Processors

Full list of service providers involved in processing your data. · Deutsche Version

Processors are selected to meet Art. 28 GDPR requirements. All transfers to third countries (notably the US) are covered by Standard Contractual Clauses (SCCs) per EU Commission Decision 2021/914. For student work that we process on your behalf, these providers act as sub-processors (Terms, section 12).

Supabase Inc.

Location:: USA (database in EU — Frankfurt)
Purpose:: Authentication, storage of profile, corrections, red-pen transactions
Transfer basis:: EU data residency, EU Commission SCCs (2021/914)
Retention:: until account deletion; audit logs 30 days
DPA:: supabase.com/legal/dpa

Vercel Inc.

Location:: USA (edge functions in EU)
Purpose:: API hosting (Next.js server)
Transfer basis:: EU data residency, SCCs
Retention:: request logs 30 days
DPA:: vercel.com/legal/dpa

Anthropic Ireland, Limited (sub-processor: Anthropic, PBC, USA)

Location:: Ireland / USA (processing in the USA)
Purpose:: AI correction (Claude Sonnet): image content, image pixel size, task context
Transfer basis:: Anthropic DPA with SCCs (2021/914); no training on API data (Commercial Terms, section B)
Retention:: usually deleted within 30 days; up to 2 years if flagged for possible usage-policy violations; longer only where legally required
DPA:: www.anthropic.com/legal/data-processing-addendum

Stripe Payments Europe, Ltd.

Location:: Ireland / USA
Purpose:: Web payments, Stripe Checkout, payment confirmation for red-pen grants
Transfer basis:: SCCs, Stripe DPA
Retention:: purchase and invoice data 7 years (tax retention)
DPA:: stripe.com/legal/dpa

Resend (Resend Inc.)

Location:: USA (email delivery in EU — Ireland)
Purpose:: Transactional email (account confirmation, password reset)
Transfer basis:: EU data residency, SCCs
Retention:: email logs 30 days
DPA:: resend.com/legal/dpa

Changes

This list is continuously updated. For material changes (new sub-processor, change of data residency) we notify active users by email 30 days in advance. You may object and delete your account.