Legal
Sub-processors
Every third party that touches data, what they do with it, and where they are.
This list is versioned and dated. If it changes, the version at the foot of this page changes, and institutions on an agreement that requires notice are told.
Google Cloud / Firebase
Entity: Google Ireland Limited
What they do: Hosting, database, authentication, file storage, scheduled jobs. Everything the product runs on.
Where: europe-west3 (Frankfurt, Germany)
What reaches them: All institution data: accounts, groups, scenarios, sessions, usage figures.
Stripe
Entity: Stripe Payments Europe, Ltd.
What they do: Subscription billing for studios paying by card. Schools invoiced by transfer never reach it.
Where: EU, with onward transfers under Stripe's own commitments
What reaches them: The billing contact and payment details. No student data of any kind.
Brevo
Entity: Sendinblue GmbH
What they do: Transactional email — credentials for staff, licence reminders, payment notices.
Where: EU (Germany and France)
What reaches them: Staff email addresses and the message. Never a student, who has no email address.
Anthropic
Entity: Anthropic PBC
What they do: The three optional AI features: shaping a scenario, reading class-list column headings, summarising usage figures.
Where: United States
What reaches them: Scenario text you wrote, up to five sample rows of a class list during import, and aggregate usage figures. The sample rows can contain names; no lesson record ever reaches it.
The one outside the EU
Anthropic is in the United States. It is worth being precise about what that means here, because "we use AI" and "our AI provider sees lesson records" are very different statements and only the first is true.
The AI features work on three things: scenario text a teacher wrote, the column headings and at most five sample rows of a class list during import, and aggregate usage figures that contain no student by construction.
There is no code path from session data to a model. It is prevented by the type system, checked again at runtime on every single call, and asserted by a test that fails the build. An institution that would rather not use the AI features at all can leave them switched off, and nothing else in the product changes.
What is not on this list
No analytics provider on the app. No advertising network. No customer-support chat tool. No error-reporting service that receives user content. No content delivery network in front of the product. If it is not above, it does not receive anything.
The marketing website additionally loads fonts from Bunny Fonts, which is EU-hosted and logs no IP addresses, and — only with your consent — Google Analytics 4. Neither touches the product.