Last updated: October 4, 2026
Lecture Hat, Inc. ("Lecture Hat," "we," "us," or "our") uses the providers below for our website, iOS application, desktop application, browser extensions, and related Services. This inventory supplies the provider, purpose, data categories, and location information for the subprocessor schedule in our Data Processing Addendum. Some vendors also act independently for their own functions, as noted below. Listing a provider is not blanket authorization to process an institution's data.
Roles depend on each processing activity. Lecture Hat is a controller for account administration and other purposes it determines. When processing covered institutional data on an institution's documented instructions, Lecture Hat acts on its behalf under the executed DPA. That does not make every account, billing, or security operation institutional processor activity.
We update this inventory as providers and their roles change. To request email updates, write to [email protected]. Posting here does not replace notice required by an executed DPA. Read the inventory with our AI Use Disclosure and Privacy Policy; contractual authorization and restrictions come from the applicable executed agreement.
| Subprocessor | Service | Categories of data | Processing location | Added | Privacy |
|---|---|---|---|---|---|
| Cloudflare, Inc. | DNS, content delivery, Cloudflare Tunnel to the Lecture Hat origin, anti-bot challenge (Turnstile), DDoS protection, web application firewall, and a Worker with Workers KV that displays a maintenance or outage banner. | IP address, request metadata, bot-detection signals, and request and response payloads transiting Cloudflare. Cloudflare terminates client TLS at its edge, so it can access payload contents. The local hop from cloudflared to the Lecture Hat reverse proxy uses plaintext HTTP. The Worker and its KV store hold only a maintenance flag and banner text. | United States; global edge network | Initial list | Policy |
| Clerk, Inc. | Authentication and identity: account creation, sign-in by email one-time code or Google, session token issuance and verification, and sign-in and email-verification messages. | Email address, name, date of birth, user preferences, Clerk-issued user id, session metadata (IP address, user agent, sign-in timestamps), Google profile fields returned for authentication, and account metadata: plan and entitlement labels, education-trial, referral and team grants, recording-consent records, account-deletion state, and a Stripe customer identifier. | United States | Initial list | Policy |
| Stripe, Inc. | Subscription billing, payment processing, and fraud prevention. | Email address, name, payment-instrument details collected directly by Stripe, billing country, and subscription metadata. Stripe acts as a processor when processing on our instructions and as a controller for its own purposes, including fraud prevention, compliance, internal billing, and service improvement, as described in its Data Processing Agreement. Its role depends on the processing purpose, not simply the product name. We do not receive or store full payment-card numbers. | United States | Initial list | Policy |
| Amazon Web Services, Inc. (AWS Bedrock) | Artificial-intelligence inference using Anthropic Claude Opus 5.5, Anthropic Claude Sonnet 5.5, Anthropic Claude Haiku 4.5 (older app versions only), and Google Gemma 4 31B through AWS Bedrock: chat, document indexing and entity extraction, image and handwriting understanding, writing assistance, assessment generation and review, and summaries and titles. Cactus Micro is Google Gemma 4 31B on AWS Bedrock. | Prompts, extracted document text, rendered page images, handwritten page images, attached chat images, and the content snippets the selected feature requires. Indexing starts automatically on upload, so this processing can occur before any chat request. AWS states that Bedrock inputs and outputs are not used to train the underlying models, and that retention and AWS human review depend on the model and effective account or project data-retention mode. AWS currently documents that content sharing with model providers is not supported. We have not independently verified the effective mode for every production Bedrock Runtime and Bedrock Mantle request, and do not promise zero retention. | Source endpoint in US East (N. Virginia). Claude Opus, Claude Sonnet, and Claude Haiku use AWS global cross-Region inference and may be processed in supported commercial AWS Regions worldwide; Gemma uses the Bedrock Mantle us-east-1 endpoint. | Initial list | Policy |
| Amazon Web Services, Inc. (Amazon EC2 and EBS) | Hosting of the production application, databases, object storage, and cache on Lecture Hat-administered Amazon EC2 servers, with encrypted Amazon EBS volumes and volume snapshots. | All Account Content and account records the Services store: notebooks, files, transcripts, chats, knowledge graphs, class and assignment records, usage and billing metadata, and support requests. Volumes and snapshots use Amazon EBS encryption. Snapshot retention targets are hourly for 48 hours and daily for 14 days, subject to successful cleanup. | United States (US East, N. Virginia) | September 28, 2026 | Policy |
| Amazon Web Services, Inc. (Amazon Textract) | Cloud fallback for image and document OCR, including the text coordinates used to locate content on a page, when Lecture Hat-operated OCR is unavailable. | Uploaded images and rendered document page images. AWS service terms permit storage and use of Textract content for service improvement unless an effective AI services opt-out applies. We have not verified an effective account-level opt-out or a categorical zero-retention setting for this service. | Requests use US East (N. Virginia). AWS service-improvement processing may occur in another AWS Region under its service terms. | October 4, 2026 | Policy |
