Subprocessors
These are the service providers (subprocessors) we use to operate AI Architect Academy, what each one processes, where it is processed, and what transfer safeguard applies when data leaves the European Economic Area. See our Privacy Policy for the legal basis behind each use, and our Data Processing Agreement page for contractual terms.
| Processor | Role | Data | Region | Safeguard |
|---|---|---|---|---|
| Cloudflare | Hosting, database, email delivery, AI gateway | Account/session data, learning records, coach transcripts (storage); outbound account emails; LLM request routing | EU (primary; global edge network) | EU processing (primary); EU-US DPF certified, with the EU Standard Contractual Clauses (2021) in Cloudflare's DPA |
| Clerk | Authentication and account data | Email address, session/auth tokens, account metadata | US | EU-US DPF certified; SCCs in Clerk's DPA apply as fallback |
| Stripe, via Clerk Billing | Payment processing | Billing/subscription status only; card data never reaches our systems | US | EU-US DPF certified; SCCs in Stripe's DPA apply as fallback |
| OpenRouter | LLM routing for the AI coach | Coach conversation messages, in transit and processing | US | SCCs / EU-US Data Privacy Framework (DPF) (placeholder — confirm) |
| Anthropic | LLM provider for the AI coach | Coach conversation messages, processed to generate replies | US | EU-US DPF certified (engaged via OpenRouter as our processor) |
| Amazon Web Services (Bedrock) | Possible LLM serving path | Coach conversation messages, if routed via this serving path | US | EU-US DPF certified (covered by the Amazon.com, Inc. certification) |
| Microsoft | Advertising tag (UET) and product analytics (Clarity) — post-consent only | Ad click/conversion events; aggregated usage analytics | US | EU-US DPF certified |
| Analytics and ads conversion tags — post-consent only | Aggregated usage analytics; ad conversion events | US | EU-US DPF certified |
DPF is the EU-US Data Privacy Framework, a European Commission adequacy decision covering US companies certified under it. If a processor's certification lapses, or the framework itself is invalidated, the Standard Contractual Clauses in the applicable data processing agreement take over as the transfer safeguard.
More on your data
For what we process, why, retention windows, and your rights, see our Privacy Policy. For cookie-level detail, see our Cookie Policy.