Sub-processors and third parties

Learnable Education Pty Ltd uses a small number of external providers to run Learnable. This page lists every one of them that receives user information, exactly what each receives, why it is disclosed, the lawful basis for the disclosure, and the countries the information is processed or stored in. It is published so schools, teachers, parents and students can see the full picture without having to ask.

Last reviewed 2026-07-30 · Next review 2027-07-30 Questions: privacy@learnable.education

Sub-processors

Processes personal information on Learnable's instructions and only for the purpose shown.

Clerk Clerk, Inc.

Creates and authenticates every Learnable account. Handles sign-in, password reset, multi-factor authentication, the single sign-on handshake with a school's identity provider, and the session that keeps a user signed in.

Information disclosed
  • Name and email address personal information — given name, family name and primary email address
  • Sign-in credentials and authentication factors personal information
  • Session and device information personal information
Whose information
students, teachers, school staff
Lawful basis
Necessary to provide the service the school or user has signed up for (Australian Privacy Principle 6.1(a) — the primary purpose of collection).
Processed or stored in
United States
Clerk hosts on Google Cloud and Cloudflare infrastructure.
Their certifications
SOC 2 Type 2, ISO/IEC 27001
Contact
clerk.com
privacy@clerk.dev
660 King Street, Unit 345, San Francisco, CA 94107, United States
Privacy policyData processing agreementTheir sub-processors

OpenAI OpenAI, L.L.C.

Marks extended-response answers against the question's rubric and returns the marks and feedback a teacher then reviews. Also generates the search embeddings that power semantic search over lesson content, which Typesense requests on Learnable's behalf.

Information disclosed
  • Student answers and submitted work personal information — the answer text and its rubric only — the request carries no name, email or student identifier
  • Teaching content authored in Learnable — lesson and document text sent for embedding
Whose information
students
Lawful basis
Necessary to provide the marking and search features of the service (Australian Privacy Principle 6.1(a)). API content is not used to train OpenAI's models.
Processed or stored in
United States
Their certifications
SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701:2019, ISO/IEC 42001:2023
Contact
openai.com
privacy@openai.com
1455 3rd Street, San Francisco, CA 94158, United States
Privacy policyData processing agreementTheir sub-processorsSecurity and certificationsEnterprise privacy commitments

Stripe Stripe Payments Australia Pty Ltd / Stripe, Inc.

Processes subscription payments from teachers and schools who buy a licence directly. Card details are entered into a payment form served by Stripe and go straight to Stripe — they never reach Learnable's systems.

Information disclosed
  • Billing and payment details personal information
  • Name and email address personal information — billing contact name and email address
Whose information
teachers, school staff
Lawful basis
Necessary to perform the subscription contract, and to meet Learnable's record-keeping obligations under Australian tax and consumer law.
Processed or stored in
Australia, United States, Ireland
Their certifications
PCI DSS Level 1, SOC 2, ISO/IEC 27001
Contact
stripe.com
privacy@stripe.com
Privacy policyData processing agreementTheir sub-processorsSecurity and certifications

Intercom Intercom, Inc.

Runs the in-product support messenger. When a teacher or student starts a conversation, Intercom stores that conversation and the identity of the person who sent it so the support team can reply.

Information disclosed
  • Name and email address personal information — display name, email address, and a keyed hash of the email used to verify identity
  • Support conversation content personal information
Whose information
students, teachers, school staff
Lawful basis
Necessary to provide user support, a purpose disclosed in the Privacy Policy and directly related to the primary purpose of collection (Australian Privacy Principle 6).
Processed or stored in
United States
Learnable's workspace uses Intercom's default United States hosting. Intercom offers an Australian data-hosting region; moving to it is an open action.
Their certifications
SOC 2 Type 2, ISO/IEC 27001
Contact
www.intercom.com
privacy@intercom.io
55 2nd Street, 4th Floor, San Francisco, CA 94105, United States
Privacy policyData processing agreementTheir sub-processorsSecurity and certifications

Better Stack Better Stack, Inc.

Receives application error reports, performance traces and uptime checks so faults are detected and fixed. Session replay is enabled for sessions in which an error occurs.

