{
  "title": "Sub-processor and third-party disclosure register",
  "published_at": "https://subprocessors.learnable.education/",
  "last_updated": "2026-07-30",
  "contact": "privacy@learnable.education",
  "data_types": [
    {
      "id": "identity",
      "label": "Name and email address",
      "description": "The user's given and family name, display name and email address, and the school or workspace they belong to.",
      "personal_information": true
    },
    {
      "id": "credentials",
      "label": "Sign-in credentials and authentication factors",
      "description": "Password (stored only as a hash), multi-factor authentication enrolment, and single sign-on identifiers returned by the school's identity provider.",
      "personal_information": true
    },
    {
      "id": "session",
      "label": "Session and device information",
      "description": "IP address, browser and device details, sign-in and sign-out events, and the cookies needed to keep a user signed in.",
      "personal_information": true
    },
    {
      "id": "student-work",
      "label": "Student answers and submitted work",
      "description": "The text a student writes in response to a question, together with the question and its marking rubric.",
      "personal_information": true
    },
    {
      "id": "curriculum",
      "label": "Teaching content authored in Learnable",
      "description": "Questions, lessons, rubrics and supporting documents written by Learnable authors or by teachers, and the name of the author who wrote them.",
      "personal_information": false
    },
    {
      "id": "search-queries",
      "label": "Search terms",
      "description": "Words a user types into the in-product search box.",
      "personal_information": false
    },
    {
      "id": "support-content",
      "label": "Support conversation content",
      "description": "Messages a user sends to the support team through the in-product messenger, and the replies they receive.",
      "personal_information": true
    },
    {
      "id": "billing",
      "label": "Billing and payment details",
      "description": "Billing contact name and email, subscription and invoice records, and card details entered into the payment form.",
      "personal_information": true
    },
    {
      "id": "uploads",
      "label": "Files uploaded by users",
      "description": "Images, documents and other files attached to lessons or answers.",
      "personal_information": true
    },
    {
      "id": "diagnostics",
      "label": "Error reports and product telemetry",
      "description": "Technical error details, performance traces and \u2014 where session replay is enabled \u2014 a recording of what was on screen when an error occurred.",
      "personal_information": true
    },
    {
      "id": "usage-flags",
      "label": "Feature-flag evaluation context",
      "description": "The identifier used to decide which product features a user sees, and the workspace that identifier belongs to.",
      "personal_information": true
    }
  ],
  "vendors": [
    {
      "id": "clerk",
      "name": "Clerk",
      "legal_entity": "Clerk, Inc.",
      "role": "sub-processor",
      "category": "Authentication and identity",
      "website": "https://clerk.com",
      "contact": "privacy@clerk.dev",
      "address": "660 King Street, Unit 345, San Francisco, CA 94107, United States",
      "purpose": "Creates and authenticates every Learnable account. Handles sign-in, password reset, multi-factor authentication, the single sign-on handshake with a school's identity provider, and the session that keeps a user signed in.",
      "data": [
        {
          "type": "identity",
          "label": "Name and email address",
          "personal_information": true,
          "note": "given name, family name and primary email address"
        },
        {
          "type": "credentials",
          "label": "Sign-in credentials and authentication factors",
          "personal_information": true,
          "note": null
        },
        {
          "type": "session",
          "label": "Session and device information",
          "personal_information": true,
          "note": null
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "Necessary to provide the service the school or user has signed up for (Australian Privacy Principle 6.1(a) \u2014 the primary purpose of collection).",
      "countries": [
        "United States"
      ],
      "hosting_note": "Clerk hosts on Google Cloud and Cloudflare infrastructure.",
      "certifications": [
        "SOC 2 Type 2",
        "ISO/IEC 27001"
      ],
      "policies": {
        "privacy": "https://clerk.com/legal/privacy",
        "dpa": "https://clerk.com/legal/dpa",
        "subprocessors": "https://clerk.com/legal/subprocessors"
      }
    },
    {
      "id": "openai",
      "name": "OpenAI",
      "legal_entity": "OpenAI, L.L.C.",
      "role": "sub-processor",
      "category": "AI inference",
      "website": "https://openai.com",
      "contact": "privacy@openai.com",
      "address": "1455 3rd Street, San Francisco, CA 94158, United States",
