Our sub-processors.
1. What a sub-processor is
Obiter is the controller of your personal data: we decide what is collected and why. To run the service we use other companies that process some of that data on our instructions — hosting it, sending your email, taking your payment. Those are our processors, and under Article 28 of the UK GDPR each of them is bound by a written contract that limits what they may do with your data.
This page lists all of them. It is the same list as our internal register; there is no longer version kept back.
2. Used for every account
| Sub-processor | What it does | What it sees | Where | Transfer basis |
|---|---|---|---|---|
| Vercel Inc. | Application hosting and delivery | IP address and request metadata, in transit | USA (functions pinned to London, lhr1) | UK IDTA / SCCs |
| Supabase Inc. | Database, authentication and file storage | Everything you store in Obiter | UK (London, AWS eu-west-2) | None — your data does not leave the UK |
| Resend Inc. | Transactional email (sign-in, receipts, alerts) | Email address, name, message content | USA | UK IDTA / SCCs |
| Functional Software, Inc. (Sentry) | Application error monitoring | Error details, page, account identifier | USA | UK IDTA / SCCs |
3. Used only if you use the feature
None of these are engaged unless you do the thing described. A student who never pays, never connects a calendar, never uploads a file and declines analytics is not touched by any row in this table.
| Sub-processor | What it does | What it sees | Where | Transfer basis |
|---|---|---|---|---|
| Anthropic, PBC | Powers Obiter AI, essay feedback, flashcard generation and transcript reading | The message, essay, document text or transcript you submit | USA | UK IDTA / SCCs. Not used to train models. |
| Stripe, Inc. | Payments and subscription management | Card details (direct to Stripe — we never see them), billing address, email | USA | UK IDTA / SCCs |
| PostHog, Inc. | Product analytics — only if you choose “Accept all” on the cookie banner | Which pages and features you use, and when. Never the content of your work. | EU | Adequacy — no transfer outside the EEA. IP address discarded. |
| Google LLC | Sign in with Google; Google Calendar; Google Drive import | Account identifier; calendar events; files you choose to import | USA | UK IDTA / SCCs |
| Microsoft Corporation | Outlook Calendar; OneDrive import | Calendar events; files you choose to import | USA | UK IDTA / SCCs |
| Dropbox, Inc. | Dropbox file import | Files you choose to import | USA | UK IDTA / SCCs |
| Apple Inc. | Sign in with Apple | An opaque user identifier, and your email unless you hide it | USA | UK IDTA / SCCs |
4. What none of them may do
- None of them may use your data for their own purposes.
- None of them may sell it, and we do not sell it either.
- Your notes, essays, messages and documents are never used to train AI models — not by us and not by Anthropic, whose commercial API terms prohibit it.
- None of them receives advertising data from us, because we do not do advertising.
5. Transfers outside the UK
Where a processor is in the United States, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and we have carried out the risk assessment that goes with it. Where a processor is in the EU, no additional safeguard is needed: the EU benefits from a UK adequacy decision.
Our two largest stores of your actual work — the database and your uploaded files — are both in London, and never leave the UK. The database region was verified on 2 August 2026 as AWS eu-west-2.
6. Changes
We will update this page before a new sub-processor starts processing your data, not after. If you want to be told when it changes, email privacy@obiter.site and we will add you to the notification list.