Modified on: May 12, 2025
Effective Date: July 1, 2025
Name | Links to Policies | Hosting Region | Description |
Vimeo | Vimeo | United States | Video hosting services. May collect personal data from students or adults if they watch an embedded video. We have signed a Data Processing Agrement for the EU. |
MongoDB | Privacy Security |
United States | Where data entered into or created by the Boom App is stored. Encrypted in motion and at rest. We have a signed BAA with MongoDB. |
AWS | United States | The MongoDB database is hosted on AWS. | |
Microsoft Azure | Microsoft Trust Center | United States | Replica of select adult and entity data for business operations, product improvement, and account management. |
Galaxy/Meteor Cloud | United States | The Boom App that processes personal data is hosted here. | |
HubSpot | United States | Used to support business operations, including account management, customer service, customer education, sales, and marketing. Some adult data is copied from MongoDB to HubSpot for these purposes. We have turned on GDPR controls. | |
Freshworks | United States | Our historical customer service platform. Being replaced during 2025-2026 with HubSpot. | |
MessageBird | Data Processing Agreement | United States | Used to deliver transactional emails like receipts and confirmations. |
Braintree | Privacy | United States | Used to accept payments from adult users. |
PayPal | Privacy | United States | Used to pay Boom Cards publishers. |
Google Analytics G4 | Privacy | United States | Web page visit analytics. We use analytics to understand how customers use our product. We have turned on GDPR controls. |
IPinfo.io | Privacy | United States | High-level location insights derived from an IP address |
ActiveCampaign | Privacy | United States | Customer education emails and newsletters. Legal and system notices. |
Some subprocessors only process your personal data if you (or the organization you work for) ask them to. We call these “integrated subprocessors.”
You are solely responsible for your selection of an integrated subprocessor and should conduct your own due diligence to ensure the integrated subprocessor and the Boom App integration meet your needs. We are not responsible for the actions of integrated subprocessors.
We support several authentication and rostering integrated subprocessors, like: Canvas, Classlink, Clever, Google, Schoology, Microsoft, and SAML. Others may be added from time to time. You can find links to connect the Boom App to your preferred integrated subprocessor in the Boom App.
We may block any authentication and/or rostering service at any time if we believe that the service poses a security or privacy risk.
We reserve the right to reject or immediately delete any personal data (such as a middle name) delivered to us by an authentication or rostering services if we decide that we don't need that personal data to deliver the services.
If you create Boom Cards decks, we allow you to embed video from some third party services. See our FAQs for currently supported providers. See our Public Author Terms of Service for rights needed for decks you sell. We reserve the right to block or remove access to videos if we deem the video service provider poses a security or privacy risk or other risk to Boom or our users. You are responsible for determining if the video subprocessor you wish to use meets your legal and policy requirements for delivering content to students, including requirements about sharing data, consent, and advertisements.