Sub-processors

Last updated: September 2026

These are the companies that process personal data on our behalf. It is the same list as section 8 of our Data Processing Agreement and section 5 of our Privacy Policy, kept here so you can check it without reading either.

Provider	What it does, and what it receives	Where	Transfer safeguard	On the list since
OpenAI OpenAI Ireland Ltd	AI generation and safety screening Free text a learner types into the exercises, chat practice, prompt lab and AI tutor, and AI output for harmful content screening	Ireland, onward to the United States	European Commission standard contractual clauses of 4 June 2021	2026-07-15
Cloudflare Cloudflare, Inc.	Edge network and attack filtering Every request to learnery.io: IP address, requested address, headers	United States	European Commission standard contractual clauses of 4 June 2021	2026-07-30
Stripe Stripe Payments Europe, Limited	Payment processing Name, email and billing address. Card details go to Stripe directly and never reach our servers	Ireland, onward to the United States	European Commission standard contractual clauses of 4 June 2021	2026-07-05
Google Google Ireland Limited	Advertising measurement With consent, from our server when a visitor buys, finishes the AI readiness assessment or sends the ROI calculator form: the click code from the advert, the time and, for a purchase, its value. The Google tag also runs in the browser and, without consent, sends only a cookieless notice that a page was opened. No name, email or telephone number	Ireland, onward to the United States	European Commission standard contractual clauses, and certification under the EU and US Data Privacy Framework
Meta Meta Platforms Ireland Limited	Advertising measurement Only with consent, from our server when a visitor buys, finishes the AI readiness assessment or sends the ROI calculator form: the click code from the advert, the time, the page address, the browser type and, for a purchase, its value. With the same consent the Meta pixel runs in the browser; without it, Meta receives nothing. No name, email or telephone number	Ireland, onward to the United States	European Commission standard contractual clauses, and certification under the EU and US Data Privacy Framework
DATAHOST DATAHOST, Athens	Hosting and transactional mail The database and outgoing messages	Greece	None required, the data does not leave the EU	2026-07-05

We tell account administrators by email at least 30 days before we add or replace a sub-processor, and you may object on reasonable data protection grounds within those 30 days. A provider that does not offer both a processor agreement and a lawful transfer mechanism does not go on this list, whatever it costs us.

Full terms are in our Data processing and our Privacy.