Sub-processors
Last updated: 2026-05-13
This page lists the third parties (sub-processors) that StudyQuest engages to deliver the StudyQuest service. It is incorporated by reference into the Data Processing Agreement between StudyQuest and each customer.
How to receive change notifications
To receive at least thirty (30) days' advance notice of additions or replacements, subscribe at hello@studyquest.app.
Active on all StudyQuest deployments
Infrastructure and data storage
Supabase
Role. Managed PostgreSQL database, authentication, file storage, realtime channels, and serverless edge functions.
Data categories. All categories of Personal Data described in Annex 1 of the DPA: identity, authentication, educational content, usage, communications.
Region. Stockholm, Sweden (eu-north-1).
Transfer mechanism. Not applicable (intra-EEA processing).
Documentation. Supabase DPA · Supabase Privacy Policy
Netlify
Role. Web hosting, content delivery network, and build infrastructure for the static frontend.
Data categories. IP address, browser metadata, request paths. No structured pupil records pass through Netlify storage.
Region. Global edge network with origin in the United States.
Transfer mechanism. EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) where applicable.
Documentation. Netlify GDPR / CCPA · Netlify Privacy Policy
Generative AI
OpenAI
Role. Large language model used to generate quiz questions from Controller-supplied study materials and to power the in-app study assistant.
Data categories. Study material text submitted by teachers; pupil questions submitted to the study assistant. No persistent pupil identifiers are sent.
Region. United States.
Transfer mechanism. EU Standard Contractual Clauses (Module Three).
Retention by sub-processor. Zero Data Retention (ZDR) is enabled on the StudyQuest API account: API inputs and outputs are not retained by OpenAI and are not used to train OpenAI’s models.
Documentation. OpenAI DPA · OpenAI Enterprise Privacy
Transactional email
Resend
Role. Delivery of transactional emails (account verification, password reset, school invitations, service notifications).
Data categories. Recipient email address, message metadata, message body.
Region. United States.
Transfer mechanism. EU Standard Contractual Clauses (Module Three).
Documentation. Resend DPA · Resend Privacy Policy
Brevo
Role. Delivery of transactional emails. Used in parallel with or as a fallback to Resend.
Data categories. Recipient email address, message metadata, message body.
Region. European Union.
Transfer mechanism. Not applicable (intra-EEA processing).
Documentation. Brevo DPA · Brevo Privacy Policy
Payments
Stripe
Role. Payment processing for paid plans. Not used for school customers paid by invoice.
Data categories. Billing contact name, billing email, payment instrument metadata. No pupil data is transmitted to Stripe.
Region. Stripe Payments Europe (Ireland), with onward global processing within the Stripe group.
Transfer mechanism. EU Standard Contractual Clauses where applicable.
Documentation. Stripe DPA · Stripe Privacy Policy
Not loaded on school deployments
The following sub-processors are used only on the public marketing site (studyquest.app) and are blocked from loading on school subdomains (<school>.studyquest.app):
Google Analytics (Google Ireland Ltd.)
Role. Aggregated traffic analytics on the public marketing site.
Data categories. Pseudonymous device identifiers, page paths, referrer.
Region. Ireland, with onward transfer to the United States under the Standard Contractual Clauses and the EU-US Data Privacy Framework.
Status on school subdomains. Not loaded. The analytics script is excluded at page load and at the application analytics layer.
DataFast
Role. Aggregated product analytics on the public marketing site.
Data categories. Pseudonymous session identifiers, page paths.
Region. United States.
Status on school subdomains. Not loaded. The DataFast client is not initialised on school subdomains and all event helpers no-op.
Change history
- 2026-05-13: initial publication.