Underdatabehandlere

voice.school uses the companies below to run the service. They process personal data only on our instructions and under data processing agreements. For schools, this list is Appendix B of our data processing agreement.

Company	What it does for us	Personal data	Where	Transfer basis
Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg)	Amazon Aurora PostgreSQL: the database	All account, class and assignment data, transcripts, grades, feedback and integrity events, and the database backups	eu-central-1, Frankfurt, Germany	Stored in the EU. AWS data processing addendum with EU standard contractual clauses; EU-US Data Privacy Framework
	Amazon S3: file storage	Students' voice recordings	eu-central-1, Frankfurt, Germany	As above
	Amazon SES: sending emails	Name, email address and the content of account and notification emails	eu-west-1, Ireland	As above
Cloudflare (Cloudflare, Inc., USA)	Hosting and running of the website and API (Workers), the queue for transcription jobs, the database connection (Hyperdrive and a tunnel protected by Cloudflare Access), content delivery, DNS, TLS and protection against attacks	Everything that passes between your browser and the service; technical data such as IP addresses in short-lived logs	Cloudflare's global network: each request is handled in a data centre near the user	EU-US Data Privacy Framework; EU standard contractual clauses in Cloudflare's data processing addendum
PostHog (PostHog Inc., USA)	Product analytics	Pseudonymised events sent from our servers: an internal account ID, the role and the action. No names, email addresses, recordings, transcripts or answers	EU cloud, Frankfurt, Germany	Stored in the EU. EU standard contractual clauses in PostHog's data processing agreement

Not sub-processors

• Sign in with Google. If you choose to sign in with your Google account, Google acts on its own behalf, and Google's privacy policy applies to that sign-in. We receive your name, email address and Google account ID.
• Email providers. The provider that receives our emails for you (your school's or your own) is not our sub-processor.

Changes

Before we add or replace a sub-processor, we tell schools that have accepted the data processing agreement by email at least 30 days in advance, and we update this page. Questions: privacy@edaptio.com.