Sub-processors
Version 1.0
Kuvatakse dokumendi ingliskeelne versioon; originaal on hispaania keeles. Ava hispaaniakeelne originaal
1. What this list is
To provide the service we rely on providers that process personal data on our behalf (sub-processors, art. 28.2 GDPR). This page is kept current and forms part of the Data Processing Agreement.
We give thirty (30) days' notice before adding or replacing a sub-processor. During that period a customer may object on reasonable data-protection grounds and, if we cannot offer an alternative, terminate without penalty.
2. List of sub-processors
| Provider | Purpose | Country | Transfer basis |
|---|---|---|---|
| OVH SAS (OVHcloud) | Application hosting, database, backups and outbound mail | France | EEA — no international transfer |
| Mistral AI SAS | Text generation and translation, embeddings for search, speech synthesis and voice cloning (reference voice samples) | France | EEA — no international transfer |
| Microsoft Ireland Operations Ltd (Azure AI Speech) | Neural speech synthesis (voiceover in languages Mistral does not cover), European region | Ireland | EEA — no international transfer |
| Replicate, Inc. | Image generation for courses | United States | Standard contractual clauses (SCC) |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | United States | Data Privacy Framework |
| Friendly Captcha GmbH | Alternative protection of the sign-in form against bots (only if enabled; by default the check runs on our own servers) — proof-of-work puzzle, EU endpoint, no cookies | Germany | EEA — no international transfer |
| Google Ireland Ltd (Google Analytics 4, Google Ads) | Web analytics and advertising on the public site (home, pricing, blog, legal pages) — only after consent in the cookie banner; never inside the application or the learner portal. EEA-established; Google may sub-transfer the data to Google LLC (United States) | Ireland | EEA; sub-transfer to Google LLC (US) covered by the Data Privacy Framework |
| Hotjar Ltd | Session analytics on the public site (heatmaps and recordings with form fields masked) — only after consent in the cookie banner; never inside the application or the learner portal | Malta | EEA — no international transfer |
| Anthropic PBC | Alternative text model (only where configured) | United States | Standard contractual clauses (SCC) |
| OpenAI Ireland Ltd | Alternative text model and speech synthesis (only where configured) | Ireland | EEA — no international transfer |
| Paddle.com Market Limited | Merchant of Record and invoicing outside the European Union | United Kingdom | UK adequacy decision |
| Armitage Labs OÜ (Creem) | Merchant of Record and invoicing within the European Union | Estonia | EEA — no international transfer |
Providers marked as alternative only process data where the corresponding credential is configured. Analytics and advertising providers additionally load only on the public site and only after the visitor consents in the cookie banner. The configuration in force in production is reviewed together with this page.
3. Data involved and safeguards
- Model providers receive only the text, document or instruction needed to produce the requested output. We do not authorise the use of that data for model training and we apply the minimum retention each provider offers.
- The anti-bot check on the sign-in form runs by default on our own servers (ALTCHA) with no third party involved. If the administration enables the Friendly Captcha alternative, that provider receives only the IP address, browser and puzzle solution needed to verify that the visitor is not a bot; it sets no cookies and builds no profiles.
- Analytics and advertising (Google Analytics 4, Google Ads, Hotjar) run exclusively on the public site and only after consent given in the cookie banner; they do not load in the application or the learner portal, and no customer content or learner data is used for those purposes. For this data we act as controller (no customer data is processed on instruction). Cookies and durations are in the cookie policy.