1. Overview
LinkEdu.AI uses third-party service providers ("subprocessors") to deliver specific platform functions. Each subprocessor processes personal data solely on behalf of LinkEdu.AI under contractual obligations. This page lists all current subprocessors, their purpose, the categories of data processed, and their hosting locations.
Data Processing Agreements (DPAs) are in place with all subprocessors in accordance with GDPR Article 28 and other applicable data protection regulations.
2. Subprocessor Vetting & Due Diligence
Before engaging any subprocessor, LinkEdu.AI performs due diligence to evaluate their data protection practices. This includes:
- Security and privacy posture assessment
- Review of data protection and incident response practices
- Verification of contractual safeguards, including a signed Data Processing Agreement (DPA)
- Ongoing monitoring of compliance and service performance
3. International Data Transfers
All subprocessors processing personal data outside the European Economic Area (EEA) are governed by appropriate safeguards, including Standard Contractual Clauses (SCCs) or equivalent legal mechanisms, in accordance with GDPR requirements.
The primary data processing location for LinkEdu.AI is the United States. Where subprocessors operate global infrastructure (e.g., CDN edge networks), data exposure is limited to request-level metadata and does not include application-level personal data.
4. Subprocessor List
The following subprocessors are currently engaged by LinkEdu.AI:
| Subprocessor | Category | Purpose | Data Processed | Location | DPA |
|---|---|---|---|---|---|
| MongoDB Atlas (MongoDB Inc.) | Infrastructure | Primary database for accounts, profiles, applications, documents (GridFS), subscriptions, consent and audit records | Account and profile data, application and document data, billing metadata, consent evidence (salted IP hash) | United States (Google Cloud) | Yes |
| Emergent (Emergent Labs) | Infrastructure | Application hosting, deployment, AI model gateway and managed Google sign-in | Application traffic, AI feature inputs/outputs routed to model providers, Google sign-in profile (name, e-mail) | United States | Yes |
| Google Cloud (Google LLC) | Infrastructure | Underlying cloud infrastructure for database hosting | Encrypted database storage | United States | Yes |
| Cloudflare (Cloudflare Inc.) | Security | Content delivery, TLS, DDoS protection and bot mitigation | IP addresses, request metadata, security cookies | Global (edge network) | Yes |
| Stripe (Stripe Inc.) | Payments | University subscription checkout, billing portal, invoices and recurring payments | Billing contact, payment method (held by Stripe only), subscription and invoice records | United States | Yes |
| Resend (Resend Inc.) | Communications | Transactional, account, security and permitted engagement e-mail delivery; delivery/bounce/complaint telemetry | E-mail address, message content, delivery events | United States | Yes |
| Sentry (Functional Software Inc.) | Monitoring | Error and performance monitoring; Session Replay only with optional analytics consent | Error traces and performance data with PII scrubbed; masked replays when consented | United States | Yes |
| UptimeRobot (UptimeRobot s.r.o.) | Monitoring | External availability monitoring of public endpoints | Endpoint response status only (no personal data) | European Union | N/A (no personal data) |
| OpenAI (OpenAI, L.L.C.) | AI Processing | AI model provider for explanations, summaries, support and drafting features (via the Emergent gateway) | Prompts and content submitted to AI features, minimised where possible | United States | Yes |
| Anthropic (Anthropic PBC) | AI Processing | AI model provider for selected features (via the Emergent gateway) | Prompts and content submitted to AI features, minimised where possible | United States | Yes |
| Google AI (Google LLC) | AI Processing | AI model provider for selected features (via the Emergent gateway) | Prompts and content submitted to AI features, minimised where possible | United States | Yes |
| Google Analytics (Google LLC) | Analytics | Optional usage analytics — loaded only after the user accepts optional analytics in the cookie banner | Pseudonymous usage data; disabled without consent | United States | Yes |
5. Data Minimization
Each subprocessor is granted access only to the minimum data necessary to perform its specific function. No subprocessor receives more data than is required for its stated purpose.
Where possible, data is anonymized or pseudonymized before being transmitted to subprocessors. For example, AI processing subprocessors receive anonymized profile context rather than direct personal identifiers.
6. Changes to This List
LinkEdu.AI may update this subprocessor list as new providers are engaged or existing ones are discontinued. When material changes occur, we will:
- Update this page with the new subprocessor details
- Notify affected users via email at least 30 days before the change takes effect
- Provide an opportunity to object to the new subprocessor within that notice period
Users may request notifications of subprocessor changes by contacting admin@linkedu.ai.
7. Legal Basis for Subprocessor Engagement
Subprocessors act solely on behalf of LinkEdu.AI under contractual obligations and do not process personal data for their own independent purposes. Processing is carried out under the legal bases described in our Privacy Policy, including contractual necessity, legitimate interest, and user consent where applicable.
8. Contact
For questions about our subprocessors, to request change notifications, or for data protection inquiries:
- Data Protection: admin@linkedu.ai
- DPA Requests: Submit a DPA request
- Security Inquiries: Security request form
- Legal: admin@linkedu.ai