Subprocessors
Effective 10 October 2026
Sigil Digital Limited uses the providers below to run TutorWrap. Each is bound by a contract that limits it to the purpose listed, requires appropriate security, and prohibits using the data to train or improve AI models. This page is Annex 3 of our Data Processing Addendum. Tutors are notified by email at least 15 days before a provider is added or replaced.
Current subprocessors
| Provider | Purpose | Data it handles | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application, worker and database | All data in the service | Germany (Nuremberg) |
| Cloudflare, Inc. | DNS, network security and performance in front of the site; private object storage for evidence photos, parent-sent photos and encrypted database backups | All traffic to the site passes through Cloudflare; stored objects are photos and backups | Global edge network; storage buckets in the EU |
| Clerk, Inc. | Sign-in, passwords, Google sign-in and account security for tutors | Tutor name, email address, sign-in credentials, IP address | United States |
| Resend, Inc. | Sending email updates to parents and account email to tutors | Recipient name and email address, the content of the update | United States |
| Twilio Inc. | Sending SMS and WhatsApp updates; receiving replies and STOP requests | Mobile number, the content of the update, replies and any photo a parent sends | United States |
| Nylas, Inc. | Read-only calendar connections for post-lesson reminders | Tutor's calendar account identifier, event titles and times on calendars the tutor ticks | Company in the United States; TutorWrap uses the EU data region |
| Anthropic, PBC | AI assist: drafting goal steps, next-lesson focus lines and turning a dictated note into session fields | Student first name, subject, curriculum and year group, goal wording and progress levels, recent lesson topics, the tutor's dictated transcript | United States |
| Deepgram, Inc. | Speech to text for dictated session notes | The tutor's voice recording | United States |
| PostHog, Inc. | Product analytics | Tutor account id, plan and country; page views only after cookie consent | Company in the United States; TutorWrap uses the EU cloud (Frankfurt) |
| Functional Software, Inc. (Sentry) | Error monitoring | Pseudonymous account id, approximate location from IP address, technical error details | Company in the United States; TutorWrap uses the EU region |
| Lemon Squeezy, LLC | Merchant of record for USD, GBP and EUR subscriptions and credit packs | Tutor name, email, billing address, payment details (collected by Lemon Squeezy directly) | United States |
| Paystack Payments Limited | Payment processing for NGN subscriptions | Tutor name, email, payment details (collected by Paystack directly) | Nigeria |
Not subprocessors
Google and Microsoft are the tutor's own calendar providers; TutorWrap reads from them through Nylas on the tutor's instruction and sends them nothing. Stripe is integrated but not used for live payments. Slack and Uptime Kuma receive operational alerts that carry no personal data.
Changes
| Date | Change |
|---|---|
| 10 October 2026 | First published list. Adds Anthropic, Deepgram, Lemon Squeezy and Cloudflare R2 storage, which the previous Privacy Policy did not name. |
Questions about this page: [email protected]