Sub-processors
Last updated: 2026-10-24 · Operator: SPÓŁKA GŁÓWNA
We use the following companies to provide the service. Processors act only on our instructions; the agreement column shows the status of each contract (draft list — items marked TO CONFIRM must be signed before launch). Providers marked with a condition are used only when that condition is met (for example, the AI tutor only after the parent or adult student consents). The payment provider is a separate controller and the seller of record, not our processor.
| Provider | Purpose | Location | Transfer safeguard | Agreement | Used |
|---|---|---|---|---|---|
| OVH SAS | hosting of the platform (servers, storage, backups) | EU (France) | none (EU) | OVH DPA (standard terms) — TO CONFIRM signed for the service project | always |
| xAI Corp. | AI tutor (language model) — lesson data, only after AI consent | USA | TO CONFIRM: the operator is in the USA and does not rely on the DPF; onward transfer from the operator under Clause 8.8 of the Module 2 SCCs (equivalent SCC terms) or the provider's own EU–US DPF certification; the AI tutor is not enabled for EEA users until that tool is signed; not engaged by us when the customer uses their own key for that provider | TO CONFIRM: provider DPA, no-training terms, transfer tool (Clause 8.8 onward terms or provider's DPF certification) | AI provider = xai and AI consent given |
| xAI Corp. | help assistant (questions about how to use the service; no lesson or student data) | USA | TO CONFIRM: we are the controller of these questions; transfer to the provider under SCCs fitting that flow or the provider's own EU–US DPF certification (not Module 3); the help assistant is not enabled for EEA users until that tool is signed; in addition every user (all countries) gives a one-time consent before the first question (remembered in the browser) (used as the transfer basis in Japan, APPI Art. 28(1), and South Korea, PIPA Art. 28-8(1)) | TO CONFIRM: provider DPA, no-training terms | help assistant (website and app); no lesson data |
| Anthropic PBC | AI tutor (language model), alternative provider | USA | TO CONFIRM: the operator is in the USA and does not rely on the DPF; onward transfer from the operator under Clause 8.8 of the Module 2 SCCs (equivalent SCC terms) or the provider's own EU–US DPF certification; the AI tutor is not enabled for EEA users until that tool is signed; not engaged by us when the customer uses their own key for that provider | TO CONFIRM: provider DPA, no-training terms, transfer tool (Clause 8.8 onward terms or provider's DPF certification) | AI provider = anthropic and AI consent given |
| Scaleway SAS | GPU machines for transcription of recordings (rented by the minute) | EU (France, fr-par-2) | none (EU) | Scaleway DPA (standard terms) — TO CONFIRM | GPU_PROVIDER = scaleway and recording consent given |
| OVH SAS (AI Training) | GPU jobs for transcription of recordings (by the minute) | EU (France, GRA) | none (EU) | OVH DPA (standard terms) — TO CONFIRM signed for the service project | GPU_PROVIDER = ovh and recording consent given |
| PAYMENT_PROVIDER (Merchant of Record, e.g. Paddle) | checkout, subscriptions, taxes, invoices, refunds — the MoR is the seller of record towards the customer — independent controller and seller of record (not our processor) | PAYMENT_PROVIDER_LOCATION | per provider terms | buyer terms of the MoR; seller-of-record agreement with us | planned |
| EMAIL_PROVIDER | sending transactional e-mails and lesson reminders | EMAIL_PROVIDER_LOCATION | per provider | TO CONFIRM: provider DPA and location | reminders module enabled |
| OPERATOR_EMAIL_PROVIDER | operator mailbox (support@tutorhabitat.com): COPPA notices to parents, confirmations and parents' e-mail replies with signed consent forms; the provider only transmits and stores them for us; copies deleted on the same schedule as the case file (90 days without consent, on withdrawal, when the student record is deleted), not kept in the general support queue | OPERATOR_EMAIL_PROVIDER_LOCATION | per provider | TO CONFIRM: provider DPA and location | COPPA module used for a student in the USA under 13 |
We will announce new sub-processors at least 30 days before they start processing customer personal data, by e-mail to account owners and on this page. Customers may object as described in the Data Processing Addendum.