Sub-processors

Supabase

Role. Managed PostgreSQL database, authentication, file storage, realtime channels, and serverless edge functions.

Data categories. All categories of Personal Data described in Annex 1 of the DPA: identity, authentication, educational content, usage, communications.

Region. Stockholm, Sweden (eu-north-1).

Transfer mechanism. Not applicable (intra-EEA processing).

Documentation. Supabase DPA · Supabase Privacy Policy

Netlify

Role. Web hosting, content delivery network, and build infrastructure for the static frontend.

Data categories. IP address, browser metadata, request paths. No structured pupil records pass through Netlify storage.

Region. Global edge network with origin in the United States.

Transfer mechanism. EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) where applicable.

Documentation. Netlify GDPR / CCPA · Netlify Privacy Policy

OpenAI

Role. Large language model used to generate quiz questions from Controller-supplied study materials, to power the in-app study assistant, and to generate user-described study mini-games.

Data categories. Study material text submitted by teachers; pupil questions submitted to the study assistant; game descriptions and generated game code for the mini-game builder. No persistent pupil identifiers are sent.

Region. United States.

Transfer mechanism. EU Standard Contractual Clauses (Module Three).

Retention by sub-processor. Standard OpenAI API data handling applies: inputs and outputs are not used to train OpenAI’s models; abuse-monitoring retention per OpenAI’s API data usage policy. Mini-game generation uses OpenAI’s background mode, which additionally retains response data for approximately 10 minutes after completion.

Documentation. OpenAI DPA · OpenAI Enterprise Privacy

Scrimba (Scrimba AS)

Role. Builds narrated video lessons (Scrimba Explain) from a learner’s own study material when the learner asks for one. Premium accounts only.

Data categories. Passages of the learner’s uploaded study material that match the requested topic, the quiz questions the learner answered wrong on that topic, and the lesson language. No names, emails or account identifiers are sent; lessons are created under StudyQuest’s own Scrimba account.

Region. Norway (EEA). Scrimba’s own sub-processors (speech and model providers) are listed in Scrimba’s privacy policy.

Transfer mechanism. Not required for Scrimba itself (EEA). Onward transfers by Scrimba’s sub-processors are governed by Scrimba’s agreements with them.

Retention by sub-processor. Lessons stay on Scrimba’s platform as unlisted pages until StudyQuest deletes them, which happens when the learner deletes the upload or their account.

Data processing agreement. In progress (requested 2026-10-15).

Documentation. Scrimba Privacy Policy · Scrimba Explain API

TypeSafe (TypeSafe AI, Inc.)

Role. Classifies written feedback (type, severity, grouping).

Data categories. The text of feedback messages that users type into StudyQuest. No names, email addresses or account identifiers are sent. Users write the text themselves, so it can contain anything they chose to include.

Region. United States (San Francisco, California). The TypeSafe privacy policy states the services are hosted in the United States.

Transfer mechanism. Not published.

Retention by sub-processor. Not published. TypeSafe’s privacy policy states it will not train or fine-tune models on prompts or other input. It does not state a retention period for inputs, and no data processing agreement is published.

Documentation. TypeSafe Privacy Policy · TypeSafe Terms of Use

OpenRouter (OpenRouter, Inc.)

Role. Routes feedback classification requests to TypeSafe.

Data categories. The text of feedback messages that users type into StudyQuest, passed on to TypeSafe. No names, email addresses or account identifiers are sent. Users write the text themselves, so it can contain anything they chose to include.

Region. United States (New York, with hosting in Google Cloud Platform US regions).

Transfer mechanism. EU Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in the OpenRouter Data Processing Agreement.

Retention by sub-processor. OpenRouter’s Data Processing Agreement says it deletes inputs and outputs promptly after the response is generated unless the customer switches on prompt logging. OpenRouter’s privacy policy says it does not use inputs or outputs to train models. Retention by the downstream model provider (TypeSafe) is listed separately above.

Documentation. OpenRouter DPA · OpenRouter Privacy Policy · OpenRouter sub-processors

Resend

Role. Delivery of transactional emails (account verification, password reset, school invitations, service notifications).

Data categories. Recipient email address, message metadata, message body.

Region. United States.

Transfer mechanism. EU Standard Contractual Clauses (Module Three).

Documentation. Resend DPA · Resend Privacy Policy

Brevo

Role. Delivery of transactional emails. Used in parallel with or as a fallback to Resend.

Data categories. Recipient email address, message metadata, message body.

Region. European Union.

Transfer mechanism. Not applicable (intra-EEA processing).

Documentation. Brevo DPA · Brevo Privacy Policy

Stripe

Role. Payment processing for paid plans. Not used for school customers paid by invoice.

Data categories. Billing contact name, billing email, payment instrument metadata. No pupil data is transmitted to Stripe.

Region. Stripe Payments Europe (Ireland), with onward global processing within the Stripe group.

Transfer mechanism. EU Standard Contractual Clauses where applicable.

Documentation. Stripe DPA · Stripe Privacy Policy