      "purpose": "Marks extended-response answers against the question's rubric and returns the marks and feedback a teacher then reviews. Also generates the search embeddings that power semantic search over lesson content, which Typesense requests on Learnable's behalf.",
      "data": [
        {
          "type": "student-work",
          "label": "Student answers and submitted work",
          "personal_information": true,
          "note": "the answer text and its rubric only \u2014 the request carries no name, email or student identifier"
        },
        {
          "type": "curriculum",
          "label": "Teaching content authored in Learnable",
          "personal_information": false,
          "note": "lesson and document text sent for embedding"
        }
      ],
      "subjects": [
        "students"
      ],
      "lawful_basis": "Necessary to provide the marking and search features of the service (Australian Privacy Principle 6.1(a)). API content is not used to train OpenAI's models.",
      "countries": [
        "United States"
      ],
      "hosting_note": null,
      "certifications": [
        "SOC 2 Type 2",
        "ISO/IEC 27001:2022",
        "ISO/IEC 27017:2015",
        "ISO/IEC 27018:2019",
        "ISO/IEC 27701:2019",
        "ISO/IEC 42001:2023"
      ],
      "policies": {
        "privacy": "https://openai.com/policies/privacy-policy/",
        "dpa": "https://openai.com/policies/data-processing-addendum/",
        "subprocessors": "https://openai.com/policies/sub-processor-list/",
        "security": "https://trust.openai.com/",
        "enterprise_privacy": "https://openai.com/enterprise-privacy/"
      }
    },
    {
      "id": "stripe",
      "name": "Stripe",
      "legal_entity": "Stripe Payments Australia Pty Ltd / Stripe, Inc.",
      "role": "sub-processor",
      "category": "Payments",
      "website": "https://stripe.com/au",
      "contact": "privacy@stripe.com",
      "address": null,
      "purpose": "Processes subscription payments from teachers and schools who buy a licence directly. Card details are entered into a payment form served by Stripe and go straight to Stripe \u2014 they never reach Learnable's systems.",
      "data": [
        {
          "type": "billing",
          "label": "Billing and payment details",
          "personal_information": true,
          "note": null
        },
        {
          "type": "identity",
          "label": "Name and email address",
          "personal_information": true,
          "note": "billing contact name and email address"
        }
      ],
      "subjects": [
        "teachers",
        "school staff"
      ],
      "lawful_basis": "Necessary to perform the subscription contract, and to meet Learnable's record-keeping obligations under Australian tax and consumer law.",
      "countries": [
        "Australia",
        "United States",
        "Ireland"
      ],
      "hosting_note": null,
      "certifications": [
        "PCI DSS Level 1",
        "SOC 2",
        "ISO/IEC 27001"
      ],
      "policies": {
        "privacy": "https://stripe.com/au/privacy",
        "dpa": "https://stripe.com/au/legal/dpa",
        "subprocessors": "https://stripe.com/au/service-providers/legal",
        "security": "https://trust.stripe.com/"
      }
    },
    {
      "id": "intercom",
      "name": "Intercom",
      "legal_entity": "Intercom, Inc.",
      "role": "sub-processor",
      "category": "Customer support",
      "website": "https://www.intercom.com",
      "contact": "privacy@intercom.io",
      "address": "55 2nd Street, 4th Floor, San Francisco, CA 94105, United States",
      "purpose": "Runs the in-product support messenger. When a teacher or student starts a conversation, Intercom stores that conversation and the identity of the person who sent it so the support team can reply.",
      "data": [
        {
          "type": "identity",
          "label": "Name and email address",
          "personal_information": true,
          "note": "display name, email address, and a keyed hash of the email used to verify identity"
        },
        {
          "type": "support-content",
          "label": "Support conversation content",
          "personal_information": true,
          "note": null
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "Necessary to provide user support, a purpose disclosed in the Privacy Policy and directly related to the primary purpose of collection (Australian Privacy Principle 6).",
      "countries": [
        "United States"
      ],
      "hosting_note": "Learnable's workspace uses Intercom's default United States hosting. Intercom offers an Australian data-hosting region; moving to it is an open action.",
      "certifications": [
        "SOC 2 Type 2",
        "ISO/IEC 27001"
      ],
      "policies": {
        "privacy": "https://www.intercom.com/legal/privacy",
        "dpa": "https://www.intercom.com/legal/data-processing-agreement",
        "subprocessors": "https://www.intercom.com/legal/subprocessors-list",
        "security": "https://www.intercom.com/security"
