Privacy
Subprocessor List
Last updated: 20 April 2026
This list describes the service providers StudyVector uses, or may use where configured, to run the platform. Core providers are needed for the product to work. Optional providers only apply to features or analytics that are switched on in the relevant environment.
We do not sell personal data. Optional analytics and campaign measurement tools load only after optional cookie consent where the tool is configured.
| Provider | Status | Purpose and data |
|---|---|---|
| Supabase | Core | Authentication, database, storage, row-level security, and edge functions. Data: Account, learning, progress, school links, uploads, support metadata, and operational logs. Location: Region depends on the configured Supabase project. Configuration: Required for the core product. |
| Vercel | Core | Application hosting, serverless routes, deployment logs, security and performance telemetry. Data: IP address, request metadata, device/browser data, and limited application logs. Location: Region depends on deployment and routing. Configuration: Required for the public website and app hosting. |
| Stripe | Core | Checkout, billing, invoices, refunds, fraud checks, subscription and Exam Pass access status. Data: Email, customer ID, payment status, invoice metadata, billing country, and payment-provider records. Location: Stripe processes data internationally under its own transfer terms. Configuration: Required for paid student plans and school checkout where enabled. |
| Resend or configured email provider | Core | Transactional email, support confirmations, account notices, and opted-in revision updates. Data: Email address, name where supplied, message metadata, delivery status, and unsubscribe/preference links. Location: Depends on the configured provider and sending region. Configuration: Resend is present in the codebase; Postmark, Loops, or Lovable email may be configured for some flows. |
| OpenAI | Optional / where configured | Marking support, explanations, embeddings, upload analysis, question generation, and tutoring features where enabled. Data: Study prompts, answer text, topic context, document extracts, and generated feedback where needed to provide the requested feature. Location: International processing may apply under provider terms. Configuration: Used only when server-side OpenAI keys are configured for the relevant feature. |
| Anthropic | Optional / where configured | Tutor, practice-coach, or marking model fallback where configured. Data: Study prompts, answer text, topic context, and generated feedback where needed to provide the requested feature. Location: International processing may apply under provider terms. Configuration: Used only when Anthropic keys are configured. |
| Google AI / Gemini and Google Cloud | Optional / where configured | Syllabus parsing, content review, image/content workflows, Drive/indexing operations, and topic classification where configured. Data: Uploaded or operator-supplied documents, topic text, generated content, service-account metadata, and operational logs. Location: International processing may apply under provider terms. Configuration: Used only for configured AI, indexing, Drive, or content workflows. |
| PostHog | Optional / where configured | Product analytics after optional cookie consent. Data: Pseudonymous event data, page/action events, browser metadata, and consented product analytics identifiers. Location: Depends on configured PostHog host. Configuration: Loads only if a public PostHog key is configured and the user accepts optional cookies. |
| Google Analytics | Optional / where configured | Website analytics after optional cookie consent. Data: Pseudonymous usage events, device/browser data, referral and page metadata. Location: International processing may apply under Google terms. Configuration: Loads only if a GA measurement ID is configured and the user accepts optional cookies. |
| TikTok Pixel | Optional / where configured | Campaign measurement after optional cookie consent. Data: Campaign event metadata, browser identifiers, and page/action events. Location: International processing may apply under TikTok terms. Configuration: Loads only if a TikTok Pixel ID is configured and the user accepts optional cookies. |
| Sentry | Optional / where configured | Error monitoring and reliability triage. Data: Error traces, device/browser metadata, request context, and limited diagnostic logs. Location: Depends on configured Sentry project region. Configuration: Used only if Sentry DSNs are configured. |
| Upstash / Vercel KV | Optional / where configured | Cache, rate limits, queue-like support, and operational throttling where configured. Data: Rate-limit keys, cache keys, request counters, and limited operational metadata. Location: Depends on configured datastore region. Configuration: Used only if KV or Upstash environment variables are configured. |
| RunPod | Optional / where configured | Self-hosted or OpenAI-compatible model inference where configured. Data: Study prompts, answer text, document context, and generated feedback needed for the selected model route. Location: Depends on selected pod/serverless region. Configuration: Opt-in only; not selected automatically unless configured. |
| ElevenLabs | Optional / where configured | Text-to-speech and voice features where configured. Data: Text submitted for speech generation and voice configuration metadata. Location: International processing may apply under provider terms. Configuration: Used only for voice/TTS flows when keys are configured. |
Changes
We review this list when adding or removing providers that process personal data. For school contracts, we can notify the school contact before adding a material new subprocessor where the data-processing terms require it.