Sub-processors
Last updated 7 September 2026.
These are the companies that help us run StudyMarket. Section 5.2 of our Privacy Policy points here. Fourteen entries: thirteen are processors and each has a data processing agreement in force, and the fourteenth, Google Maps, is an independent controller, so no such agreement arises.
We give at least 30 days notice before a new processor starts.
We keep this list in English so it is always up to date.
| Company | What we use them for | What they touch | Where they process | Data processing agreement |
|---|---|---|---|---|
| Clerk | Authentication and account management | Account identity, email and session data, for every agent and provider user | United States | In force |
| DigitalOcean | Primary database host | The platform database, so everything held on the platform | United States | In force |
| Vercel | Application hosting and file storage | All hosted data, and uploaded documents and generated PDFs on private storage | United States | In force |
| Anthropic | Artificial intelligence features | Content sent to the model by the features listed in section 4 of the Privacy Policy, including student names where the customer's purpose requires it | United States | In force. Contractually barred from training on content submitted through our account |
| Resend | Transactional email | Recipient addresses and message content | United States | In force |
| Woodpecker | Outbound email campaign delivery | Outreach contact name and email address | European Union | In force |
| Brevo | Marketing email and contact management | Marketing contact records | European Union | In force |
| MillionVerifier | Email address verification | Candidate contact email addresses, checked for deliverability before anything is sent | Hungary | In force. Barred in writing from reusing addresses across its other customers |
| Google Analytics 4 | Site usage analytics | Visitor behaviour on the public site, only where you have consented | United States | In force |
| Airtable | CRM and lead enrichment data storage | Agent contact records and sales prospects. No student data | United States | In force |
| Sentry | Error monitoring and diagnostics | Error reports, with sensitive fields stripped before sending in every runtime. Errors on the signed-in platform carry the user's account id, email and name, so we can see who was affected | United States | In force |
| DeepL | Translation of platform content into other languages | Content submitted for translation, which can carry personal data written by a user | European Union | In force |
| Deepgram | Voice note transcription | Microphone audio, streamed from the browser to their European endpoint. It never reaches our servers, and only the transcript is stored | European Union endpoint, United States company | In force. Opted out of their model improvement programme, verified against their own request log |
| Google MapsIndependent controller | Address and location autocomplete | Typed address fragments, sent from your browser direct to Google. They do not touch our servers | United States | None, and none arises. Google is an independent controller here, under its own controller terms, not a processor acting for us |
Companies we no longer use
Kept here because accountability is about what we did, not only what we do now.
| Company | What we use them for | Removed | Why |
|---|---|---|---|
| Bunny.net | Image and file hosting | 7 September 2026 | It was the only processor without a data processing agreement. We stopped using the vendor rather than signing one, and moved the files elsewhere |