Sub-processors
Last updated: [FOUNDER: publish date]
To run Mamagayo we rely on a small number of trusted service providers (“sub-processors”) that handle some of your data on our behalf. We never sell your personal data, and we only share what a provider needs to do its job. This page lists every provider currently in use, the learner data it receives, where it processes that data, and the safeguard that covers any transfer outside the EU/EEA/UK/Switzerland.
This page complements our Privacy Policy, which explains what we collect and why. If the two ever appear to differ about which providers we use, treat this page as the fuller list.
1. Providers we use
| Provider | What learner data it receives | Where it processes data | International transfer mechanism |
|---|---|---|---|
| Vercel (hosting and compute) | All app traffic, meaning every request you make to the service passes through it | Primarily United States | Standard Contractual Clauses, plus the EU-US, UK and Swiss Data Privacy Framework |
| Supabase (database, sign-in, file storage) | Everything we store about you: account and profile, conversation content, session and voice audio, learner memory, and diary entries | [FOUNDER: confirm project region] | Data Processing Agreement with Standard Contractual Clauses; provider holds SOC 2 Type 2 and ISO 27001 |
| Microsoft Azure (speech-to-text, text-to-speech, AI tutor responses) | Your spoken and written turns, the tutor responses generated for you, and your voice audio | The Azure region we operate in | Microsoft Products and Services Data Protection Addendum with Standard Contractual Clauses |
| PostHog (product analytics) | Usage events and a whitelisted set of properties only, never your conversation content, transcripts, or audio | European Union or United States, depending on configuration | EU-US, UK and Swiss Data Privacy Framework, with Standard Contractual Clauses as a backstop |
| Resend (email delivery) | Your email address and the lifecycle emails we send you (practice reminders and progress recaps, which may include coarse stats like session counts and streaks, never your conversation content); delivery, click, bounce and complaint events | United States (runs on AWS) | Data Processing Agreement with Standard Contractual Clauses; provider holds SOC 2 Type 2 |
| [FOUNDER: payment processor / merchant of record once chosen] | Billing and subscription data (we never handle your card details directly) | [FOUNDER: confirm region once provider is chosen] | [FOUNDER: confirm transfer mechanism once provider is chosen] |
2. What these providers commit to
- No training on your data. Microsoft does not use your prompts, completions, or training data to train its own or any third party’s AI models, and does not share them with the underlying AI provider outside Microsoft’s own infrastructure. PostHog does not use your data to train AI or machine-learning models.
- Limited abuse monitoring. Microsoft Azure runs a limited abuse-monitoring process in which authorized reviewers may examine flagged content for policy violations. Where required, that review is carried out by reviewers based in the EEA for EEA-deployed resources.
- Analytics stays content-free. We never send your conversation content, transcripts, or audio to our analytics tools. This is enforced by a filter in our own code, not just a policy promise.
3. Changes to this list
We may add, remove, or replace a sub-processor as the service evolves. When we do, we will update this page and, for material changes, notify you in-app or by email as described in our Privacy Policy.