Information disclosed
  • Error reports and product telemetry personal information — error messages, stack traces and performance traces; session replay is currently configured without text masking, so a replay can capture on-screen content including student work
  • Name and email address personal information — the signed-in user is attached to each error report
  • Session and device information personal information
Whose information
students, teachers, school staff
Lawful basis
Necessary to keep the service secure and operating correctly — a purpose within the reasonable expectations of users and disclosed in the Privacy Policy (Australian Privacy Principle 6.2(a)).
Processed or stored in
United States
Learnable's telemetry is ingested into Better Stack's us-east region. Better Stack's default for new accounts is the European Union.
Their certifications
SOC 2 Type 2, ISO/IEC 27001
Contact
betterstack.com
hello@betterstack.com
Privacy policyData processing agreementSecurity and certificationsTerms

Typesense Cloud Typesense, Inc.

Hosts the search index over Learnable's lessons, questions and documents and answers in-product search queries. For semantic search it calls OpenAI's embedding model on Learnable's behalf.

Information disclosed
  • Teaching content authored in Learnable — indexed lesson, question and document text, and the author's display name
  • Search terms
Whose information
teachers, school staff, Learnable authoring staff
Lawful basis
Necessary to provide the search feature of the service (Australian Privacy Principle 6.1(a)). The index holds teaching content, not student work.
Processed or stored in
Australia
Their certifications
SOC 2 Type II
Contact
typesense.org
contact@typesense.org
Privacy policyData processing agreementTheir sub-processorsSecurity and certifications

LaunchDarkly Catamorphic Co. (trading as LaunchDarkly)

Decides which product features each user sees, so changes can be released to a small group before everyone.

Information disclosed
  • Feature-flag evaluation context personal information — the user's email address is used as the evaluation key, together with their workspace identifier and whether they hold an internal role
  • Name and email address personal information
Whose information
students, teachers, school staff
Lawful basis
Necessary to operate and safely release the service (Australian Privacy Principle 6.2(a)).
Processed or stored in
United States
Their certifications
SOC 2 Type 2, ISO/IEC 27001
Contact
launchdarkly.com
privacy@launchdarkly.com
Privacy policyData processing agreementTheir sub-processorsSecurity and certifications

Twilio SendGrid Twilio Inc.

Delivers every transactional email Learnable sends — account invitations, email-change confirmations and password resets.

Information disclosed
  • Name and email address personal information — recipient email address and name, and the content of the message sent to them
Whose information
students, teachers, school staff
Lawful basis
Necessary to provide the service, including account administration (Australian Privacy Principle 6.1(a)).
Processed or stored in
United States
The code prefers a directly configured SMTP relay and falls back to SendGrid, but no deployed environment sets SMTP_HOST — so SendGrid is the route every production email actually takes.
Their certifications
ISO/IEC 27001, SOC 2 Type 2
Contact
sendgrid.com
privacy@twilio.com
101 Spear Street, Fifth Floor, San Francisco, CA 94105, United States
Privacy policyData processing agreementTheir sub-processorsSecurity and certifications

Infrastructure providers

Hosts or transports information as part of running the service.

Google Cloud Google LLC / Google Cloud Australia Pty Ltd

Stores the files users upload and serves them back, and holds database backups. Also hosts the legacy App Engine application the service is migrating off.

Information disclosed
  • Files uploaded by users personal information
  • Student answers and submitted work personal information
  • Name and email address personal information
  • Teaching content authored in Learnable
Whose information
students, teachers, school staff
Lawful basis
Necessary to provide the service (Australian Privacy Principle 6.1(a)). Google Cloud acts only on Learnable's instructions under its Cloud Data Processing Addendum.
Processed or stored in
Australia
Learnable's Google Cloud resources are in the australia-southeast1 (Sydney) region. The Cloud Storage bucket's configured location still needs to be confirmed against that.
Their certifications
ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 2, SOC 3, IRAP
Contact
cloud.google.com
https://support.google.com/policies/contact/general_privacy_form
Privacy policyData processing agreementTheir sub-processorsSecurity and certifications

Fly.io Fly.io, Inc.

Runs the Learnable application itself — the web and API services every request reaches, plus the push-notification and background-worker services behind them.

