Legal
Subprocessors and purposes
Last updated 2026-11-12. This list forms part of our Privacy Policy and is available in English and Portuguese. It is dated rather than versioned — see "How this list changes" below for why, and for the notice we give before a new recipient starts.
What this page is
Our Privacy Policy describes the categories of processing: what we send, what we never send, who may receive it and why, and the commitments we make about training and location. This page names the specific companies serving those categories today.
A subprocessor is a company that processes your personal data on our behalf, under our instructions, so that we can provide the service — a cloud host, a payment processor, the AI provider that writes an answer. They are not free to use your data for their own purposes.
How this list changes
Which companies fill a category is a fact about today rather than a promise we made you, so it is kept here instead of inside a version-stamped document. Replacing one provider with another doing the same thing, to the same data, for the same purpose, updates this page and nothing else: nothing you were told has changed, so you are not asked to accept anything.
We publish a new recipient here at least 30 days before it begins processing, and every change is recorded below with its date.
A new kind of processing is different. Sending something the Privacy Policy does not already describe, or sending it to a kind of recipient it does not already describe, changes the policy itself — it is versioned and announced, and does not arrive as a line on this page.
You are not a party to our contracts with these companies, so you have no contractual right to object to one of them the way a business customer would. What you do have are the rights in section 6 of the Privacy Policy, which apply whoever is processing, and the ability to export everything and delete your account at any time from Settings.
Classification purposes
These are the small decisions that shape how you are answered rather than what the answer says. Each returns a label and a probability, and none of them writes any part of the answer you read. They are listed one by one, including any that are not currently switched on, because a list that silently dropped what is off could not be checked against what we actually run.
| Purpose | What that purpose sends | Status |
|---|---|---|
| Ranking retrieved passages by relevance (semantic reranking) | Your question and the candidate passages retrieved from your own materials and from course materials made available to you | Enabled |
| Choosing which teaching approach answers you (the teaching-style selector) | Your question, and whether you attached an image — never the image itself | Enabled |
The list
AI inference — the model that writes each answer
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Anthropic, PBC | When a Claude model answers you | Message content, retrieved passages, the lines of your class notes that the tutor reads, tool outputs, and any image you attach | Generating the answer you read | United States |
| OpenAI, L.L.C. | When a GPT model answers you, writes the AI notes of a class you ask for, or writes the short note of a voice practice that has ended (only if you accepted the current voice notice). AI notes are offered to an account with a verified e-mail | Message content, retrieved passages, the lines of your class notes that the tutor reads, tool outputs, and any image you attach; for AI notes, the transcript of the class and your own notes of it; for the note of a voice practice, the last part of its captions (up to 12,000 characters, which can include anything you said) with its practice, language and level and the language of your screen | Generating the answer you read, the AI notes you ask for, or the short note of what you showed in a voice practice | United States |
| Google LLC (Gemini) | When another provider is down and a Gemini model answers in its place, and when you import a class from a YouTube link. Google's terms for these models serve only adults, so an account whose stated age is under 18, or that states none, is never answered by this provider in a chat. A class video is different: Google receives only the link of a public video, with nothing that names you, and importing a class is offered to every account with a verified e-mail | Message content, retrieved passages, the lines of your class notes that the tutor reads, tool outputs, and any image you attach; for a class, the link of the YouTube video you import (a public video that Google reads from YouTube itself: we download nothing) | Generating the answer you read | United States and other Google regions. Its data processing terms incorporate the ANPD standard contractual clauses, on which we rely for transfers to it (LGPD Art. 33, II, b) |
| Fireworks AI, Inc. (GLM) | When a GLM model answers you | Message content, retrieved passages, the lines of your class notes that the tutor reads, tool outputs, and any image you attach | Generating the answer you read | Regions designated by Fireworks AI for its global API endpoint, outside Brazil |
Indexing your uploads — building and searching your private index
