# WYG Subprocessor and Technical Service Provider List

**Status:** Pilot diligence draft; verify legal entities and contracts before signature  
**Updated:** August 23, 2026  
**Contact for changes or objections:** wygplaybookapp@gmail.com

WYG uses a deliberately small provider chain. A listed provider receives only the information necessary for its service and may not use student information for advertising, unrelated profiling, sale, rental, or another unrelated commercial purpose.

## Current providers

### OpenAI Sites

- **Purpose:** application source/deployment management and operation of the WYG Sites service.
- **Potential data:** application source, deployment metadata, and service data required to operate or support the hosted application.
- **Location and legal entity:** [CONFIRM IN SIGNED PROVIDER TERMS BEFORE PILOT].
- **Student-data role:** technical service provider to WYG; no independent school-data purpose.

### Cloudflare

- **Purpose:** edge delivery, Worker compute, D1 structured-data storage, R2 private-file storage, and related security/traffic operations.
- **Potential data:** WYG program records, private uploaded playbook sources, authenticated requests, network/technical data, and operational logs as necessary to host the Service.
- **Location and legal entity:** [CONFIRM IN SIGNED PROVIDER TERMS BEFORE PILOT].
- **Student-data role:** hosting and infrastructure provider; no independent school-data purpose.

## Providers not used by the current pilot build

The current pilot does not integrate an advertising network, third-party behavioral analytics provider, external athlete-email delivery provider, payment processor, biometric service, or public social plug-in. If WYG adds one, the School will receive the information required by the signed agreement before student-data disclosure.

## Provider requirements

Before receiving Student Data, each provider must be restricted to the contracted WYG purpose, prohibited from unrelated use and unauthorized further disclosure, and required to maintain reasonable security. WYG remains responsible for managing the provider relationship as stated in the signed School agreement.

## Notice and updates

WYG will provide this list to an Illinois School at the beginning of each State fiscal year, at the beginning of each calendar year, and when a material provider change occurs. Proposed advance-notice period for a new provider: [30 DAYS], except an emergency security replacement may occur sooner with prompt notice. The signed DPA should state the School's objection and remediation process.