Sub-processors
In short: Refine relies on a small number of service providers, known as sub-processors under the GDPR, to operate the platform: infrastructure, media storage, speech processing, email delivery, and product analytics. This page lists every one of them, what each processes, and where.
1. Who we use
| Provider | Purpose | Personal data processed | Location | Safeguard |
|---|---|---|---|---|
| Google Cloud Platform | Core infrastructure, database, and AI processing of lesson responses. | All platform data, including audio and transcripts while AI feedback is being generated. | EU (Frankfurt) and United States, depending on the service | DPA + Standard Contractual Clauses |
| Amazon Web Services | Backup and scalable storage. | Backups of platform data. | EU / global, depending on configuration | DPA + Standard Contractual Clauses |
| Cloudflare (R2) | Object storage for media used inside lessons (images and video). | Lesson media files uploaded by course authors; not learner data in the ordinary course. | Frankfurt, Germany (EU) | DPA + Standard Contractual Clauses |
| Vercel | Hosting and delivery of the web application. | Technical request data, including the approximate country derived from your IP address (used for language detection); no application data is stored. | Global edge network | DPA + Standard Contractual Clauses |
| Deepgram | Speech-to-text transcription of spoken lesson answers. | Voice recordings, processed in real time and not stored by the provider. | United States | DPA + Standard Contractual Clauses |
| ElevenLabs | Text-to-speech generation of lesson audio. | Lesson text rendered to audio in real time; no learner data is stored. | United States | DPA + Standard Contractual Clauses |
| Resend | Transactional email, such as password resets and invitations. | Name and email address. | United States | DPA + Standard Contractual Clauses |
| PostHog | Product usage analytics. | Pseudonymous usage events only: salted, irreversible identifiers and lesson-completion facts. No names, email addresses, lesson content, or IP addresses. | Frankfurt, Germany (EU Cloud) | DPA + Standard Contractual Clauses |
About the analytics entry. PostHog never receives who you are: a salted, irreversible identifier stands in for each learner, and the salt never leaves our servers. Nothing analytics-related runs in, is stored in, or is read from your browser; see our Cookie & Browser Storage Policy for the full description.
2. Changes to this list
We will update this page before engaging a new sub-processor or materially changing what an existing one processes. Enterprise customers are additionally notified in accordance with their data processing agreement and may object within the period it defines.
3. Questions
This platform is operated by Refine Inc. Questions about this list, or about how a provider handles your data, can be sent to ceo@refine-skills.com.