Sub-processors
Last updated: March 2026
This page lists the third-party service providers (sub-processors) that process personal data on behalf of Swedish General Consulting AB (trading as Epivo) in connection with the Epivo platform. Each sub-processor processes data only for the purposes described below. All are bound by a data processing agreement, except OpenRouter, where an agreement has been requested and is not yet in place.
Current sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic | AI model provider — generates tutoring responses from conversation content | United States | SCCs |
| OpenAI | AI model provider — supporting analysis: selects lesson images and ranks courses | United States | SCCs |
| OpenRouter | Backup AI model routing, and offline quality analysis of tutoring sessions | United States | No agreement in place — requested |
| Deepgram | Speech-to-text — converts voice audio to text in real time | United States | SCCs |
| ElevenLabs | Text-to-speech — generates voice responses for the AI tutor | United States | SCCs |
| Stripe | Payment processing — handles subscription payments securely | United States | DPF + SCCs |
| Resend | Transactional email — sends verification and service emails | United States | SCCs |
| Render.com | Cloud hosting — hosts our application and database | United States | DPF + SCCs |
| Cloudflare | Content delivery and storage — serves website and stores educational media | United States | DPF + SCCs |
| Authentication — provides sign-in via Google accounts; advertising conversion measurement — with your consent, receives the click identifier of an advert you followed so a sign-up, app install, first lesson or purchase can be attributed to the right campaign | United States | DPF + SCCs | |
| Meta | Advertising conversion measurement — if you arrive from an advert on Facebook or Instagram and consent to advertising cookies, receives that advert's click identifier and a one-way hash of your email address so the sign-up can be attributed to the right campaign | United States | SCCs |
| Advertising conversion measurement — if you arrive from an advert on Reddit and consent to advertising cookies, receives that advert's click identifier and a one-way hash of your email address so the sign-up can be attributed to the right campaign | United States | SCCs | |
| Backblaze B2 | Backup and archive storage — nightly database backups and archived session records (includes student personal data) | United States | SCCs |
Transfer mechanisms
- DPF — EU-US Data Privacy Framework. The provider is certified under the framework, which the European Commission has recognized as providing adequate protection for personal data transfers.
- SCCs — EU Standard Contractual Clauses. Contractual safeguards approved by the European Commission for international data transfers, supplemented with additional technical and organizational measures where appropriate.
Changes to this list
We will update this page when we add or remove sub-processors. If you would like to be notified of changes, contact us at privacy@epivo.ai and we will include you in our sub-processor change notifications.
Questions
If you have questions about our sub-processors or how your data is processed, contact us at privacy@epivo.ai. For more information about how we handle personal data, see our Privacy Policy.