Sub-processors
Last updated: 3 November 2026
voice.school uses the companies below to run the service. They process personal data only on our instructions and under data processing agreements. For schools, this list is Appendix B of our data processing agreement.
| Company | What it does for us | Personal data | Where | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) | Amazon Aurora PostgreSQL: the database | All account, class and assignment data, transcripts, grades, feedback and integrity events, and the database backups | eu-central-1, Frankfurt, Germany | Stored in the EU. AWS data processing addendum with EU standard contractual clauses; EU-US Data Privacy Framework |
| Amazon S3: file storage | Students' voice recordings | eu-central-1, Frankfurt, Germany | As above | |
| Amazon SES: sending emails | Name, email address and the content of account and notification emails | eu-west-1, Ireland | As above | |
| Cloudflare (Cloudflare, Inc., USA) | Hosting and running of the website and API (Workers), the queue for transcription jobs, the database connection (Hyperdrive and a tunnel protected by Cloudflare Access), content delivery, DNS, TLS and protection against attacks | Everything that passes between your browser and the service; technical data such as IP addresses in short-lived logs | Cloudflare's global network: each request is handled in a data centre near the user | EU-US Data Privacy Framework; EU standard contractual clauses in Cloudflare's data processing addendum |
| PostHog (PostHog Inc., USA) | Product analytics | Pseudonymised events sent from our servers: an internal account ID, the role and the action. No names, email addresses, recordings, transcripts or answers | EU cloud, Frankfurt, Germany | Stored in the EU. EU standard contractual clauses in PostHog's data processing agreement |
Not sub-processors
- Sign in with Google. If you choose to sign in with your Google account, Google acts on its own behalf, and Google's privacy policy applies to that sign-in. We receive your name, email address and Google account ID.
- Email providers. The provider that receives our emails for you (your school's or your own) is not our sub-processor.
Changes
Before we add or replace a sub-processor, we tell schools that have accepted the data processing agreement by email at least 30 days in advance, and we update this page. Questions: privacy@edaptio.com.