Legal
Subprocessors and purposes
Last updated 2026-09-21. This list forms part of our Privacy Policy and is available in English and Portuguese. It is dated rather than versioned — see "How this list changes" below for why, and for the notice we give before a new recipient starts.
What this page is
Our Privacy Policy describes the categories of processing: what we send, what we never send, who may receive it and why, and the commitments we make about training and location. This page names the specific companies serving those categories today.
A subprocessor is a company that processes your personal data on our behalf, under our instructions, so that we can provide the service — a cloud host, a payment processor, the AI provider that writes an answer. They are not free to use your data for their own purposes.
How this list changes
Which companies fill a category is a fact about today rather than a promise we made you, so it is kept here instead of inside a version-stamped document. Replacing one provider with another doing the same thing, to the same data, for the same purpose, updates this page and nothing else: nothing you were told has changed, so you are not asked to accept anything.
We publish a new recipient here at least 30 days before it begins processing, and every change is recorded below with its date.
A new kind of processing is different. Sending something the Privacy Policy does not already describe, or sending it to a kind of recipient it does not already describe, changes the policy itself — it is versioned and announced, and does not arrive as a line on this page.
You are not a party to our contracts with these companies, so you have no contractual right to object to one of them the way a business customer would. What you do have are the rights in section 6 of the Privacy Policy, which apply whoever is processing, and the ability to export everything and delete your account at any time from Settings.
Classification purposes
These are the small decisions that shape how you are answered rather than what the answer says. Each returns a label and a probability, and none of them writes any part of the answer you read. They are listed one by one, including any that are not currently switched on, because a list that silently dropped what is off could not be checked against what we actually run.
| Purpose | What that purpose sends | Status |
|---|---|---|
| Ranking retrieved passages by relevance (semantic reranking) | Your question and the candidate passages retrieved from your own materials and from course materials made available to you | Enabled |
| Choosing which teaching approach answers you (the teaching-style selector) | Your question, and whether you attached an image — never the image itself | Enabled |
The list
AI inference — the model that writes each answer
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Anthropic, PBC | When a Claude model answers you | Message content, retrieved passages, tool outputs, and any image you attach | Generating the answer you read | United States |
| OpenAI, L.L.C. | When a GPT model answers you | Message content, retrieved passages, tool outputs, and any image you attach | Generating the answer you read | United States |
| Google LLC (Gemini) | When a Gemini model answers you | Message content, retrieved passages, tool outputs, and any image you attach | Generating the answer you read | United States and other Google regions |
| Alibaba Cloud (Qwen) | When a Qwen model answers you | Message content, retrieved passages, tool outputs, and any image you attach | Generating the answer you read | Singapore. We deliberately use Alibaba's International endpoint, whose service scope excludes the Chinese mainland |
| Z.AI (GLM) | When a GLM model answers you | Message content, retrieved passages, tool outputs, and any image you attach | Generating the answer you read | Regions designated by Z.AI for its international API endpoint, outside Brazil |
Indexing your uploads — building and searching your private index
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| OpenAI, L.L.C. (embeddings) | Always, whichever chat model you pick | The full text of each file you upload, and the text of each search it runs against your materials | Building and searching your private index. The index is built once, separately from the model that answers you | United States |
Classification — small decisions that shape how you are answered
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| TypeSafe AI, Inc. (Jev) | Only for the classification purposes listed above that are marked enabled | See the per-purpose list above — each purpose sends only what that purpose needs | Returning a label and a probability. It never writes any part of the answer you read. Our contract with TypeSafe forbids using your content to train or adjust any model without our permission, which we do not give | United States. Its subprocessors are also in the United States: Amazon Web Services, which stores and processes the request, and Modal, whose compute nodes process the prompt without storing it |
| Cohere Inc. | Only when the reranking layer is configured to use it instead of TypeSafe | Your question together with the candidate passages retrieved from your own materials and from course materials made available to you. Direct identifiers are stripped before the request leaves us, which reduces exposure without making the payload anonymous | Re-ordering search results by relevance | United States |
Lookup — web and academic sources the tutor cites
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Tavily | When web search is enabled and Tavily is configured | Search queries derived from your question | Live web search grounding | United States |
| DuckDuckGo | When web search is enabled and Tavily is not configured | Search queries derived from your question | Live web search grounding | United States |
| arXiv, Crossref, PubMed/NCBI | When academic lookup is enabled | Search terms derived from your question. Never your name, e-mail, or account id | Finding and verifying references so the tutor cites real sources instead of inventing them | United States and Europe |
Payments and subscriptions
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Paddle.com Market Ltd | When you buy or manage a subscription | Email, account and checkout references, billing intent, payment and subscription events, and referral redemption references | Payment processing and subscription management. As our merchant of record Paddle is the legal seller of your subscription, so for the payment relationship it acts on its own behalf rather than on ours, under its own privacy notice | United Kingdom and United States |
| Asaas Gestão Financeira S.A. | When enabled, for Brazilian payment methods | Email, account and checkout references, billing intent, payment and subscription events | Payment processing and subscription management | Brazil |
Hosting and delivery
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Google LLC (OAuth, Calendar) | Only if you sign in with Google or connect Calendar | OAuth authorization code exchange | Sign-in and Calendar sync | United States and other Google regions |
| GitHub, Inc. | Only if you connect it | Your authorization, and the repository content you ask the tutor to read or change | The optional GitHub integration | United States |
| Fly.io, Inc. | Always | Application traffic | Backend hosting | United States and other regions of that provider |
| Cloudflare, Inc. | Always | Frontend traffic, DNS resolution, inbound e-mail routing, and aggregate edge analytics (requests by country and device class) | Frontend hosting, DNS, e-mail, and traffic analytics | A global edge network; associated account metadata is processed in the United States and Europe |
| Functional Software, Inc. (Sentry) | When enabled | Error events with personally identifiable information scrubbed | Error monitoring | United States |
Messages we send you
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Our e-mail relay | When enabled | Your e-mail address and the message we send you | Transactional e-mail such as password resets | United States |
| Your browser's own push service (Google, Mozilla, or Apple) | Only if you turn on reminders | The push endpoint your browser issued, and the reminder we send to it | Delivering study reminders to your device | Determined by your browser vendor |
Abuse prevention
| Recipient | When it receives anything | What is sent | Why | Where it processes |
|---|---|---|---|---|
| Google LLC (reCAPTCHA) | When enabled, at signup and login | A CAPTCHA token and your IP address | Blocking automated signup and login abuse | United States and other Google regions |
Record of changes
- 2026-09-21 — First publication of this list. Nothing was added or removed: every entry was already named in the Privacy Policy's third-party and transfer tables, and this page consolidates them so that future changes can be published here without reopening the policy.
Questions about a specific recipient or the safeguards applying to it: [email protected].