Subprocessors
Who else touches your data.
Last updated 2026-04-12 · v3
This is the complete list of third-party services we use to operate CinderTutor. We keep it short on purpose. Org-plan customers receive at least 30 days’ notice before any addition, via the address in section 10 of the Privacy Policy.
Subprocessor
What it does
Where
Transfer basis
Stripe Payments Australia Pty LtdStripe (Australia)
Card-on-file storage and subscription billing. Card numbers never reach our servers.
Sydney, AU
AUIntra-Australia. No cross-border transfer.
Amazon Web Services Inc.AWS Australia (Sydney) Region
Primary hosting (database, application, recordings storage). Sydney region for primary; Singapore for cross-region backup.
Sydney, AU (primary)
Singapore (backup)
SGCross-border to Singapore for backup only. Standard contractual clauses in place.
Daily.co (Pluot Inc.)Pluot Inc. dba Daily.co
Video conferencing for live tutoring sessions. Recordings are saved to our AWS infrastructure, not to Daily’s.
United States
SCCsCross-border transfer for live media stream only. Daily.co is HIPAA-certified.
ActiveCampaign LLCPostmark (transactional email)
Transactional emails: sign-up verification, billing receipts, password resets, progress reports, lesson reminders. No marketing emails.
United States
SCCsCross-border for email delivery. Email content is functional, not promotional.
Plausible Insights OÜPlausible Insights OÜ
Cookie-less, privacy-respecting analytics for the marketing site (this site). Not used in the parent dashboard or session pages.
Tallinn, EE
SCCsCross-border to EU. No personal data stored; only aggregate page views.