Sub-processors
Version 1.1, effective 6 November 2026

Draft for pilot use. Review by a solicitor before relying on it.

# Sub-processors

These are the suppliers TutorMaestry uses that may process personal data in your account, on our behalf, under the [Data processing agreement](/legal/dpa). Each is bound by a written contract with data protection terms at least as protective as ours.

Some are used only if you connect them or use the feature: the "When it is used" column says which.

| Sub-processor | Company | What for | Personal data | Where | When it is used | Transfer safeguard |
|---|---|---|---|---|---|---|
| Fly.io | Fly.io, Inc. | Hosting: runs the application and stores its database and uploaded files | All customer data held in the service | Paris, France (EU) | Always | Held in the EU (UK adequacy regulations). Any access from the US is covered by the provider's DPA with the UK Addendum to the EU Standard Contractual Clauses |
| Tigris | Tigris Data, Inc. | Off-site backups | Encrypted copies of the database and files. Encrypted before upload; the provider cannot read them | EU storage region | Always | UK Addendum to the EU Standard Contractual Clauses (the provider's DPA); the content is unreadable to the provider |
| Anthropic | Anthropic, PBC | The AI report writer and assistant | What a feature sends: for a report, a pupil's first name, curriculum objectives and levels and notes the tutor has allowed; for the assistant, what the tutor types. Not used to train AI models | United States | Only on plans with AI, when the tutor uses an AI feature | UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the provider's commercial DPA) |
| Google | Google LLC | Signing in with Google and calendar sync | The tutor's Google account email; calendar event titles, times and attendees | United States and global | Only if the tutor connects a Google account | UK Extension to the EU-US Data Privacy Framework, and the UK Addendum in Google's DPA |
| Stripe | Stripe Payments Europe, Ltd. and Stripe, Inc. | Taking subscription payments; card payments from families if the tutor connects Stripe | Billing name, email and payment details (card details go straight to Stripe, never to TutorMaestry); for family payments, the payer's name, email and amount | Ireland (EU) and United States | Paid plans; family payments only if the tutor connects Stripe | UK Extension to the EU-US Data Privacy Framework, and the UK Addendum in Stripe's DPA |
| GoCardless | GoCardless Ltd | Direct Debit payments from families | The payer's name, email and the amount; bank details are handled by GoCardless directly | United Kingdom | Only if the tutor connects GoCardless | None: processed in the UK |
| Email delivery | [CONFIRM: email delivery provider] | Sending the emails the tutor sends or approves, and account emails | Recipient address and the email's content | [CONFIRM: location] | When email is set up for the account | [CONFIRM: transfer mechanism, if outside the UK or EU] |
| Sentry | Functional Software, Inc. (Sentry) | Error monitoring | Technical error details. Configured to send no personal data: no request bodies, no form values, no names or emails, links carrying a secret scrubbed | Frankfurt, Germany (EU) | Always | Held in the EU (UK adequacy regulations); the provider's DPA includes the UK Addendum for any US access |

## Changes to this list

We tell you at least 30 days before we add or replace a sub-processor: this page is updated with a new version and effective date, a notice appears in the app, and the account owner is emailed where email is set up. You can object, as the [Data processing agreement](/legal/dpa) (section 9) explains.

## Not on this list

Suppliers that never receive personal data are not sub-processors (for example, the public exchange-rate service used to convert currencies, which is sent only currency codes and dates).

Questions: [CONFIRM: support email].