and support notes | Name or school, only where a support note needs it | United States | Legitimate interests (support) |
Other parties that can see your data
| Party | Why | Data | Where |
|---|---|---|---|
| Maths — No Problem! (publishing partner) | Manages the subscription and seats of schools that subscribe to its content through Pomegranate | School name, and the names and email addresses of users at that school. No access to other schools | Staff in the United Kingdom and Canada; data stays in AWS Ireland |
| FuzzyEd staff | Running and supporting the service | As needed for the task | Canada |
Tools that hold no personal data
We also use these tools, which do not receive school or teacher personal data: GitHub (source code and deployment), Linear (issue tracking) and DigitalOcean (serves the static front end of our internal admin tool; data goes straight from the browser to AWS in Ireland).
Changes to this list
We give schools at least 30 days' notice by email and in the app before we add a sub-processor that receives personal data, or move data to a new country. A school may object during that period. If we cannot meet the objection, the school may end its subscription and export its data. In an emergency, such as replacing a provider after a security incident or outage, we may make a change with shorter notice and will tell schools within 5 business days, with the reason. Removals are made without notice and shown here.
Questions about this list: privacy@pomegranate.so.
Last updated 28 October 2026