Information disclosed
  • Name and email address personal information
  • Session and device information personal information
  • Student answers and submitted work personal information
  • Teaching content authored in Learnable
  • Files uploaded by users personal information — uploads pass through on their way to Google Cloud Storage
Whose information
students, teachers, school staff
Lawful basis
Necessary to provide the service (Australian Privacy Principle 6.1(a)).
Processed or stored in
Australia
All three Fly.io applications are pinned to the syd (Sydney) region. Confirmed as the live origin behind app.learnable.education.
Their certifications
SOC 2 Type 2
Contact
fly.io
compliance@fly.io
Privacy policyData processing agreementTheir sub-processorsSecurity and certifications

Cloudflare Cloudflare, Inc.

Sits in front of the application as its content delivery network and web application firewall, presents the challenge that blocks automated sign-up attempts, and collects aggregate page-performance measurements.

Information disclosed
  • Session and device information personal information — IP address, browser details and request metadata for every request
Whose information
students, teachers, school staff, site visitors
Lawful basis
Necessary to keep the service available and to protect it from attack and abuse (Australian Privacy Principle 6.2(a)).
Processed or stored in
Australia, global edge network
Requests are served from the Cloudflare edge location nearest the user; for Australian schools that is normally an Australian city.
Their certifications
ISO/IEC 27001, ISO/IEC 27018, SOC 2 Type 2, PCI DSS
Contact
www.cloudflare.com
privacyquestions@cloudflare.com
101 Townsend St., San Francisco, CA 94107, United States
Privacy policyData processing agreementTheir sub-processorsSecurity and certifications

Embedded content

Contacted directly by the browser when a teacher embeds their content in a lesson.

YouTube Google LLC

Plays a YouTube video that an author or teacher has embedded in a lesson. The user's browser contacts YouTube directly, and only when such a lesson is opened.

Information disclosed
  • Session and device information personal information — IP address, device and browser details, and YouTube's own cookies
Whose information
students, teachers, school staff
Lawful basis
The embed is loaded at the direction of the teacher or author who placed it; Google acts as an independent controller of what it then collects.
Processed or stored in
United States, global
Their certifications
ISO/IEC 27001, SOC 2, SOC 3
Contact
www.youtube.com
https://support.google.com/policies/contact/general_privacy_form
Privacy policySecurity and certifications

Vimeo Vimeo.com, Inc.

Plays a Vimeo video that an author or teacher has embedded in a lesson. The user's browser contacts Vimeo directly, and only when such a lesson is opened.

Information disclosed
  • Session and device information personal information — IP address, device and browser details, and Vimeo's own cookies
Whose information
students, teachers, school staff
Lawful basis
The embed is loaded at the direction of the teacher or author who placed it; Vimeo acts as an independent controller of what it then collects.
Processed or stored in
United States, global
Their certifications
SOC 2 Type 2, TPN
Contact
vimeo.com
privacy@vimeo.com
330 West 34th Street, 5th Floor, New York, NY 10001, United States
Privacy policyData processing agreementSecurity and certifications

What the categories mean

Each provider above is described using these categories.

CategoryWhat it coversPersonal information
Name and email addressThe user's given and family name, display name and email address, and the school or workspace they belong to.Yes
Sign-in credentials and authentication factorsPassword (stored only as a hash), multi-factor authentication enrolment, and single sign-on identifiers returned by the school's identity provider.Yes
Session and device informationIP address, browser and device details, sign-in and sign-out events, and the cookies needed to keep a user signed in.Yes
Student answers and submitted workThe text a student writes in response to a question, together with the question and its marking rubric.Yes
Teaching content authored in LearnableQuestions, lessons, rubrics and supporting documents written by Learnable authors or by teachers, and the name of the author who wrote them.No
Search termsWords a user types into the in-product search box.No
Support conversation contentMessages a user sends to the support team through the in-product messenger, and the replies they receive.Yes
Billing and payment detailsBilling contact name and email, subscription and invoice records, and card details entered into the payment form.Yes
Files uploaded by usersImages, documents and other files attached to lessons or answers.Yes
Error reports and product telemetryTechnical error details, performance traces and — where session replay is enabled — a recording of what was on screen when an error occurred.Yes
Feature-flag evaluation contextThe identifier used to decide which product features a user sees, and the workspace that identifier belongs to.Yes

Changes to this list

This register is reviewed at least annually and whenever a provider is added, removed or moves the country it processes information in. Customers are notified before a change takes effect where the change affects where information is stored or who can access it. To ask a question about a provider on this list, or to request the agreements behind it, contact privacy@learnable.education.