      }
    },
    {
      "id": "better-stack",
      "name": "Better Stack",
      "legal_entity": "Better Stack, Inc.",
      "role": "sub-processor",
      "category": "Error monitoring and observability",
      "website": "https://betterstack.com",
      "contact": "hello@betterstack.com",
      "address": null,
      "purpose": "Receives application error reports, performance traces and uptime checks so faults are detected and fixed. Session replay is enabled for sessions in which an error occurs.",
      "data": [
        {
          "type": "diagnostics",
          "label": "Error reports and product telemetry",
          "personal_information": true,
          "note": "error messages, stack traces and performance traces; session replay is currently configured without text masking, so a replay can capture on-screen content including student work"
        },
        {
          "type": "identity",
          "label": "Name and email address",
          "personal_information": true,
          "note": "the signed-in user is attached to each error report"
        },
        {
          "type": "session",
          "label": "Session and device information",
          "personal_information": true,
          "note": null
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "Necessary to keep the service secure and operating correctly \u2014 a purpose within the reasonable expectations of users and disclosed in the Privacy Policy (Australian Privacy Principle 6.2(a)).",
      "countries": [
        "United States"
      ],
      "hosting_note": "Learnable's telemetry is ingested into Better Stack's us-east region. Better Stack's default for new accounts is the European Union.",
      "certifications": [
        "SOC 2 Type 2",
        "ISO/IEC 27001"
      ],
      "policies": {
        "privacy": "https://betterstack.com/privacy",
        "dpa": "https://betterstack.com/dpa",
        "security": "https://betterstack.com/security",
        "terms": "https://betterstack.com/terms"
      }
    },
    {
      "id": "typesense",
      "name": "Typesense Cloud",
      "legal_entity": "Typesense, Inc.",
      "role": "sub-processor",
      "category": "Search",
      "website": "https://typesense.org",
      "contact": "contact@typesense.org",
      "address": null,
      "purpose": "Hosts the search index over Learnable's lessons, questions and documents and answers in-product search queries. For semantic search it calls OpenAI's embedding model on Learnable's behalf.",
      "data": [
        {
          "type": "curriculum",
          "label": "Teaching content authored in Learnable",
          "personal_information": false,
          "note": "indexed lesson, question and document text, and the author's display name"
        },
        {
          "type": "search-queries",
          "label": "Search terms",
          "personal_information": false,
          "note": null
        }
      ],
      "subjects": [
        "teachers",
        "school staff",
        "Learnable authoring staff"
      ],
      "lawful_basis": "Necessary to provide the search feature of the service (Australian Privacy Principle 6.1(a)). The index holds teaching content, not student work.",
      "countries": [
        "Australia"
      ],
      "hosting_note": null,
      "certifications": [
        "SOC 2 Type II"
      ],
      "policies": {
        "privacy": "https://cloud.typesense.org/legal/privacy",
        "dpa": "https://cloud.typesense.org/legal/dpa",
        "subprocessors": "https://cloud.typesense.org/legal/sub_processors",
        "security": "https://cloud.typesense.org/security"
      }
    },
    {
      "id": "launchdarkly",
      "name": "LaunchDarkly",
      "legal_entity": "Catamorphic Co. (trading as LaunchDarkly)",
      "role": "sub-processor",
      "category": "Feature management",
      "website": "https://launchdarkly.com",
      "contact": "privacy@launchdarkly.com",
      "address": null,
      "purpose": "Decides which product features each user sees, so changes can be released to a small group before everyone.",
      "data": [
        {
          "type": "usage-flags",
          "label": "Feature-flag evaluation context",
          "personal_information": true,
          "note": "the user's email address is used as the evaluation key, together with their workspace identifier and whether they hold an internal role"
        },
        {
          "type": "identity",
          "label": "Name and email address",
          "personal_information": true,
          "note": null
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "Necessary to operate and safely release the service (Australian Privacy Principle 6.2(a)).",
      "countries": [
        "United States"
      ],
      "hosting_note": null,
      "certifications": [
        "SOC 2 Type 2",
        "ISO/IEC 27001"
      ],
      "policies": {
        "privacy": "https://launchdarkly.com/policies/privacy/",
        "dpa": "https://launchdarkly.com/policies/dpa/",
        "subprocessors": "https://launchdarkly.com/policies/sub-processors/",
        "security": "https://launchdarkly.com/security/"
