Last updated: 1 September 2026
This register is kept current against our code. It lists the processors we use and is reviewed against the software itself rather than from memory, so it reflects what the product actually does. It is a disclosure, not a substitute for a signed data processing agreement. Schools and trusts can request the underlying agreements, our record of processing activities and our data protection impact assessment for a procurement file. Currently available in English only. Questions in the meantime: privacy@learn2learnai.com.
The third parties that process personal data on behalf of Learn2LearnAI, what they process, and where it is stored.
The full list, with detail on each below.
A subprocessor is a company we use to run the service that may process personal data on our behalf. We use a small number of them, and we keep the list short on purpose.
Every provider below operates under a data processing agreement. We do not sell personal data, and we do not allow any provider to use it to train their own models.
Our production database is hosted in the United States (AWS US East). We are telling you this plainly rather than leaving it to be discovered: a UK or EU school should know where its data sits before it signs anything.
The transfer is covered by the appropriate safeguards, and the provider is certified under the EU-US Data Privacy Framework. A migration to an EU region is planned but has not yet happened, so we do not claim UK or EU data residency today. If residency is a requirement for your school or trust, please contact us before purchasing so we can tell you honestly where that work stands.
Vercel hosts the application, stores generated lesson images, and routes our AI requests. It processes request logs and content in transit.
Our usage analytics through Vercel are cookieless, do not store IP addresses, and are switched off entirely on the pages children use.
Neon provides the Postgres database that stores accounts, learner profiles and lesson content.
Clerk provides authentication. Only adults have accounts: children join through a class code on a shared device and have no login, so no child data reaches Clerk by design.
Stripe processes subscription payments. Only paying adults' billing details reach Stripe. We do not store full card numbers.
Resend sends transactional email such as receipts and invitations. We do not collect email addresses for children, so only adults' addresses are involved.
AI model providers, accessed through Vercel's AI Gateway, generate lesson content and character replies. Prompts include the lesson material and an age range. They do not include a child's real name.
ElevenLabs provides text-to-speech for narration and songs. It receives text only. A child's microphone audio is never sent to it: speech-to-text runs on the child's own device, in their browser, so their voice never leaves the machine it was spoken into.
OpenAI's moderation service screens generated content for safety. It is used for moderation, not for generating anything a child sees.
Sentry collects error reports so we can find and fix faults. Error data is scrubbed before it is sent: we strip web address details, profile identifiers and fields that commonly carry personal information, and we do not record sessions or screen replays.
We review this register against the code rather than from memory, so it reflects what the software actually does rather than what we intended it to do.
If you are a school or trust and need the underlying data processing agreements, our record of processing activities, or our data protection impact assessment for a procurement file, contact us and we will provide them.