PSTUDY is operated by Tesco Engineering BV (Heibergstraat 6, 2235 Hulshout, Belgium; BE 0477 579 104). Where a school uses PSTUDY for its pupils, the school is normally the controller and we act as its processor; the providers below are then our sub-processors. Where someone signs up individually, we are the controller and the same providers are our processors.
This list is kept against the code that runs www.pstudy.be, not against a template: every provider below is one the application actually calls. If you are evaluating PSTUDY for a school and something here does not match what you were told, trust this page and tell us.
Who we use today
Supabase
Supabase, Inc.
- What it does
- Database, sign-in and file storage. This is the authoritative copy of PSTUDY: accounts, decks and cards, practice activity, exams and their results, and the pictures you upload.
- What it can see
- Your email address and name, everything you create or record in the product, and exam results.
- Where it processes
- European Union — eu-west-3 (Paris, France).
Vercel
Vercel, Inc.
- What it does
- Hosting. Vercel serves the website and runs the application's server code, including the routes that talk to every other provider on this page.
- What it can see
- Request data as it passes through, including IP address and whatever a page submits. Vercel holds no copy of the database.
- Where it processes
- Server code runs in the cdg1 region (Paris). One part does not: Next.js middleware always runs at the edge location nearest the visitor and cannot be pinned to a region, and PSTUDY's middleware reads the session cookie on almost every request. Vercel is also a United States company, so operating and supporting the platform may involve access from the United States.
OpenAI
OpenAI, L.L.C.
- What it does
- AI deck generation, and a check on the short public labels you give a deck (field of interest, topic) for inappropriate content.
- What it can see
- The document text or topic you submit for generation, and those short labels. No account identifier, name or email is sent with the request — the call carries the text and nothing else.
- Where it processes
- United States.
Resend
Resend, Inc.
- What it does
- Transactional email: review invitations, approval and change-request notices, school invitations, and account mail such as sign-up confirmation and password reset.
- What it can see
- Recipient email address and name, and whatever the message itself contains — typically a deck or exam title and a link.
- Where it processes
- United States.
Cloud86
Cloud86 B.V.
- What it does
- The outgoing mail server for messages you send through the contact and help forms. These go to our own inbox rather than through the provider above.
- What it can see
- The name, email address and message you type into the form.
- Where it processes
- Netherlands — European Union.
Google Cloud Speech-to-Text
Google Ireland Limited / Google LLC
- What it does
- Turns speech into text during speak practice — but only if you choose it. Practice uses your browser's own speech recognition by default; Google Cloud is an engine you select per browser in the exercise settings.
- What it can see
- Short recordings of your voice while you answer, and the words of the deck you are practising, which are sent with the audio as recognition hints.
- Where it processes
- Google's global Speech-to-Text endpoint. We do not pin a region, so processing may take place outside the European Union, including in the United States.
Transfers to providers outside the European Economic Area are made on the basis of the European Commission's standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework, together with each provider's own data processing terms. Our agreement with Supabase is a signed Customer Data Processing Agreement incorporating the standard contractual clauses, including Module Three — the module that applies when your school is the controller, we are its processor, and Supabase is our sub-processor.
The layer beneath Supabase
Supabase holds the database, so the providers it engages in turn matter to you as much as ours do. These are its own sub-processors, as listed in Schedule 3 of the data processing agreement we hold with them:
- Amazon Web Services — the infrastructure the database itself runs on.
- Postmark and ActiveCampaign — email sent by Supabase.
- Atlassian — status and incident reporting.
- Braintrust Data — monitoring.
Supabase maintains this list itself and may change it; the version above is the one in our signed agreement. Ask us and we will tell you the date of the copy we hold.
Not in use yet
Paddle is named here because we intend to use it as the merchant of record when paid plans launch. It is not enabled: the application has no live checkout, and no payment data has been processed. We will update this page and the privacy policy before that changes.
Other services that get called
These are not sub-processors — they do not process personal data on our instructions — but a complete answer is more useful to a DPO than a short one, so here is every other third party the product touches.
- Openverse provides the picture search in the card editor, which returns only openly licensed images. The search term travels from our server, not your browser, so Openverse does not see your IP address or who you are.
- The hosts of the pictures themselves. While the picture picker is open, your browser loads each thumbnail directly from wherever that image lives — Wikimedia Commons or Flickr's image servers, for example — so those hosts see your browser's IP address, as they would if you visited the site. Once you pick a picture we copy it into our own storage, and the original host is not contacted again.
- Your browser's own speech recognition, which is what speak practice uses unless you switch the engine to Google Cloud. It is part of the browser rather than part of PSTUDY: in Chrome and Edge it sends audio to Google's servers, on Apple devices it can run on the device. Either way that processing is between you and your browser vendor, and we neither see nor control it.
What we do not use
No analytics provider, no advertising or marketing trackers, no third-party cookies, and no session-recording or heat-mapping tools. The only cookies PSTUDY sets are the first-party ones needed to keep you signed in — see Cookies.
When this changes
When we add, replace or drop a provider we update this page and the “Last updated” date above. If you are a school and would like to hear about a change in advance rather than find it here, write to privacy@pstudy.be and we will tell you before it takes effect.
For the wider picture — what we collect, why, how long we keep it and what rights you have — see the Privacy Policy.