Sub-Processors

1. Overview

ClevStudy Limited ("ClevStudy", "we", "us", or "our") uses third-party service providers ("sub-processors") to help deliver the ClevStudy platform. This page provides a comprehensive list of those sub-processors, including the purpose of their engagement and the categories of personal data they may process on our behalf.

All sub-processors are engaged under Data Processing Agreements (DPAs) that require them to:

• Process personal data only on our documented instructions.
• Implement appropriate technical and organisational security measures.
• Assist us in meeting our obligations under UK GDPR, including data subject rights requests.
• Delete or return all personal data at the end of the service relationship.
• Allow for and contribute to audits and inspections.

This page is referenced by our Privacy Policy and our Data Processing Agreement. For details on how we handle personal data more broadly, please refer to our Privacy Policy.

2. Current Sub-Processors

The following table lists all sub-processors currently engaged by ClevStudy.

3. Infrastructure & Hosting

Microsoft Azure

Microsoft Azure provides the core cloud infrastructure for the ClevStudy platform, including compute, networking, database, and storage services. Our Azure resources are deployed in UK and EU regions, ensuring that the majority of personal data remains within jurisdictions that provide adequate data protection under UK GDPR.

Azure is certified under ISO 27001, SOC 2 Type II, and is compliant with UK GDPR. All data at rest is encrypted, and all data in transit is encrypted using TLS 1.2 or higher. Access to infrastructure is restricted via private networking and scoped credentials.

4. AI Services

OpenRouter

OpenRouter provides AI model routing for ClevStudy's tutoring engine, connecting to various large language models to generate teaching scripts, assessment questions, explanations, and adaptive learning content. Data sent to OpenRouter includes lesson topics, student responses, and mastery levels — identified by internal session IDs only. Student names and personal contact details are never included in AI requests. Under our agreement, OpenRouter does not use ClevStudy data to train any models.

OpenAI

OpenAI is used as a secondary validation layer to review AI-generated content for accuracy, appropriateness, and educational quality. The same data minimisation principles apply. Under our agreement, OpenAI does not use ClevStudy data to train its models.

Speechify

Speechify provides text-to-speech capabilities for accessibility and audio-based learning. Only text content to be spoken is sent to the service; no student personal data is included.

5. Communications

Resend

Resend handles transactional email delivery, including account verification, password reset, parent notifications, and invitation emails. Resend processes recipient email addresses and email content strictly for delivery purposes.

OneSignal

OneSignal provides push notification services for the ClevStudy mobile application, including streak reminders and learning notifications. OneSignal processes device identifiers and notification preferences. No student names or learning content are included in notification payloads sent via OneSignal.

6. Payments

Paddle.com Market Limited

Paddle processes all subscription payments, billing, and payment method management for ClevStudy as the Merchant of Record. Paddle is a PCI DSS Level 1 certified payment processor. Payment card details are handled entirely by Paddle and never touch ClevStudy servers. Paddle processes customer names, email addresses, and billing information as required to fulfil payment transactions.

7. International Transfers

Some sub-processors (OpenRouter, OpenAI, Speechify, Resend, OneSignal) are based in the United States. Paddle is based in the United Kingdom. Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with UK GDPR, including:

• Standard Contractual Clauses (SCCs) — approved by the ICO as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.
• Supplementary measures — including encryption in transit and at rest, data minimisation, and contractual restrictions on further processing.
• Transfer Impact Assessments — conducted for each US-based sub-processor to evaluate risks and safeguards.

The "(SCCs)" notation in the Location column of the sub-processor table indicates that Standard Contractual Clauses (or the UK equivalent) are in place for that provider.

8. Changes to This List

We may update this sub-processor list from time to time as we engage new providers or change existing ones. When we make material changes, we will:

• Update this page with the new or changed sub-processor details.
• Update the "Last updated" date at the top of this page.
• Notify customers who have a Data Processing Agreement with us, providing a reasonable objection period (typically 30 days) as required under UK GDPR Article 28.

Changelog

9. Contact Us

If you have questions about our sub-processors or wish to request a copy of our Data Processing Agreement, please contact us at:

ClevStudy Limited
Email: privacy@clevstudy.com