1. Cloudflare, Inc.
What it does: the network all traffic to the website and panel passes through, and the domain's DNS; for imports from LangLion also a request relay. Which data: what you send between the browser and the panel, while in transit, the IP address and connection headers; we do not ask Cloudflare to store this data. Where: Cloudflare's global network, a company in the USA. Transfer basis: the European Commission decision on the EU-US Data Privacy Framework or standard contractual clauses.
2. Hetzner Online GmbH
What it does: stores files and backups away from our server. Which data: files uploaded by the school (documents, materials, contract and certificate templates, support screenshots) and a daily database backup, encrypted before upload with a key Hetzner does not know; backups are kept for 90 days. Where: Germany (Falkenstein). Data does not leave the EEA.
3. Zoho (ZeptoMail and Zoho Mail)
What it does: sends system messages (invitations, new passwords, links to reports, contracts and payments, notifications) and runs the [email protected] mailbox that receives support requests. Which data: the recipient's e-mail address and name, the subject and body of the message, the content of a request. Where: an EU data centre.
4. Stripe
What it does: handles the Cerium subscription and the school's online payments, which go through the school's own Stripe account. Which data: payer and card details (the card stays with Stripe only), and for school payments the student's name, the amount, the payment reference and the payer's e-mail. Where: the Stripe group, whose parent company is in the USA. Transfer basis: the EU-US Data Privacy Framework or standard contractual clauses.
5. OpenAI
What it does: a language model that drafts a comment for a student report and answers in the help chat in the panel. The AI comment is on by default, and the school owner turns it off in Settings. Which data: for a report, attendance, grade and homework figures and the teacher's notes with first names, surnames, school and group names, e-mail addresses, phone numbers and PESEL numbers removed; for the help chat, the question the user types. We ask the provider not to store requests. The contracting entity, place of processing and transfer basis will be added to this page soon.
6. Browser notification services
When someone turns on browser notifications themselves, the message passes through the push service of the browser vendor: Google, Mozilla, Microsoft or Apple. The content is encrypted end to end, so the service only sees the encrypted message, the subscription address and the time, not what it says.
7. What is not on the list
The application, database and online lesson servers are our own and located in Poland; lesson video and audio do not pass through Cloudflare and are not recorded. The accounting software, the Stripe account and the previous system a school imports data from work under the school's own agreement with that provider, and Cerium sends data to them on the school's instructions. A YouTube or Vimeo video embedded on a whiteboard works under that service's rules.
8. Planned
Phone notifications in the mobile app will go through Google Firebase Cloud Messaging, and on iPhone further through Apple's service. This service is not switched on today. It will receive only a device identifier and a short text without student data, and we will announce switching it on the same way as any change to the list.
9. How we change the list
We tell schools about an intended new or replaced subprocessor by e-mail or in the panel at least 14 days in advance, naming the provider, the scope of data, the place of processing and the transfer basis. During that time the school may object, which counts as terminating the agreement at the end of the billing period. Every subprocessor carries data protection obligations matching our data processing agreement, and we are liable to the school for their performance.