Introduction
This page lists every third party processor (a "subprocessor") that Backrow uses to deliver the service. It complements Section 3 of our Privacy Policy by providing the complete, dated list and the data each subprocessor receives, disclosure required under GDPR Article 28 and similar laws.
Each subprocessor is bound by its published data processing terms, which we accept as a condition of using it and which restrict its use of your data to the purposes described below. Those terms generally incorporate the European Commission's Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum. We rely on those published terms rather than negotiating bespoke agreements — see Section 7 of the Privacy Policy.
Subprocessors
OpenAI
AI generationUnited StatesProcesses prompts to generate text, study materials, and answers.
Data received: Prompts and source content you submit to AI tools
Privacy policy ↗Anthropic
AI generationUnited StatesProcesses prompts for select study tools and the AI tutor.
Data received: Prompts and source content you submit to AI tools
Privacy policy ↗Google (Gemini / Vertex AI / Veo)
AI generationUnited States, EUPowers Rowly, the AI tutor, learning paths, and the Video Overview cinematic tiers.
Data received: Prompts, source content, and storyboard descriptions
Privacy policy ↗Perplexity
AI researchUnited StatesPowers research queries that need citations and current information.
Data received: Your research query text
Privacy policy ↗StealthGPT
AI text rewritingUnited StatesRewrites text in a style closer to your own writing voice.
Data received: Text submitted to the writing voice humanizer and optional writing samples
Privacy policy ↗Helicone
AI infrastructureUnited StatesGateway that our OpenAI and Anthropic requests are routed through, for reliability monitoring and cost tracking.
Data received: The same prompts and source content sent to those AI providers, plus request metadata
Privacy policy ↗Adobe (PDF Services)
Document processingUnited StatesConverts and extracts text from PDFs that need server side processing.
Data received: PDF files you upload and the text extracted from them
Privacy policy ↗Microsoft
Optional connectorUnited States, EUPowers the Outlook, OneDrive, To Do, Teams, and calendar connectors when you link a Microsoft account.
Data received: Only the mail, files, tasks, and calendar entries the connector you enabled is scoped to read
Privacy policy ↗Dropbox
Optional connectorUnited StatesImports documents from your Dropbox when you link the account.
Data received: Files and file metadata you choose to import
Privacy policy ↗Notion
Optional connectorUnited StatesReads and writes Notion pages when you link the account.
Data received: Pages and page content in the workspaces you authorise
Privacy policy ↗Readwise
Optional connectorUnited StatesImports your saved highlights when you link the account.
Data received: Highlights and reading metadata in your Readwise library
Privacy policy ↗AssemblyAI
Audio transcriptionUnited StatesConverts your audio recordings into searchable text.
Data received: Raw audio, plus optional speaker labels and custom vocabulary
Privacy policy ↗ElevenLabs
Audio transcription + TTSUnited StatesPremium audio transcription (Scribe) and text to speech for Audio Overview.
Data received: Raw audio and TTS source text
Privacy policy ↗Supabase
Database, auth, storageUnited StatesPrimary backend covering account data, recordings, notes, uploaded materials, and row level security.
Data received: All account, content, and authentication data
Privacy policy ↗Cloudflare
Hosting, CDN, edge routingGlobal edge network (United States, EU, and other regions)Serves the Backrow web application, routes API traffic across its network, and applies bot and abuse protection. Also provides the R2 object storage used for large media files.
Data received: IP address, approximate country, and request metadata on every request; file blobs stored in R2
Privacy policy ↗Vercel
Standby hostingUnited StatesStandby host for the web application and failover path for AI requests when the primary backend is unavailable.
Data received: When active: IP address and request metadata
Privacy policy ↗Upstash
Rate limitingUnited States, EUHosted Redis holding short lived request counters so no single account or IP address can overload the platform.
Data received: Your user id or IP address and a request count. No content.
Privacy policy ↗Google Cloud Run
Video renderingUnited StatesRuns the video rendering worker behind Learning Shorts and Video Overview, then returns the finished file.
Data received: The images, audio, and captions for the video being rendered
Privacy policy ↗Stripe
PaymentsUnited StatesProcesses subscriptions and one off purchases.
Data received: Card details (held directly by Stripe, so Backrow never sees the full number), name, billing address, email
Privacy policy ↗Brevo
Transactional + marketing emailEuropean UnionSends account verification, password resets, receipts, and optional marketing email.
Data received: Email address, name, message content
Privacy policy ↗Composio
Social media broker (admin only)United StatesBrokers connections to social media accounts authorised by Backrow admins for marketing. Does not process individual student data.
Data received: Admin authorised social account credentials
Privacy policy ↗Sentry
Error monitoringEuropean Union (Frankfurt)Collects error reports and crash diagnostics so we can fix bugs.
Data received: URL, browser metadata, partial stack traces (PII redaction configured)
Privacy policy ↗PostHog
Product analyticsEuropean UnionAggregated usage analytics. Opt out available via cookie preferences or Global Privacy Control.
Data received: Page views, feature usage, anonymised user identifier
Privacy policy ↗Judge0
Code executionEuropean UnionExecutes code you submit to the Code Debugger tool.
Data received: Source code submitted to the Code Debugger
Privacy policy ↗Wolfram Alpha
Symbolic mathUnited StatesSolves math expressions submitted to advanced math tools.
Data received: Math expressions submitted to those tools
Privacy policy ↗FingerprintJS
Fraud preventionRuns in your browser; identifier stored with your accountComputes a device identifier used to detect duplicate accounts created to farm free credits. Never used for advertising.
Data received: Browser characteristics (screen, timezone, fonts, rendering behaviour)
Privacy policy ↗Meta Platforms (Meta Pixel)
AdvertisingUnited StatesBuilds a remarketing audience and measures ad performance. Loads ONLY if you accept the advertising cookie category; blocked by a GPC/DNT signal and for users under the age of majority.
Data received: That you visited Backrow, which key actions you took, IP address, and the _fbp / _fbc identifiers
Privacy policy ↗TikTok (TikTok Pixel)
AdvertisingUnited States, Singapore, IrelandSame function as the Meta Pixel for TikTok ads. Currently DORMANT — activates only once a Backrow TikTok ad account exists and you have accepted the advertising category.
Data received: That you visited Backrow, which key actions you took, IP address, and the _ttp identifier
Privacy policy ↗Changes to this list
We update this list when we add, remove, or change subprocessors. Material additions will be announced in the in app changelog and via email at least 14 days before they take effect. If you object to a new subprocessor, you may delete your account before the change takes effect.
Contact
Questions about a specific subprocessor or our data processing agreements? Email privacy@backrow.ai.