      }
    },
    {
      "id": "google-cloud",
      "name": "Google Cloud",
      "legal_entity": "Google LLC / Google Cloud Australia Pty Ltd",
      "role": "infrastructure",
      "category": "Hosting and storage",
      "website": "https://cloud.google.com",
      "contact": "https://support.google.com/policies/contact/general_privacy_form",
      "address": null,
      "purpose": "Stores the files users upload and serves them back, and holds database backups. Also hosts the legacy App Engine application the service is migrating off.",
      "data": [
        {
          "type": "uploads",
          "label": "Files uploaded by users",
          "personal_information": true,
          "note": null
        },
        {
          "type": "student-work",
          "label": "Student answers and submitted work",
          "personal_information": true,
          "note": null
        },
        {
          "type": "identity",
          "label": "Name and email address",
          "personal_information": true,
          "note": null
        },
        {
          "type": "curriculum",
          "label": "Teaching content authored in Learnable",
          "personal_information": false,
          "note": null
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "Necessary to provide the service (Australian Privacy Principle 6.1(a)). Google Cloud acts only on Learnable's instructions under its Cloud Data Processing Addendum.",
      "countries": [
        "Australia"
      ],
      "hosting_note": "Learnable's Google Cloud resources are in the australia-southeast1 (Sydney) region. The Cloud Storage bucket's configured location still needs to be confirmed against that.",
      "certifications": [
        "ISO/IEC 27001",
        "ISO/IEC 27017",
        "ISO/IEC 27018",
        "SOC 2",
        "SOC 3",
        "IRAP"
      ],
      "policies": {
        "privacy": "https://cloud.google.com/terms/cloud-privacy-notice",
        "dpa": "https://cloud.google.com/terms/data-processing-addendum",
        "subprocessors": "https://cloud.google.com/terms/subprocessors",
        "security": "https://cloud.google.com/security/compliance/offerings"
      }
    },
    {
      "id": "fly-io",
      "name": "Fly.io",
      "legal_entity": "Fly.io, Inc.",
      "role": "infrastructure",
      "category": "Hosting and storage",
      "website": "https://fly.io",
      "contact": "compliance@fly.io",
      "address": null,
      "purpose": "Runs the Learnable application itself \u2014 the web and API services every request reaches, plus the push-notification and background-worker services behind them.",
      "data": [
        {
          "type": "identity",
          "label": "Name and email address",
          "personal_information": true,
          "note": null
        },
        {
          "type": "session",
          "label": "Session and device information",
          "personal_information": true,
          "note": null
        },
        {
          "type": "student-work",
          "label": "Student answers and submitted work",
          "personal_information": true,
          "note": null
        },
        {
          "type": "curriculum",
          "label": "Teaching content authored in Learnable",
          "personal_information": false,
          "note": null
        },
        {
          "type": "uploads",
          "label": "Files uploaded by users",
          "personal_information": true,
          "note": "uploads pass through on their way to Google Cloud Storage"
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "Necessary to provide the service (Australian Privacy Principle 6.1(a)).",
      "countries": [
        "Australia"
      ],
      "hosting_note": "All three Fly.io applications are pinned to the syd (Sydney) region. Confirmed as the live origin behind app.learnable.education.",
      "certifications": [
        "SOC 2 Type 2"
      ],
      "policies": {
        "privacy": "https://fly.io/legal/privacy-policy/",
        "dpa": "https://fly.io/documents/",
        "subprocessors": "https://fly.io/legal/sub-processors/",
        "security": "https://fly.io/docs/security/"
      }
    },
    {
      "id": "cloudflare",
      "name": "Cloudflare",
      "legal_entity": "Cloudflare, Inc.",
      "role": "infrastructure",
      "category": "Content delivery and bot protection",
      "website": "https://www.cloudflare.com",
      "contact": "privacyquestions@cloudflare.com",
      "address": "101 Townsend St., San Francisco, CA 94107, United States",
      "purpose": "Sits in front of the application as its content delivery network and web application firewall, presents the challenge that blocks automated sign-up attempts, and collects aggregate page-performance measurements.",
      "data": [
        {
          "type": "session",
          "label": "Session and device information",
          "personal_information": true,
          "note": "IP address, browser details and request metadata for every request"
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff",
        "site visitors"
      ],
