Subprocessors and service providers
Last updated: 25 September 2026
This page lists the main providers used for self-service accounts and for schools or other institutions. It is the canonical public list of these providers.
In short, a provider may act as our processor or subprocessor for a particular data flow, or as another service provider needed to deliver a feature. Its role depends on the feature and the data flow.
For self-service users outside the Schools context, the providers below may be used when needed for a feature, security, payments, support, analytics or service operation. For Schools customers, use depends on the agreement, selected add-ons, enabled features and organization settings. When OCR, handwriting recognition, document review or AI slide generation is used, the relevant AI provider may receive user-submitted text, images, PDFs, slide prompts and text, teacher notes, or lesson and study-set context to the extent needed to provide that feature.
How to read this list
- Always applies means services used for core platform operation and security.
- Only when relevant means a service is used in a particular situation, such as analytics with consent, payments or AI features.
- If a provider may process data outside the EEA, we use applicable transfer safeguards, including standard contractual clauses, technical and organizational measures, and internally approved transfer risk assessments, as described in our Privacy Policy.
- We generally email the designated Schools administrator about material changes to subprocessors, the Privacy Policy or Terms of Service. For self-service users, we may announce material terms or privacy changes on the website, in the app, in the account or by email, as applicable.
Change notices and objections
If we plan to add a subprocessor or materially change an existing subprocessor in a way that may significantly affect Schools data, we aim to notify the designated Schools administrator at least 7 calendar days in advance. Notice may be sent by email and/or by updating this canonical page.
A Schools customer may submit a reasoned objection to a specific new subprocessor within the period stated in the notice if it believes the use creates a real data-protection or contractual risk. In practice, an objection will generally mean not using or disabling the relevant feature, finding an alternative workflow, or agreeing separate contract terms where possible. An objection to a subprocessor needed for a feature, security, stability or legal obligation does not by itself grant a right to terminate the entire agreement without consequences, unless the agreement or mandatory law says otherwise.
If a provider must be changed urgently because of a security incident, provider outage, legal requirement, abuse, service continuity or another justified urgent reason, we may make the change without the 7-day advance period. We will provide information as soon as reasonably possible afterwards. An urgent change needed for service security or continuity generally does not justify suspending payment obligations or ending the agreement outside the applicable contractual process.
Always applies
| Provider | Service category | Location | What it does |
|---|---|---|---|
| Hetzner | Hosting and infrastructure | EU | Hosts core systems, databases, files and backups. |
| Cloudflare | CDN, WAF and security | EU / global network | Helps protect the website and app API, filter abuse and deliver content faster. |
| Google Workspace | Email and documents | EU / international processing may occur | Used for support, administration, internal communication and documents. |
Only when a feature is enabled
| Provider | Service category | Location | When it applies |
|---|---|---|---|
| Google Analytics 4 | Analytics | EU / international processing may occur | Used only after clear consent to analytics cookies and event analysis. |
| Sentry | Error, crash and performance monitoring | European Union | May monitor technical errors, crashes, performance issues and service interruptions on the website, app or server. |
| Google Firebase Cloud Messaging (FCM) | Mobile notifications and device notification tokens | EU / international processing may occur under Google Cloud infrastructure | May be used when notifications are enabled in the mobile app or another supported channel, to register notification tokens and deliver notifications. |
| Umami Cloud EU | Privacy-friendly, cookie-free website analytics | European Union | May measure aggregated traffic, popular pages, referral sources, device categories and high-level conversions. We use it to understand whether public pages work and where people get stuck, not to build advertising profiles or track users across other websites. |
| Stripe | Payments and subscriptions | EU / global infrastructure | Applies when payment, subscription or invoice data is processed. |
| DeepL | Translation services | Germany / EU; international processing may occur under the provider’s infrastructure | Applies only when text or learning-content translation is used. DeepL is used for translation, not general-purpose AI tasks. |
| OpenAI | AI services | EU region where available; otherwise international processing | May support exercise generation, explanations, summaries, writing feedback, automated assessment, slide generation or editing, and—if configured—handwriting or document text recognition. |
| OpenRouter | AI request routing | International processing | May route an AI request to a specific model or provider, including writing, OCR, slide-generation or automated-assessment requests, when this integration is used. |
| Google Cloud | AI services | EU region where available; otherwise international processing | May support specific AI features, including Google Cloud Gemini, writing feedback, slide generation or editing, and handwriting, image or PDF text recognition when those features are used. |
Previously used provider
Crisp was used for support chats, email, campaigns and customer relationship management. The integration is disabled for new conversations and account-data transfers. Older conversations or other personal data may still be stored by Crisp; the retention criteria and user rights described in the Privacy Policy apply to them.
Use for Schools customers
Schools is one access plan with optional add-ons. Provider use depends on the features in use, the agreement and organization settings.
| Provider | How it applies to Schools access |
|---|---|
| Hetzner | Applies to the core platform. |
| Cloudflare | Applies to security, WAF, CDN and access stability. |
| Google Workspace | Applies to administration, contracts and support communications. |
| Sentry | May be used to monitor errors, crashes and service interruptions. |
| Google Firebase Cloud Messaging (FCM) | May apply if mobile notifications are enabled for school or organization users. |
| Stripe | Applies only if a school or organization payment or subscription is processed through Stripe. |
| DeepL | May apply when translation features are used. |
| OpenAI | May apply to enabled AI, explanation, generation, writing, OCR or automated-assessment features. |
| OpenRouter | May apply if a specific AI, writing, OCR or automated-assessment feature uses model routing. |
| Google Cloud | May apply to specific AI or infrastructure features, including Google Cloud Gemini and handwriting, image or PDF text recognition, if enabled. |
| Google Analytics 4 | Generally does not apply to identifiable school learning data; it is used on the public website only with consent. |
Notes
- Not every provider listed on this page applies to every user or every session.
- AI and analytics providers are used only when you use the relevant feature and applicable privacy settings allow it.
- We use Umami Cloud EU only for high-level, aggregated website and conversion trends. We do not use it for ad targeting, third-party audiences, selling user profiles or evaluating a student’s learning results.
- When you use AI writing, OCR, handwriting-recognition or document-review features, the relevant provider may receive user-submitted text, an image or PDF, and the technical request context needed to return a result.
- We generally notify the designated school contact by email and update this page about material changes that may significantly affect school or institutional data.
- We first reflect minor additions or feature-specific changes on this page and, where appropriate, also mention them in product or blog updates.
