Sub-Processors
Last updated: 12 September 2026
The following material third-party services process customer or user data on behalf of Teacher's Buddy. Some services are used only when a specific feature is enabled or an integration is connected. Incidental tools that do not process customer or user data for the Service are not listed.
| Name | Website / Contact | Purpose | Data Types Disclosed | Lawful Basis / Rationale | Countries / Regions |
|---|---|---|---|---|---|
| PlanetScale | https://planetscale.com | Primary MySQL database | Account, authentication, session and connected-service records; school and organisation records; teaching content; resource metadata; and billing identifiers | Service delivery under contract; legitimate interests in security and reliability | Australia (Sydney) |
| Railway | https://railway.com | Teacher, marketing and admin applications; API services; background jobs; Redis/cache; queues; vector database; and library database | Application and admin records, cache/session data, job payloads, resource embeddings, request metadata and telemetry | Service delivery under contract; legitimate interests in security and reliability | United States |
| Cloudflare | https://www.cloudflare.com | File/object storage, video hosting and streaming, realtime meetings, CDN/edge routing, Workers runtime, bot protection and security services | Uploaded files, generated assets, video/audio content, meeting participant identifiers and metadata, IP/request metadata, security events and Turnstile signals | Service delivery under contract; legitimate interests in security and abuse prevention | United States and global edge locations |
| Amazon Web Services | https://aws.amazon.com | Meeting recording storage and transcription; AI-assisted transcript analysis; and direct Amazon Bedrock AI processing for selected generation and publisher-intake workflows where enabled | Audio recordings, transcripts, speaker labels, meeting metadata and derived analysis; prompts, user instructions, resource excerpts and generated outputs for enabled Bedrock workflows | Service delivery under contract; user direction when using meeting-recording or AI features | Australia (Sydney) for meeting services; United States (including us-east-1) for configured Bedrock workflows |
| Anthropic | https://www.anthropic.com | AI content generation | Prompts, user instructions, attached context and generated outputs | Service delivery under contract | United States |
| OpenRouter | https://openrouter.ai | AI model routing gateway that forwards requests to selected downstream AI providers | Prompts, inputs/outputs and request metadata | Service delivery under contract | United States |
| https://cloud.google.com | Gemini AI generation, image generation, embeddings and document processing; Google sign-in; and Google Drive integration where connected | Prompts, inputs/outputs, embeddings, document and image content, Google account identifiers, OAuth tokens and Drive content when connected | Service delivery under contract; user direction for connected integrations | United States and provider-operated regions | |
| OpenAI | https://openai.com | Selectable AI models, realtime voice features and document-import embeddings where enabled | Prompts, inputs/outputs, audio and transcripts, resource excerpts and request metadata | Service delivery under contract | United States |
| ElevenLabs | https://elevenlabs.io | Live voice coaching, speech processing and generated voice responses where enabled | Microphone audio, coaching messages and transcripts, relevant coaching/profile context and conversation metadata | Service delivery under contract; user direction when starting voice coaching | Provider-operated regions, depending on the selected service and configuration |
| fal.ai | https://fal.ai | 3D/interactive simulation asset generation where enabled | Image-generation prompts and generated asset metadata | Service delivery under contract | United States |
| Microsoft / Azure | https://azure.microsoft.com | Microsoft sign-in; OneDrive and SharePoint integration; optional Outlook calendar and Microsoft To Do actions; configurable Azure OpenAI generation; and Azure Video Indexer processing for instructional-coaching video analysis and face-redaction workflows where enabled | Microsoft account identifiers, email/profile information, OAuth tokens, selected OneDrive/SharePoint content and calendar/task data when connected; prompts, context and generated outputs for enabled Azure OpenAI workflows; instructional-coaching video/audio, transcripts, detected-face tracks and thumbnails, and related indexing metadata for enabled Video Indexer workflows | Service delivery under contract; user direction for connected integrations | Australia (Australia East) for the instructional-coaching Video Indexer workflow; provider-operated regions for other Microsoft services |
| Apple | https://www.apple.com/legal/privacy | Sign in with Apple where used | Apple account identifiers, email or relay email, name where provided, authentication tokens and request metadata | Service delivery under contract; user direction for sign-in | Provider-operated regions |
| Stripe | https://stripe.com | Payment processing, billing and tax administration | Billing contact, customer IDs, subscriptions, tax details, payment status and payment method tokens | Service delivery under contract; legal obligations for tax/accounting | United States and Australia |
| Resend | https://resend.com | Transactional email | Email address, name, message content and delivery metadata | Service delivery under contract; legitimate interests in account and service communications | United States |
| PostHog | https://posthog.com | Product analytics and session replay where enabled | User and organisation identifiers, name, email, profile image, school name and location, product usage events, device/browser and performance metadata, console diagnostics and masked session recordings | Legitimate interests in product improvement and support, subject to applicable settings/consent requirements | United States |
| Axiom | https://axiom.co | Application logging and operational monitoring | User, organisation and workspace identifiers; request and performance metadata; operational, authentication, billing and generation events; and error messages, stack traces and diagnostic context | Legitimate interests in reliability, security and support | United States |
| Sentry | https://sentry.io | Application error monitoring and incident diagnosis where enabled | User and organisation identifiers, request metadata, error messages, stack traces, breadcrumbs and diagnostic context | Legitimate interests in reliability, security, incident response and support | Configured Sentry organisation region (United States or Germany) |
| InstantDB | https://www.instantdb.com | Realtime collaboration, presence and session-to-collaboration authentication where enabled | User identifiers and email address; collaborative document state, operations, presence and related metadata | Service delivery under contract; legitimate interests in collaboration reliability and security | Provider-operated regions |
| Kitenga | https://kitenga.app | Marketing content and forms, feature and conversion configuration, product-event processing, and customer/billing lifecycle workflows | Contact and form information, user and organisation identifiers, product usage and engagement events, subscription and lifecycle event metadata, and marketing content | Service delivery under contract; legitimate interests in product operations, customer support and service communications, subject to applicable consent requirements | Provider-operated regions |
| UploadThing | https://uploadthing.com | File-upload handling where used | Uploaded files, cover images, organisation logos, extracted document artifacts, video frames, generated assets and upload metadata | Service delivery under contract | United States |
| ClickUp | https://clickup.com | Customer support, bug tracking and internal issue management | Reporter name/email, organisation details, bug-report description and reproduction steps, page/route details, diagnostic context, user agent and PostHog session/replay references | Legitimate interests in support, security, reliability and product improvement | United States |
For questions about our sub-processors, contact privacy@teachersbuddy.com.
Where a customer agreement requires advance notice of a new or replacement material sub-processor, we provide notice to the customer's designated contact using the period and communication method in that agreement. Locations may change when a customer selects a regional service option; contact us for confirmation of a currently configured region.