| Eleven Labs Inc. | Real-time speech-to-text for Live Subtitles (Scribe v2 Realtime), cloud fallback transcription of uploaded audio and video (Scribe v2), and text-to-speech for Read Aloud and narrated lessons (Flash v2.5) on web and iOS. The Lecture Hat Browser Extension uses browser speech and sends no Read Aloud text to ElevenLabs. | For live captions, an encrypted live audio stream for the duration of the session. For fallback transcription, audio from the uploaded file. For Read Aloud and narrated lessons, the response text or lesson script requested for playback or export. Uploaded-media fallback uses standard processing with provider logging and retention enabled; we have not verified a fixed provider retention period. Live-caption and speech-output requests ask the provider to disable logging. We have not verified our account's Zero Retention Mode, model-improvement opt-out, or applicable data-processing agreement. Provider retention and use depend on the applicable contract and account settings; we do not promise zero retention or no provider model-improvement use. | United States, the Netherlands, and Singapore; personal data is transferred to the United States for storage | Initial list | Policy |
| Amazon Web Services, Inc. (Amazon SES) | Transactional and opted-in marketing email delivery. | Email address, name, message content, and delivery metadata. | United States | Initial list | Policy |
| Amazon Web Services, Inc. (Amazon S3) | Direct encrypted disaster-recovery backups from Amazon EC2, including PostgreSQL databases, Redis data, and uploaded files; storage of verified historical backup archives migrated from Backblaze B2. | Encrypted copies of stored account records and Account Content, including uploaded files. Database and Redis backups target deletion after about 35 days; replaced or deleted uploaded files target about 14 days in backup history. Historical archives migrated from B2 have a separate expiration target of no more than 35 days after migration, outside the routine pruning jobs. All periods depend on successful backup and cleanup jobs. | United States (US East, N. Virginia, us-east-1) | October 4, 2026 | Policy |
| Backblaze, Inc. (legacy B2 backup storage) | Legacy encrypted backup storage; any remaining historical copies are archived and removed after verified restore checks. New direct backups use Amazon S3. | Database backup snapshots can contain account identifiers and relational records from the application and retrieval databases: notebook and file metadata, chat and transcript text, indexes and extracted entities, class records, usage records, billing metadata, and support requests. The uploaded-file copy contains the files themselves, encrypted before transfer. Copies made before September 28, 2026 can also hold records of the retired server code-execution service. Any remaining historical copies are subject to verified migration and removal; Backblaze is not the destination for new direct backups. Routine S3 retention does not establish their deletion; separate cleanup and verification are required. | United States (US East) | July 28, 2026 | Policy |
Entries marked "Initial list" predate the first publication of this page. Prior versions are available from [email protected].
Some blog articles embed YouTube videos using its privacy-enhanced player, and the tutorial welcome screen loads a photograph directly from Unsplash. Loading those resources connects your browser to their providers, which receive network information such as your IP address and browser details. Playing a video can involve additional provider processing. These external resources are separate from the providers processing notebook content above; privacy-enhanced mode does not mean no data is sent. See Google's Privacy Policy, Unsplash's Privacy Policy, and our Cookie Policy.
Some features query public reference services. Instant AI sends the highlighted phrase and a contact user agent to Wikimedia for a summary and image, without an account identifier or authentication credential. A phrase can itself contain personal information, so avoid confidential information for that lookup. Your browser may load the returned image directly from Wikimedia, which receives your IP address and user agent. In-browser Python downloads Pyodide from jsDelivr, which receives your IP address and user agent; the download does not itself send your code or files. Optional web-search integrations depend on deployment configuration and need review before activation.
Tailscale supports the private network between our servers. It receives server and operator account/device information and connection metadata; its relays can carry encrypted traffic. Tailscale states that it cannot read the contents of traffic protected by its WireGuard VPN. This is infrastructure networking, separate from our AI providers. See Tailscale's privacy policy.
Lecture Hat administers the servers that run the Services: Amazon EC2 servers in US East (N. Virginia), listed above, and a Lecture Hat-owned server in the United States that accelerates OCR, transcription of uploaded media, and embeddings when available. OCR can fall back to Amazon Textract, uploaded-media transcription to ElevenLabs, and embeddings to the AWS host. Content passes between them over an encrypted WireGuard (Tailscale) tunnel.
Lecture Hat is established in the United States and stores its systems of record on the United States servers described above. Requests may be processed outside the United States: Cloudflare and Clerk operate global edge networks, Eleven Labs Inc. maintains server locations in the United States, the Netherlands, and Singapore, and Claude requests use AWS Global cross-Region inference profiles.
A restricted transfer from the EEA, United Kingdom, or Switzerland requires a valid transfer mechanism and any additional safeguards required by law. Our DPA describes the transfer documentation to complete before such processing. Publication of this inventory does not establish that Standard Contractual Clauses, a UK Addendum, or a transfer assessment have been completed for a customer or provider. Contact [email protected] to review the documentation applicable to a proposed deployment. See Section 16 of our Privacy Policy.
Under our proposed DPA, Lecture Hat must give the customer at least 30 calendar days' prior email notice before authorizing a new or replacement subprocessor or a material change to covered processing. The customer may object on reasonable data-protection grounds before use begins. The executed DPA sets the alternative-processing and termination remedy, including any refund for prepaid unused affected Services. Send objections to [email protected]; your executed agreement controls if it contains different negotiated terms.
Schedule organization and notice procedure adapted from the Common Paper Data Processing Agreement, version 1.1, © Common Paper, Inc., under CC BY 4.0. Lecture Hat supplied the provider inventory and changed the notice period and execution conditions. This customized schedule does not incorporate the standard agreement on its own.