Last updated: 2026-05-04
Below is the current list of third-party services that process personal data on our behalf. Each is bound by a written agreement that mirrors the data-protection commitments we make to you.
Adding or removing a sub-processor is a code change reviewed in our public repository. Paying B2B customers can subscribe to email notifications for material changes (30-day advance notice).
| Provider | Purpose | Location | Privacy policy |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, invoices. | United States (EU/UK Standard Contractual Clauses) | View |
| OpenRouter | AI inference routing across multiple model providers. | United States | View |
| OpenAI | GPT-family models for AI question generation, scoring, chat. | United States | View |
| Anthropic | Claude-family models for AI features. | United States | View |
| Google (Vertex AI / Gemini, OAuth) | Gemini models, Google Sign-In, Google Tag Manager (analytics). | United States / EU | View |
| Google Sheets (optional integration) | When a Pro/Enterprise test owner explicitly connects their Google account, completed submission data is exported row-by-row to a spreadsheet they control. Disabled by default; respondents are notified in the pre-test notice when active. | United States / EU | View |
| DeepSeek | Open-source-aligned LLM inference for selected features. | China (no personal data sent unless explicitly opted in) | View |
| ElevenLabs | Speech-to-text transcription for voice input. | United States / EU | View |
| ip-api.com | Approximate geolocation from IP for fraud/sanctions screening. | European Union | View |
| SMTP provider | Transactional email delivery (verification, password reset, billing). | United States / EU | View |
| Hosting provider | Server hosting and storage (Vercel / Railway / equivalent). | United States / EU | View |
Have a question about a specific sub-processor? Email [email protected].