1Active subprocessors
These vendors handle personal data on our behalf in the operation of Fluëntry. We will give at least 30 days' notice before adding a new subprocessor that handles identifiable personal data, where reasonably practicable, by updating this page and notifying B2B customers via email.
| Subprocessor | Role and data handled | Jurisdiction | Data residency and transfer mechanism |
|---|---|---|---|
| Vercel (active) | Application hosting, edge runtime, asset CDN. Sees request metadata (IP, user-agent), HTTPS traffic, and any payload our app transmits to the browser. | Vercel Inc., USA (with EU operations) | EU regions for application; static assets served from the global edge. Personal-data flows out of the EU are governed by Standard Contractual Clauses. |
| Supabase (active) | Database, authentication, file storage. Holds all account data, test responses, scores, course progress, certificates, team membership and consent records. | Supabase Inc., USA (EU subsidiary for European data) | Frankfurt (eu-central-1). Resting and processing inside the EEA. Cross-border parent-level access governed by Standard Contractual Clauses. |
| PostHog (active) | Product analytics, session replay, feature flags, experiments. Receives behavioural events and a PII-masked replay stream. Configured for EU residency. | PostHog Ltd, UK; EU Cloud operated under separate EEA processor arrangements | EU Cloud, Frankfurt. Resting and processing inside the EEA. Cross-border access controls per PostHog's EU Cloud DPA. |
| Resend (active) | Transactional email (sign-in and confirmation emails, team invitations, course reminders, account notifications and data request confirmations). Holds the recipient address and the email body. | Resend, Inc., USA (EU operations) | EU (Ireland) region. Cross-border parent-level access governed by Standard Contractual Clauses. |
| OpenRouter (active) | AI model gateway. Runs the AI features in the courses (Flo, the tutor and the practice sandbox) and drafts candidate test items for human review. Receives the learner's first name, course position, the screen content and the text the learner types or pastes, and passes it to the model provider (Anthropic) to produce the reply. Does not receive email addresses, test responses or scores. | OpenRouter Inc., USA | United States. Transfers governed by Standard Contractual Clauses. We do not store the text of these exchanges. |
| Google Ads (active, only with Marketing consent) | Advertising conversion measurement. If you accept Marketing cookies, the Google tag sets its cookies and tells Google when a visit from one of our adverts leads to a sign-up. No account data, test data or course data is sent. | Google Ireland Ltd, Ireland (parent Google LLC, USA) | Loaded only after consent. Transfers by Google to the United States are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. |
2Standard contractual clauses
For subprocessors with operations outside the European Economic Area, transfers of personal data are protected by the European Commission's Standard Contractual Clauses (Decision 2021/914) under Article 46(2)(c) of the GDPR. Where the subprocessor's jurisdiction has been the subject of additional EDPB guidance (in particular the United States, in light of Schrems II), we apply the supplementary technical measures recommended in that guidance, including encryption in transit and at rest and segregation of EU-resident processing where the subprocessor supports it.
4Subscribe to changes
To be notified when this page changes, either because we add a subprocessor or because the role or jurisdiction of an existing one changes, write to privacy@fluentry.be with the subject line "Subprocessor change subscription". We will send a plain-text email when this page is updated.
5Historical changes
Material changes to this page will be logged here from version 2 onward.
- 26 May 2026: initial publication.
- 4 October 2026: Fluëntry became free. Lemon Squeezy removed (we take no payments). OpenRouter now also runs the AI features in the courses. Sentry removed (it was never put into use). Google Ads conversion tag listed.