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| OpenAI, L.L.C. (embeddings) | Always, whichever chat model you pick | The full text of each file you upload, and the text of each search it runs against your materials | Building and searching your private index. The index is built once, separately from the model that answers you | United States |
Speech — your voice in a voice practice call or in a class recording
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| OpenAI, L.L.C. (voice) | Only while you are in a voice practice call | Your voice as audio, streamed from your browser while the call lasts; the partner's spoken replies; the text of what is said; the instructions that set the practice up, including the situation you typed and, if you accepted the current voice notice, your last three notes for that kind of practice; and any reply you type instead of speaking | Talking with the AI practice partner and showing the captions of the call | United States |
| OpenAI, L.L.C. (speech to text) | Only when you import a class recording, an audio file you upload or a recording you make in the browser. Importing a class is offered to an account with a verified e-mail | The audio of the recording, whole or in pieces of about three minutes, and the language you name for it. The recording passes through our server, which keeps it only until the transcript is saved or the import fails | Turning the recording into the written transcript of the class | United States |
Classification — small decisions that shape how you are answered
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| TypeSafe AI, Inc. (Jev) | Only for the classification purposes listed above that are marked enabled | See the per-purpose list above — each purpose sends only what that purpose needs | Returning a label and a probability. It never writes any part of the answer you read. Our contract with TypeSafe forbids using your content to train or adjust any model without our permission, which we do not give | United States. Its subprocessors are also in the United States: Amazon Web Services, which stores and processes the request, and Modal, whose compute nodes process the prompt without storing it |
| Cohere Inc. | Only when the reranking layer is configured to use it instead of TypeSafe | Your question together with the candidate passages retrieved from your own materials and from course materials made available to you. Direct identifiers are stripped before the request leaves us, which reduces exposure without making the payload anonymous | Re-ordering search results by relevance | United States |
Lookup — web and academic sources the tutor cites
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Tavily | When web search is enabled and Tavily is configured | Search queries derived from your question | Live web search grounding | United States |
| DuckDuckGo | When web search is enabled and Tavily is not configured | Search queries derived from your question | Live web search grounding | United States |
| arXiv, Crossref, PubMed/NCBI | When academic lookup is enabled | Search terms derived from your question. Never your name, e-mail, or account id | Finding and verifying references so the tutor cites real sources instead of inventing them | United States and Europe |
Payments and subscriptions
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Stripe, Inc. and Stripe Brasil | When you buy or manage a subscription | Email, account and checkout references, billing intent, the card you enter on its checkout page, payment and subscription events | Payment processing and subscription management. You enter your card on Stripe's own page; it never passes through our servers | United States and Brazil. Its data processing terms incorporate the ANPD standard contractual clauses, on which we rely for transfers to it (LGPD Art. 33, II, b) |
| Paddle.com Market Ltd | When enabled | Email, account and checkout references, billing intent, payment and subscription events, and referral redemption references | Payment processing and subscription management. As our merchant of record Paddle is the legal seller of your subscription, so for the payment relationship it acts on its own behalf rather than on ours, under its own privacy notice | United Kingdom and United States |
| Asaas Gestão Financeira S.A. | When enabled, for Brazilian payment methods | Email, account and checkout references, billing intent, payment and subscription events | Payment processing and subscription management | Brazil |
Hosting and delivery
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Google LLC (OAuth, Calendar) | Only if you sign in with Google or connect Calendar | OAuth authorization code exchange | Sign-in and Calendar sync | United States and other Google regions |
| Google LLC (Google Ads) | Only on the public pages, if you arrived from a Google ad and accepted its measurement question; never inside the app | The identifier of the ad click (in cookies Google's tag sets for this site), your IP address, your browser, the address of the page, and that the visit reached our sign-up link. Nothing from an account, a conversation or your materials | Measuring which ads bring visits that start a sign-up | United States and other Google regions |
| GitHub, Inc. | Only if you connect it | Your authorization, and the repository content you ask the tutor to read or change | The optional GitHub integration | United States |
