Last updated: July 28, 2025  |  Version 1.1
Effective date: July 28, 2025

Subprocessors

Summary: This page lists all third-party service providers (subprocessors) that StudySync uses to deliver our services. We carefully select trusted partners who meet our security and privacy standards.

What Are Subprocessors?

Subprocessors are third-party service providers that process personal data on behalf of StudySync to help us deliver our services. We maintain strict contractual agreements with all subprocessors to ensure your data is protected according to our privacy standards and applicable data protection laws.

How We Select Subprocessors

  • Security and privacy assessments
  • Compliance with GDPR, CCPA, and other applicable regulations
  • Data processing agreements (DPAs) with appropriate safeguards
  • Regular security audits and monitoring
  • Contractual requirements for data protection and deletion

Current Subprocessors

AI and Transcription Services

AssemblyAI

Audio Transcription

Purpose: Real-time and batch audio transcription, speech-to-text conversion, audio analysis

Data Processed: Audio recordings, voice data, transcription metadata

Location: United States

Website: assemblyai.com

OpenAI

AI Content Generation

Purpose: Chat responses, content generation, educational AI features, text analysis

Data Processed: User queries, chat messages, educational content

Location: United States

Website: openai.com

Hosting and Infrastructure

Render

Backend Hosting

Purpose: API hosting, server infrastructure, backend services

Data Processed: All user data, application logs, system metadata

Location: United States

Website: render.com

Vercel

Frontend Hosting

Purpose: Frontend application hosting, CDN services, static site delivery

Data Processed: User interactions, page analytics, session data

Location: United States, Global CDN

Website: vercel.com

Database and Storage

MongoDB Atlas

Database Services

Purpose: Primary database storage, user data management, application data

Data Processed: User profiles, chat history, transcriptions, flashcards, quiz data

Location: United States (configurable regions)

Website: mongodb.com/atlas

Payment Processing

PayPal

Alternative Payment Gateway

Purpose: Alternative payment processing, subscription management

Data Processed: Payment information, PayPal account details

Location: United States, Global

Website: paypal.com

Analytics and Monitoring

Vercel Analytics

Web Analytics

Purpose: Website usage analytics, user behavior analysis, performance monitoring

Data Processed: Anonymized usage data, page views, user interactions

Location: United States, Global

Website: vercel.com/analytics

Communication Services

Nodemailer

Email Services

Purpose: Automated transactional emails including payment confirmations, payment renewals, account signup notifications, data deletion confirmations, and data download notifications

Data Processed: Email addresses, user names, payment confirmation details, account status information, data request confirmations

Location: Global (library-based email service)

Website: nodemailer.com

Canvas

Canvas LMS

Educational Platform API

Purpose: Retrieve courses, assignments, grades, and assignment details to power features including Agent Mode.

Data Processed: Course listings, assignment metadata, due dates, grades, user identifiers.

Location: United States (Canvas cloud infrastructure)

Website: canvas.instructure.com

Data Transfer Safeguards

When subprocessors are located outside your country, we implement appropriate safeguards including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • UK International Data Transfer Agreement (IDTA) for UK transfers
  • EU-U.S. Data Privacy Framework (DPF) participation where applicable
  • Additional technical and organizational measures
  • Regular compliance assessments and audits

Subprocessor Changes

We may update this list from time to time as we add, remove, or change subprocessors. When we make material changes to our subprocessors that may affect the processing of your personal data, we will:

  • Update this page with the changes
  • Notify users via email or in-app notification
  • Provide at least 30 days notice for significant changes
  • Allow users to object to the use of new subprocessors

Your Rights

You have the right to object to the use of specific subprocessors. If you object to a subprocessor and we cannot provide the service without using that subprocessor, you may need to discontinue using the affected features or services. You can exercise your rights by contacting us at khansokan1234@gmail.com.

Questions?

If you have questions about our subprocessors or data processing practices, please contact our Data Protection Officer at khansokan1234@gmail.com.