Snapshot 17145
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Subprocessor Disclosure for the Boom Application Modified on: May 28, 2026 Effective Date: June 30, 2026 Boom App Subprocessors: These subprocessors may collect and store data about you on our behalf when you use the Boom App. Name Links to Policies Hosting Region Description Vimeo Vimeo United States Video hosting services. May collect personal data from students or adults if they watch an embedded video. We have signed a Data Processing Agreement for the EU. MongoDB Privacy Technical And Organizational Security Measures United States Where data entered into or created by the Boom App is stored. Encrypted in motion and at rest. We have a signed BAA with MongoDB. AWS Privacy Security United States The MongoDB database is hosted on AWS. Microsoft Azure Microsoft Trust Center United States Replica of select adult and entity data for business operations, product improvement, and account management. Galaxy/Meteor Cloud Privacy Security & Compliance Data Processing Agreement United States The Boom App that processes personal data is hosted here. HubSpot Data Processing Agreement Trust Center United States Used to support business operations, including account management, customer service, customer education, sales, and marketing. Some adult data is copied from MongoDB to HubSpot for these purposes. We have turned on GDPR controls. Freshworks Privacy Security United States Our historical customer service platform. Replaced during summer of 2025 with HubSpot. Retained only for archival purposes. No new data is collected. MessageBird Data Processing Agreement United States Used to deliver transactional emails like receipts and confirmations. Braintree Privacy United States Used to accept payments from adult users. Apple Pay and Google Pay integrations are available through BrainTree services. PayPal Privacy United States Used to pay Boom Cards publishers. Google Analytics G4 Privacy United States Web page visit analytics. We use analytics to understand how customers use our product. We have turned on GDPR controls. IPinfo.io Privacy United States High-level location insights derived from an IP address. Elastic Privacy United States Log aggregator used to monitor infrastructure and application logs in real-time to troubleshoot issues and detect anomalies. Ring Central Privacy United States Telephone services for customer support and sales. Integrated Subprocessors and Services: Some subprocessors only process your personal data if you (or the organization you work for) ask them to. We call these “integrated subprocessors.” You are solely responsible for your selection of an integrated subprocessor and should conduct your own due diligence to ensure the integrated subprocessor and the Boom App integration meet your needs. We are not responsible for the actions of integrated subprocessors. We support several authentication and rostering integrated subprocessors, like: Canvas, Classlink, Clever, Google, Schoology, and SAML. Others may be added from time to time. You can find links to connect the Boom App to your preferred integrated subprocessor in the Boom App. Canvas Users: If District allows integration to Canvas from its Boom user accounts, the District must require its users to conform to the Instructure Acceptable Use Policy for items used with Canvas. The experience of Boom Cards from inside Canvas differs from the direct Boom Cards experience: it has some additional features, and other features are unavailable. Google Add-on Users: If District enables its authorized users to use the Boom Cards Google Add-on, the District's use is subject to the Google Add-on Terms of Service Addendum and all Google Terms and Policies referenced therein. We may block any authentication and/or rostering service at any time if we believe that the service poses a security or privacy risk. We reserve the right to reject or immediately delete any personal data (such as a middle name) delivered to us by an authentication or rostering services if we decide that we don't need that personal data to deliver the services. We further reserve the right to modify imported personal data to remove the ability to use them to contact an identifiable person in the real world. If you create Boom Cards decks, we allow you to embed video from some third party services. See our FAQs for currently supported providers. See our Publisher Addendum to the Terms of Service for rights needed for decks you sell. We reserve the right to block or remove access to videos if we deem the video service provider poses a security or privacy risk or other risk to Boom or our users. You are responsible for determining if the video subprocessor you wish to use meets your legal and policy requirements for delivering content to students, including requirements about sharing data, consent, and advertisements.