Sub-processors
Last updated: 28 July 2026 · Version 2026-07-28
Feedback Flows Ltd uses the following sub-processors to deliver the Service. This list forms Annex III of our Data Processing Agreement.
| Name | Category | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|---|
| OpenAI, L.L.C. | AI | AI processing for marking, feedback, tutoring, worksheets, syllabus generation, OCR/vision, Whisper transcription and related features | Student work text, images/pages, audio (where Video Marker is used), and limited prompt context; may include student names unless anonymisation is enabled | United States | UK International Data Transfer Agreement / UK Addendum to EU SCCs (OpenAI API terms) |
| Stripe, Inc. / Stripe Payments Europe Limited | Payments | Payment processing for credit packs and subscriptions | Account holder email, customer and subscription identifiers, payment amounts (card data handled by Stripe Checkout — not stored by us) | United States / European Economic Area | Stripe Binding Corporate Rules / SCCs as applicable |
| SMTP email provider (configured per deployment) | Transactional and (where consented) marketing email delivery | Recipient email address and message content (may include names, marks or feedback when teachers email results) | Depends on configured MAIL_SERVER | As required by the configured provider's terms | |
| Cloudflare, Inc. (Turnstile) | Security | Bot protection on account registration | Turnstile challenge token and client IP address at verification time | Global edge network | Cloudflare data processing terms / SCCs as applicable |
| Google LLC (Google Analytics 4) | Analytics | Optional website analytics (only when the visitor has opted in) | Pseudonymous analytics identifiers, page views, device/browser metadata | United States / global | Google Ads Data Processing Terms / SCCs; loaded only after analytics consent |
| Crossref | Reference data | Bibliographic metadata lookup for reference checking (DOI only) | Digital Object Identifier (DOI); student essay text is not sent to Crossref | United States | Public API; limited metadata only |
| YouTube (Google LLC) via yt-dlp | Media | Download of user-supplied YouTube URLs for Video Marker (local processing) | Video URL and downloaded media temporarily stored on our UK servers; audio/frames may then be sent to OpenAI | Media retrieved from YouTube; processed in United Kingdom then OpenAI (US) | User-initiated URL; subsequent AI processing under OpenAI terms |
Change notification
We will update this page when we add or replace a sub-processor that processes customer personal data. Enterprise customers who need contractual notice of changes may contact admin@feedbackflows.org to arrange notification preferences. Objections may be raised as described in the DPA.