Sub-processors
Last updated: October 6, 2026
These are the companies that handle personal data when you use Course Parse, what each one does and where. It supports our Privacy Policy and our Data Processing Addendum. Services marked after consent only run only if you press Accept on the cookie banner.
Processors acting on our instructions
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Supabase | Database, user sign-in and file storage | Account details, uploaded documents and extracted text, study packs, chat history, course progress | India (Mumbai) |
| Railway | Application hosting and the background job queue | All traffic to the site, and the content of queued jobs while they run | United States (San Francisco) |
| OpenAI | AI generation of study packs, tutor chat, embeddings, speech-to-text for speaking practice and text-to-speech for listening practice | Text extracted from your documents, your chat messages, and speaking-practice audio while it is being transcribed | United States |
| Mistral AI | Optical character recognition for scanned PDFs, used only when a PDF has no text layer | The scanned pages of the PDF being read | European Union |
| Resend | Sending email: account emails, notices, reminders and course emails | Your email address, name and the content of the message | United States |
| Sentry | Error monitoring, so we can find and fix crashes | Technical error details and page addresses. Configured not to collect personal data by default | European Union (Germany) |
| Google Analyticsafter consent only | Counting which pages are useful | Page views, device and approximate location, a random visitor identifier | United States and other countries where Google operates |
Independent controllers
These companies decide for themselves how to use the data they receive, under their own privacy policies, rather than only following our instructions.
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Paddle | Payments, tax and invoicing as our Merchant of Record | Name, email, billing address and payment details, which Paddle collects directly and we never see in full | United Kingdom and United States |
| Sign in with Google, if you choose it | Your Google name, email address and profile picture | United States and other countries where Google operates | |
| Meta Platforms (Meta Pixel)after consent only | Measuring whether our Facebook and Instagram ads work | Pages visited, sign-up and purchase events, a browser identifier | United States and other countries where Meta operates |
| OpenAI (ChatGPT Ads pixel)after consent only | Measuring whether our ads in ChatGPT work | Pages visited, sign-up and purchase events, an advertising click identifier | United States |
Changes to this list
When we add or replace a processor we update this page before the new one handles personal data. Business customers with a signed Data Processing Addendum are told by email at least 30 days ahead and may object. To be on that list, email support@courseparse.com.
Security certifications
Course Parse itself does not currently hold a SOC 2 report or ISO 27001 certificate. Some of the providers above publish their own; ask us and we will point you to them.