Sub-processors
Last updated: 2 November 2026
1.Current sub-processors#
A sub-processor is a company we use to run Tooition that may process personal information, including family data we process on behalf of teachers.
| Provider | What it does for Tooition | Data involved | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Application hosting (ECS on Fargate), secrets storage (Secrets Manager), sending email (SES). | All data handled by the application; email addresses and message content for emails we send. | USA (us-east-1, N. Virginia) |
| Neon | Managed Postgres database. | Account, student, family, booking, payment-record and other structured data. | USA (runs on AWS us-east-1) |
| Cloudflare, Inc. | CDN, web application firewall, DNS and secure tunnel to our servers; R2 file storage; Workers AI (the AI assistant); Turnstile bot checks. | Web traffic (including IP addresses); uploaded files and practice recordings (R2); assistant messages while they are processed (not stored by us). | Stored files: USA. Traffic and AI requests are handled across Cloudflare’s global network, usually at a location near the user. |
| Stripe, Inc. and its affiliates | Payments from families to teachers (Stripe Connect), Tooition subscriptions (Stripe Billing), and identity and payout checks for teachers. | Payer names, emails, payment details (card details go straight to Stripe), and teacher business and payout details. | USA and other countries where Stripe operates |
2.Other services (no personal data)#
| Service | What it does | Data involved |
|---|---|---|
| Frankfurter (European Central Bank reference rates) | Currency exchange rates, so families can see prices in their own currency. | None. We request published exchange rates only; no personal information is sent. |
3.Where data is stored#
Tooition stores its data in the United States. Because Cloudflare runs a global network, web requests and AI requests may pass through, or be processed in, Cloudflare locations outside the United States on their way. Read more about international transfers in our Privacy Policy.
4.How we choose and manage sub-processors#
- We use established providers, under their data processing terms, that require them to protect personal information and use it only to provide their services to us.
- We give each provider only the data it needs for its job.
- Cloudflare Workers AI does not use customer data to train its models.
- Where needed for transfers from the EU or UK, we rely on the providers’ Standard Contractual Clauses and UK addendum.
5.Changes to this list#
We’ll update this page before a new sub-processor begins processing personal information. Where it affects family data we process for teachers, we aim to email teachers at least 30 days in advance, unless we need to act sooner to keep Tooition running or secure. If you object to a change, email [email protected]. If we can’t reasonably address your objection, you can cancel your plan.
Questions? [email protected] · Vox Samples Pty Ltd, Melbourne, Australia