      "lawful_basis": "Necessary to keep the service available and to protect it from attack and abuse (Australian Privacy Principle 6.2(a)).",
      "countries": [
        "Australia",
        "global edge network"
      ],
      "hosting_note": "Requests are served from the Cloudflare edge location nearest the user; for Australian schools that is normally an Australian city.",
      "certifications": [
        "ISO/IEC 27001",
        "ISO/IEC 27018",
        "SOC 2 Type 2",
        "PCI DSS"
      ],
      "policies": {
        "privacy": "https://www.cloudflare.com/privacypolicy/",
        "dpa": "https://www.cloudflare.com/cloudflare-customer-dpa/",
        "subprocessors": "https://www.cloudflare.com/gdpr/subprocessors/",
        "security": "https://www.cloudflare.com/trust-hub/compliance-resources/"
      }
    },
    {
      "id": "twilio-sendgrid",
      "name": "Twilio SendGrid",
      "legal_entity": "Twilio Inc.",
      "role": "sub-processor",
      "category": "Email delivery",
      "website": "https://sendgrid.com",
      "contact": "privacy@twilio.com",
      "address": "101 Spear Street, Fifth Floor, San Francisco, CA 94105, United States",
      "purpose": "Delivers every transactional email Learnable sends \u2014 account invitations, email-change confirmations and password resets.",
      "data": [
        {
          "type": "identity",
          "label": "Name and email address",
          "personal_information": true,
          "note": "recipient email address and name, and the content of the message sent to them"
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "Necessary to provide the service, including account administration (Australian Privacy Principle 6.1(a)).",
      "countries": [
        "United States"
      ],
      "hosting_note": "The code prefers a directly configured SMTP relay and falls back to SendGrid, but no deployed environment sets SMTP_HOST \u2014 so SendGrid is the route every production email actually takes.",
      "certifications": [
        "ISO/IEC 27001",
        "SOC 2 Type 2"
      ],
      "policies": {
        "privacy": "https://www.twilio.com/en-us/legal/privacy",
        "dpa": "https://www.twilio.com/en-us/legal/data-protection-addendum",
        "subprocessors": "https://www.twilio.com/en-us/legal/sub-processors",
        "security": "https://www.twilio.com/en-us/legal/security-overview"
      }
    },
    {
      "id": "youtube",
      "name": "YouTube",
      "legal_entity": "Google LLC",
      "role": "embedded-content",
      "category": "Embedded media",
      "website": "https://www.youtube.com",
      "contact": "https://support.google.com/policies/contact/general_privacy_form",
      "address": null,
      "purpose": "Plays a YouTube video that an author or teacher has embedded in a lesson. The user's browser contacts YouTube directly, and only when such a lesson is opened.",
      "data": [
        {
          "type": "session",
          "label": "Session and device information",
          "personal_information": true,
          "note": "IP address, device and browser details, and YouTube's own cookies"
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "The embed is loaded at the direction of the teacher or author who placed it; Google acts as an independent controller of what it then collects.",
      "countries": [
        "United States",
        "global"
      ],
      "hosting_note": null,
      "certifications": [
        "ISO/IEC 27001",
        "SOC 2",
        "SOC 3"
      ],
      "policies": {
        "privacy": "https://policies.google.com/privacy",
        "security": "https://policies.google.com/technologies/partner-sites"
      }
    },
    {
      "id": "vimeo",
      "name": "Vimeo",
      "legal_entity": "Vimeo.com, Inc.",
      "role": "embedded-content",
      "category": "Embedded media",
      "website": "https://vimeo.com",
      "contact": "privacy@vimeo.com",
      "address": "330 West 34th Street, 5th Floor, New York, NY 10001, United States",
      "purpose": "Plays a Vimeo video that an author or teacher has embedded in a lesson. The user's browser contacts Vimeo directly, and only when such a lesson is opened.",
      "data": [
        {
          "type": "session",
          "label": "Session and device information",
          "personal_information": true,
          "note": "IP address, device and browser details, and Vimeo's own cookies"
        }
      ],
      "subjects": [
        "students",
        "teachers",
        "school staff"
      ],
      "lawful_basis": "The embed is loaded at the direction of the teacher or author who placed it; Vimeo acts as an independent controller of what it then collects.",
      "countries": [
        "United States",
        "global"
      ],
      "hosting_note": null,
      "certifications": [
        "SOC 2 Type 2",
        "TPN"
      ],
      "policies": {
        "privacy": "https://vimeo.com/legal/privacy/policy",
        "dpa": "https://vimeo.com/legal/enterprise-terms/dpa",
        "security": "https://vimeo.com/features/security"
      }
    }
  ],
  "generated": "2026-07-30"
}