Sub-Processors

| Direct Processor | Function | Material Sub-Processors | Processing Location | Child Data? |

|---|---|---|---|---|

| Hosting and authentication provider | Account access, database, and storage services | United States | Yes |

| AI assistance provider | Optional tutoring and safety assistance | United States | Yes, only as needed to provide the feature |

| AI assistance provider | Optional alternate tutoring assistance | United States | Yes, only as needed to provide the feature |

| Google LLC (Gemini and Google Cloud AI services) | Alternate AI and voice services | Google Cloud infrastructure and disclosed sub-processors | United States and other disclosed service locations | Disabled for child personal data unless contract, paid-service, and configuration evidence are current |

| ElevenLabs, Inc. | Text-to-speech and approved narration rendering | Infrastructure providers listed in ElevenLabs' current sub-processor disclosures | United States and other disclosed service locations | Child personal data blocked; approved Koydo-authored lesson narration may be rendered |

| fal.ai | Staff-operated AI image generation | Infrastructure providers listed in fal.ai's current disclosures | United States and other disclosed service locations | No — admin-only staff-authored prompts |

| Stripe, Inc. | Payment processing for adult subscriptions | AWS; payment-network providers (Visa, Mastercard, etc.) per Stripe's published list | United States, with global card-network routing | No — adult accounts only |

| RevenueCat, Inc. | Mobile subscription management (iOS, Android) | AWS; Apple StoreKit; Google Play Billing | United States | No — adult accounts only |

| Vercel, Inc. | Web hosting, edge runtime, and optional web performance analytics | Amazon Web Services; Cloudflare (edge cache and DDoS protection) | United States; global edge | Limited — hosting processes essential network data; optional analytics are blocked for active profiles known to be under 18, and anonymous use requires adult-mode selection and consent |

| Sentry (Functional Software, Inc.) | Error monitoring and crash reporting | Google Cloud Platform | United States | Limited — minimized crash metadata only; Koydo removes user identity, request data, learner content, breadcrumbs, custom context, and attachments before transmission for every user, and disables automatic session tracking, replay, and performance traces |

| Google Workspace | Business email infrastructure (admin@, privacy@, legal@, etc.); Gmail API for vendor correspondence | Google LLC global infrastructure | Multi-region | Limited — admin correspondence only; no User content |

| Cloudflare, Inc. | DNS, CDN, DDoS protection, bot detection, Turnstile security checks, and R2 object storage | Cloudflare global infrastructure | Global edge and configured object-storage locations | Limited — network and browser/device signals are used for security; R2 stores Koydo service media and other objects placed there |

Daily.co is integrated for a future Study Rooms video feature but is disabled while Koydo completes its contract and configuration review. It does not receive User data in the current configuration. If enabled after review, Focus Cam will remain unavailable to users under 13, audio and video recording will remain disabled, and Daily may process short-lived call metadata needed to operate and troubleshoot calls.

Mixpanel is integrated for optional product analytics but is disabled in Koydo's current linked web configuration. If enabled later, Mixpanel will remain limited to active profiles with a known age of at least 18 and recorded analytics consent. Unknown age, minor status, opt-out, and native-app contexts deny initialization.

The following providers have been evaluated and excluded for child-serving Koydo products:

| Provider | Reason for exclusion |

|---|---|

| xAI / Grok | Regulatory and content-safety risk for a child-serving platform; not used; do not re-enable |

| Meta Platforms (Facebook SDK, Pixel, etc.) | Advertising and behavioral-tracking infrastructure inconsistent with Koydo's no-advertising posture |

| TikTok Pixel / TikTok APIs | Same as above |

| Google Ads / DoubleClick | Same as above |

Koydo maintains a private evidence register for provider contracts, transfer terms, retention and training controls, account settings, deletion behavior, and review dates. A provider is not enabled for child personal data merely because it appears in this list. Child-serving AI routes fail closed unless the evidence for the exact provider service is current.

OpenAI's DPA was executed on March 19, 2026. Koydo does not publicly describe any provider as having zero retention unless current private evidence covers the exact account, project, endpoint, and feature. For a copy or redacted summary of an applicable transfer mechanism, contact privacy@koydo.app.

Sub-processor list v2026-07-11 — Effective July 11, 2026 — koydo.app/legal/subprocessors