| Fly.io, Inc. | Always | Application traffic, account and study data, conversations and uploaded files | Backend hosting and storage | Netherlands (Amsterdam), where the backend machine and encrypted volume run; Fly.io control-plane and account administration in the United States |
| Cloudflare, Inc. | Always | Frontend traffic, DNS resolution, inbound e-mail routing, and aggregate edge analytics (requests by country and device class), and off-site backup archives when enabled and, from the day the production database runs on PostgreSQL, its continuous archive and daily dump (both encrypted by us before they are stored) and the deletion markers | Frontend hosting, DNS, e-mail, traffic analytics and backup storage | A global edge network; when enabled, off-site backups use Cloudflare R2 with European Union jurisdiction; associated account metadata is processed in the United States and Europe; when enabled, the continuous archive, the dump and the deletion markers of the production database sit in R2 buckets with the same jurisdiction, and Cloudflare group staff in other countries may reach account metadata and object names |
| Functional Software, Inc. (Sentry) | When enabled | Error events with personally identifiable information scrubbed | Error monitoring | United States |
Messages we send you and mail you send us
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Our e-mail relay | When enabled | Your e-mail address and the message we send you | Transactional e-mail such as password resets | United States |
| Zoho Corporation (Zoho Mail) | When you write to a NodeStudy address (support@ and the team's other addresses), and when we reply | The e-mail you send us (your address, the subject, the message and any attachment) and our replies | Receiving and answering the e-mail you send to support and to the team | United States, in the Zoho data center where our account was created |
| Your browser's own push service (Google, Mozilla, or Apple) | Only if you turn on reminders | The push endpoint your browser issued, and the reminder we send to it | Delivering study reminders to your device | Determined by your browser vendor |
Abuse prevention
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Cloudflare, Inc. (Turnstile) | When enabled, at signup and when a network is flagged for sign-in abuse | A CAPTCHA token, your IP address and signals from your browser that tell a person from a script | Blocking automated signup and login abuse. Cloudflare also uses the signals to improve its own bot detection | A global edge network |
Record of changes
- 2026-11-11 — Extended the GPT row to the short note of a voice practice: when a practice ends and an account has accepted the current voice notice, the last part of its captions goes to the model that writes the note, the one that already writes the AI notes of a class: no new recipient. The Speech row now says that the instructions of a practice can include the account's last notes. The Privacy Policy now describes the note (sections 2 to 5) and the voice notice is revised.
- 2026-11-09 — Removed Alibaba Cloud (Qwen): no Qwen model is offered or reachable any more. Gemini is no longer a model you can pick; Google receives content only when you import a class from a YouTube link and when another provider is down and a Gemini model answers in its place, and its row now says so.
- 2026-11-08 — Added a row to the Speech category: the provider that turns a class recording into a transcript. Extended the Gemini row to the video behind a YouTube link imported into a class, and the GPT row to the AI notes of a class. The Privacy Policy now describes classes (sections 2 to 5, 8 and 9). The providers were already on this page for answers; the rows say what a class sends them and when.
- 2026-11-07 — Added a Speech category with one row: the voice provider that carries the audio of a voice practice call. The Privacy Policy now describes voice practice (sections 2 to 5, 8 and 9). The provider is already named on this page for answers and for indexing; the new row says what a call sends it and when.
- 2026-11-03 — The Privacy Policy no longer names the AI model providers or the embeddings provider; it points to this list for them. Nothing was added or removed: this page already named each of them. Two facts the policy used to state about them are kept here: that Google's terms for its Gemini models serve only adults, so no account under 18 or with no stated age is answered by them, and that Google and Stripe incorporate the ANPD standard contractual clauses into their data processing terms.
- 2026-10-26 — Added Zoho Corporation (Zoho Mail), which keeps the mail you send to support@nodestudy.com and to the team's other addresses. It receives that mail from this date. The 30 days' notice this page usually gives was waived for this addition.
- 2026-09-21 — First publication of this list. Nothing was added or removed: every entry was already named in the Privacy Policy's third-party and transfer tables, and this page consolidates them so that future changes can be published here without reopening the policy.
Questions about a specific recipient or the safeguards applying to it: support@nodestudy.com.