Sub-processors and Transfers
The service providers that handle personal data for YourWorksheets, where they are, and the safeguards for transfers abroad.
Version 1.0 · In force from 13 October 2026 · Last updated 13 October 2026
Providers
| Provider | Purpose | Data | Location | Role |
|---|---|---|---|---|
| Vercel Vercel Inc., San Francisco, USA Privacy policy | Hosting of the website and its server functions; delivery of pages; if you allow it, page-speed measurement (Speed Insights). | IP address, request details, and everything that passes through our server (account, worksheet and form data). | United States, with worldwide edge locations | Processor (acts for us) · Handles student data |
| Google Firebase and Google Cloud Google LLC, Mountain View, USA Privacy policy | Sign-in (Firebase Authentication), the database (Cloud Firestore), file storage (Cloud Storage), and the bot check (App Check with reCAPTCHA). | Account data, worksheets and uploads, class and student records, messages, IP address and browser details for sign-in and the bot check. | United States for sign-in; the database and file storage are in the Google Cloud location chosen for our project | Processor (acts for us) · Handles student data |
| Google Analytics for Firebase (only with your consent) Google LLC, Mountain View, USA Privacy policy | Counting visits and how features are used, only if you allow analytics in the cookie settings. | A random identifier, IP address, device and browser details, pages and features used. | United States | Processor (acts for us) |
| Google Gemini API Google LLC, Mountain View, USA Privacy policy | Writing worksheet drafts in AI Studio from the settings you enter. | The subject, topic, grade or level, language, question types and difficulty you choose. No account details are sent. | United States and other Google locations | Processor (acts for us) |
| Anthropic (Claude) Anthropic, PBC, San Francisco, USA Privacy policy | Writing worksheet drafts on the AI Studio page, and pictures for your picture library, from what you ask for. | What you ask for — subject, topic, goals, level, languages, question types, a theme and any text you paste, or a few words describing a picture — and an anonymous code in place of your account. Never your name or e-mail. | United States | Processor (acts for us) |
| Upstash Upstash, Inc., USA Privacy policy | Rate limiting: short-lived counters that stop the service being overwhelmed or abused. | IP address and account identifier, held only for the length of the counting window (at most one day). | The Upstash region chosen for our database | Processor (acts for us) |
| Resend Resend, Inc., USA Privacy policy | Delivering a copy of your help-form message, data request or content report to our inbox so we can answer it. | Your name, e-mail address and the text of your message. | United States | Processor (acts for us) |
| Polar Polar Software, Inc., Dover, Delaware, USA Privacy policy | Selling the Plus and Pro plans as merchant of record: checkout, payment, tax, receipts, refunds and the subscription portal. | Your e-mail address and account identifier from us; your name, billing address and card details, which you give directly to Polar and which we never see. | United States | Independent controller |
Polar is an independent controller for payment data: it decides how payment details are handled, under its own privacy policy.
Transfers abroad and their safeguards
| Provider | Location | Türkiye (KVKK art. 9) | EU and UK |
|---|---|---|---|
| Vercel | United States, with worldwide edge locations | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per Vercel’s data processing addendum |
| Google Firebase and Google Cloud | United States for sign-in; the database and file storage are in the Google Cloud location chosen for our project | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per the Google Cloud data processing terms |
| Google Analytics for Firebase (only with your consent) | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per Google’s terms |
| Google Gemini API | United States and other Google locations | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Google’s data processing terms for the Gemini API |
| Anthropic (Claude) | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Anthropic’s data processing addendum, with Standard Contractual Clauses |
| Upstash | The Upstash region chosen for our database | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Upstash’s data processing agreement |
| Resend | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Resend’s data processing agreement |
| Polar | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Polar’s own privacy policy and buyer terms (Polar decides how payment data is handled) |
Changes to this list
We add a provider here at least 30 days before it starts handling student data, and schools may object in that time (see the Data Processing Terms). Every change appears in the version history and the legal changelog. Questions or a copy of a safeguard: privacy@yourworksheets.com.