Subprocessors

A subprocessor is a third-party company that processes personal data on our behalf so that we can provide ClassFactor, for example by hosting our servers, delivering email or running the AI models behind our features. Each one is bound by a written contract that limits how it may use the data. Some providers on this list, such as payment platforms, app stores and advertising partners, also process data as independent controllers under their own terms and privacy policies.

We process data in the United States. For users in the EEA and the UK, we rely on appropriate safeguards for international transfers, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, and, where a provider is certified, the EU-U.S. Data Privacy Framework and its UK Extension. Our Privacy Policy (/privacy) explains how we use personal data and the choices you have.

We update this page before we add a new subprocessor. Business customers who have signed our Data Processing Addendum (/dpa) receive at least 30 days’ notice by email before a new subprocessor begins processing their data, and may object as described in the DPA. Questions about this list can be sent to support@classfactor.com.

Purpose: Application hosting, databases (PostgreSQL), job queues (Redis) and logs.

Data processed: All account and service data.

Location: United States.

Purpose: Website and web app hosting and edge network, including detecting your approximate country from your IP address to choose the right cookie consent default.

Data processed: Request data and IP address.

Location: Global edge network; United States.

Purpose: File storage for uploads, support attachments and generated media (R2), and bot protection on forms and sign-in (Turnstile).

Data processed: Stored files, and device and browser signals used for bot checks.

Location: Global network; United States.

Purpose: AI generation, transcription of uploaded and recorded audio and video, realtime voice calls, image generation and embeddings.

Data processed: Study content, prompts, voice audio during calls, and study coach profile context.

Location: United States.

Purpose: AI generation.

Data processed: Study content and prompts.

Location: United States.

Purpose: YouTube video transcription and text recognition in images and PDFs.

Data processed: YouTube URLs, images and PDF pages.

Location: United States.

Purpose: Text-to-speech for the Listen feature.

Data processed: The text you ask to hear.

Location: United States.

Purpose: Web payments, subscriptions, the customer billing portal and fraud prevention.

Data processed: Name, email address, payment details (held by Stripe) and billing history.

Location: United States.

Purpose: In-app purchases, sign-in and push notifications on iOS.

Data processed: Purchase and transaction IDs, Sign in with Apple identifiers and device push tokens.

Location: United States.

Purpose: Android purchases, sign-in, push notification delivery and product analytics.

Data processed: Purchase tokens, Google sign-in identifiers, push tokens, and analytics events and identifiers.

Location: United States.

Purpose: Mobile push notification relay and over-the-air app updates.

Data processed: Push tokens, notification content and app update requests.

Location: United States.

Purpose: Email delivery.

Data processed: Email address and email content.

Location: United States.

Purpose: Error monitoring (errors only; no session replay).

Data processed: Error details, user ID, and device and browser information.

Location: United States.

Purpose: Advertising measurement through a pixel on the website and web app and the server-side Conversions API, only with your consent or where you have not opted out.

Data processed: Pixel cookies and identifiers and page views; for trial and purchase events, a hashed email address, ad click IDs, the IP address and user agent captured at sign-up, and the plan and value.

Location: United States.

Purpose: Advertising measurement through a pixel and the server-side Events API, only with your consent or where you have not opted out.

Data processed: Pixel cookies and identifiers and page views; for trial and purchase events, a hashed email address, ad click IDs, the IP address and user agent captured at sign-up, and the plan and value.

Location: United States and Singapore, as described by TikTok.

Purpose: Fetching metadata and thumbnails for YouTube links you add.

Data processed: The YouTube URL.

Location: United States.

Meta and TikTok receive data from ClassFactor only for advertising measurement, and only in line with your choices. In the United States, advertising measurement is on by default and you can opt out at any time. Everywhere else, including the EEA, the UK and locations we cannot determine, it stays off until you opt in. A Global Privacy Control signal turns it off.

When advertising is off for you, our pixels do not load and we do not send server-side conversion events about you to these partners. You can review or change your choice at any time under “Your privacy choices” in our Cookie Policy (/cookies). The mobile apps do not use advertising identifiers.