Our sub-processors.
1. What a sub-processor is
Obiter is the controller of your personal data: we decide what is collected and why. To run the service we use other companies that process some of that data on our instructions — hosting it, sending your email, taking your payment. Those are our processors, and under Article 28 of the UK GDPR each of them is bound by a written contract that limits what they may do with your data.
This page lists all of them. It is the same list as our internal register; there is no longer version kept back.
2. Used for every account
| Sub-processor | What it does | What it sees | Where | Transfer basis |
|---|---|---|---|---|
| Vercel Inc. | Application hosting and delivery | IP address and request metadata, in transit | USA (functions pinned to London, lhr1) | UK IDTA / SCCs |
| Supabase Inc. | Database, authentication and file storage, including uploaded files and lecture recordings | Everything you store in Obiter, including audio recordings and their transcripts | UK (London, AWS eu-west-2) | None — your data does not leave the UK |
| Resend Inc. | Transactional email (sign-in, receipts, alerts) | Email address, name, message content | USA | UK IDTA / SCCs |
| Functional Software, Inc. (Sentry) | Application error monitoring for our web servers; crash reporting for the mobile app | Web: error details, page, account identifier. Mobile app: error details, app and OS version only; no account identifier, no session replay | USA (web servers); EU (mobile app project) | UK IDTA / SCCs for the US project; UK adequacy decision for the EU project |
3. Used only if you use the feature
None of these are engaged unless you do the thing described. A student who never pays, never connects a calendar, never uploads a file, never records or dictates, never enables notifications and declines analytics is not touched by any row in this table.
| Sub-processor | What it does | What it sees | Where | Transfer basis |
|---|---|---|---|---|
| OpenRouter, Inc. | AI gateway. Routes Obiter AI requests, and audio transcription of lecture recordings, to the model providers below and enforces our no-retention, no-training settings. | The message, essay, document text, transcript or audio recording you submit, in transit to the provider | USA | UK IDTA / SCCs. Zero data retention; not used to train models. |
| Google LLC (Google Cloud Vertex AI) | Processes Obiter AI messages, flashcard and summary generation, transcript reading, and transcription of lecture recordings of up to 20 minutes (Gemini, via OpenRouter) | The message, essay, document text, transcript or audio recording you submit | USA and EU | UK IDTA / SCCs. Zero data retention; not used to train models. |
| OpenAI, L.L.C. | Processes practice question generation; builds the search index for your notes and files; transcribes lecture recordings longer than 20 minutes, or where the primary model fails (Whisper) | Practice-question prompts; the text of your notes and files, for the search index; audio recordings sent for transcription | USA | UK IDTA / SCCs. Zero data retention; not used to train models. |
| Stripe, Inc. | Payments and subscription management | Card details (direct to Stripe — we never see them), billing address, email | USA | UK IDTA / SCCs |
| Google LLC | Sign in with Google; Google Calendar; Google Drive import | Account identifier; calendar events; files you choose to import | USA | UK IDTA / SCCs |
| Microsoft Corporation | Outlook Calendar; OneDrive import. Azure hosts OpenAI models used as a fallback for AI processing | Calendar events; files you choose to import | USA | UK IDTA / SCCs |
| Dropbox, Inc. | Dropbox file import | Files you choose to import | USA | UK IDTA / SCCs |
| Apple Inc. | Sign in with Apple | An opaque user identifier, and your email unless you hide it | USA | UK IDTA / SCCs |
| Expo (650 Industries, Inc.) | Push notification delivery for the mobile app, if you allow notifications. Expo relays to Apple or Google’s notification service | A device push token; the notification title, text and in-app link. Never the content of your notes or messages | USA | UK IDTA / SCCs |
3a. Speech recognition on your device
Dictation in the mobile app is performed by your phone's operating system, not by Obiter. Audio goes from your device to Apple or Google under their own privacy terms and never passes through our systems; only the recognised text reaches Obiter, as part of your note. These are therefore not our processors, but we list them so that the picture is complete.
| Sub-processor | What it does | What it sees | Where | Transfer basis |
|---|---|---|---|---|
| Apple Inc. (iOS speech recognition) | Converts dictation to text in the note editor on iPhone and iPad | Your speech while the Dictate button is active, sent by iOS to Apple; only the resulting text reaches Obiter | See provider (Apple’s privacy policy) | Apple’s own terms; not on Obiter’s instructions |
| Google LLC (Android speech recognition) | Converts dictation to text in the note editor on Android | Your speech while the Dictate button is active, sent by the Google app to Google; only the resulting text reaches Obiter | See provider (Google’s privacy policy) | Google’s own terms; not on Obiter’s instructions |
4. What none of them may do
- None of them may use your data for their own purposes.
- None of them may sell it, and we do not sell it either.
- Your notes, essays, messages and documents are never used to train AI models. We route AI requests only through provider endpoints that do not retain your data after processing, and every data-training option on our AI gateway account is switched off.
- None of them receives advertising data from us, because we do not do advertising.
5. Transfers outside the UK
Where a processor is in the United States, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and we have carried out the risk assessment that goes with it. Where a processor is in the EU, no additional safeguard is needed: the EU benefits from a UK adequacy decision.
Our two largest stores of your actual work — the database and your uploaded files — are both in London, and never leave the UK. The database region was verified on 2 August 2026 as AWS eu-west-2.
6. Changes
We will update this page before a new sub-processor starts processing your data, not after. If you want to be told when it changes, email privacy@obiter.site and we will add you to the notification list.