Raitu
Start trial

Legal

Sub-processors

These are the third-party services that process personal information for Raitu, what each one receives, and where it runs. We keep this list short, we do not sell data, and we do not allow any provider on it to train models on your content.

Last updated:

How to read this list

Which AI providers see a learner’s content depends on age. Learners under 18 are served by OpenAI only. Adults and guests who confirmed they are 18 or older are served by Google, ElevenLabs and OpenRouter as a backup. Where a detail is marked Pending, we have asked or are still confirming it and have chosen to say so rather than guess. Fuller detail, including retention by provider, is in the Privacy Policy.

Current sub-processors

OpenAI

What it does
Everything AI for learners under 18: lesson planning, grading, quizzes, document reading, spoken-question transcription, narration and figures. Also content-safety checks for those learners.
Data it receives
Under-18 learners' topics, questions, answers, uploaded document text, voice recordings, and the tutor's responses.
Used for
Learners under 18
Location
United States or European Union (OpenAI regional processing)
Trains on our data
No. API content is not used to train models.
Retention
Abuse-monitoring logs for up to 30 days by default, longer where the law requires.
Agreement
Data processing agreement signed by both parties.

Google (Gemini API, paid tier)

What it does
Lesson planning, narration, quizzes, grading, sketches, figures and document reading for adults and guests aged 18 or over.
Data it receives
Topics, questions, session context, check-in answers, uploaded document content, narration text, figure descriptions.
Used for
Adults and guests (18+)
Location
Not controllable by us; Google may process or cache content in any country.
Trains on our data
No. On the paid tier Google does not use prompts or responses to improve its products.
Retention
Abuse-monitoring logs for a limited period that Google does not state.
Agreement
Google Cloud Data Processing Addendum (applies on the paid tier).

ElevenLabs

What it does
Speech-to-text for spoken questions and narration, for adults and guests aged 18 or over.
Data it receives
Voice recordings and narration text.
Used for
Adults and guests (18+)
Location
United States by default; its data-residency option (EU and other locations) is an Enterprise feature we do not use.
Trains on our data
No. We have opted out of its use of our content to train models.
Retention
Standard retention, which it does not publish for our plan; deleted items stay in backups for up to 30 days. Zero Retention Mode is not active.
Agreement
Data Processing Addendum with EU standard contractual clauses forms part of its customer agreement.

OpenRouter

What it does
Backup route for adults and guests when Google is unavailable: lesson planning, narration, quizzes, grading and sketches.
Data it receives
The same content Google would have received.
Used for
Adults and guests (18+)
Location
Varies by the AI provider it routes to; OpenRouter itself may process in the United States.
Trains on our data
No. Provider training is switched off and only zero-data-retention providers are allowed.
Retention
OpenRouter keeps no prompt content (logging is off); upstream providers must keep none.
Agreement
Pending

Supabase

What it does
Database, sign-in and file storage.
Data it receives
Accounts, profiles, sessions, uploaded-document digests, consent records, guardian email addresses, safety records.
Used for
Everyone
Location
Paris, France (eu-west-3)
Trains on our data
Not applicable (infrastructure).
Retention
Set by us: see the retention section of the Privacy Policy.
Agreement
Data Processing Agreement with EU standard contractual clauses, accepted as part of its terms; 30 days' notice of sub-processor changes.

Vercel

What it does
Website hosting, server functions, scheduled jobs and cookie-free page-view analytics.
Data it receives
Request traffic, IP addresses, page-view events.
Used for
Everyone
Location
Server functions in Cape Town, South Africa; global edge network for delivery.
Trains on our data
Not applicable.
Retention
Server logs are kept by Vercel for 1 day on the Pro plan (1 hour on Hobby).
Agreement
Pending

PostHog

What it does
Product analytics and sampled session replay.
Data it receives
Usage events and replays on about 1 in 10 visits. Replays mask all on-screen text and inputs and replace images.
Used for
Everyone
Location
European Union
Trains on our data
Not applicable.
Retention
Events 1 year (free) or 7 years (paid); replays up to 30 days on the free plan, longer on paid. Our plan: pending.
Agreement
Pending

Cloudinary

What it does
Hosting of generic tutor-drawn figure images.
Data it receives
Generated illustrations (no learner content).
Used for
Everyone
Location
United States by default (other regions are an Enterprise option); our account's region is being confirmed.
Trains on our data
Not applicable.
Retention
Kept until we remove them; not deleted when an account is deleted.
Agreement
Published Data Processing Agreement; participates in the EU-US Data Privacy Framework.

Resend

What it does
Transactional email: welcome, guardian consent, reminders and contact replies.
Data it receives
Names, email addresses (including guardian addresses) and message content.
Used for
Everyone
Location
Email is sent from Ireland (eu-west-1), but Resend stores message content, logs and account data in the United States.
Trains on our data
Not applicable.
Retention
30 days of email and log data on its Free, Pro and Scale plans; deleted within 90 days of account termination; backups 7 days.
Agreement
Data Processing Agreement pre-signed by Resend, with EU standard contractual clauses; EU-US Data Privacy Framework participant.

Paystack

What it does
Payment processing for adults purchasing a plan or pack.
Data it receives
Payer details. Card data is handled by Paystack and never reaches us.
Used for
Adults and guests (18+)
Location
Ireland (private AWS cloud).
Trains on our data
Not applicable.
Retention
No fixed period published; keeps some transaction and identity records as the law requires.
Agreement
Pending

Transfers outside South Africa

Most of these providers process data outside South Africa, mainly in the European Union and the United States. Our written transfer basis under section 72 of POPIA is Pending legal review. In the meantime we rely on each provider’s data processing agreement and, where available, its standard contractual clauses.

Changes to this list

We update this page before a new sub-processor starts handling learner data, and change the date above. Institutions with a signed agreement will be told of changes under the notice terms in that agreement. Questions or objections: support@raitu.tech.