Subprocessor List
Overview
MHLE uses the following sub-processors (third-party vendors that process personal data on MHLE's behalf) to deliver our service. This list is updated within 30 days of any material change.
If you have questions or wish to object to the addition of a new sub-processor, contact privacy@mhle.com.
Notification of Changes
We notify customers of sub-processor changes by updating this page and, where required by contract, sending advance notice to enterprise customers. The change history table above records all additions, removals, and material updates.
Current Sub-Processors
Infrastructure & Storage
| Vendor | Purpose | Data Processed | Transfer Mechanism | Data Location |
|---|---|---|---|---|
| Google Cloud Platform | Cloud hosting, compute, storage | All user data at rest and in transit | Standard Contractual Clauses (SCCs) + DPA | United States |
| Redis / Upstash | Session caching, rate-limiting | Temporary session tokens, rate counters | Intra-regional | United States |
AI Model Providers
MHLE sends user-submitted note content to the following AI providers for analysis, generation, and search. Content is processed under zero-day retention agreements where available (see notes below).
| Vendor | Models Used | Data Sent | Retention | Contract Basis |
|---|---|---|---|---|
| Google LLC (Vertex AI / Gemini) | gemini-2.0-flash, gemini-flash-latest | Note text, study materials | Zero retention (API) | DPA + SCCs |
| OpenAI, LP | gpt-4o, gpt-4o-mini, gpt-3.5-turbo, text-embedding-3-small, whisper-1, tts-1-hd | Note text, audio transcriptions, TTS synthesis, embedding vectors | Zero retention (API) | DPA + SCCs |
| Anthropic, PBC | claude-sonnet-4-5, claude-haiku-4-5, claude-opus-4-5 | Note text, study materials | Zero retention (API) | DPA + SCCs |
| Perplexity AI, Inc. | sonar | Note topics, factual claims (for verification) | Per API ToS | DPA under negotiation |
Note on audio data (whisper-1): When users opt into voice note capture, audio is transcribed by OpenAI's Whisper model over an encrypted API call. Audio is not retained by OpenAI beyond the duration of the API request under our enterprise agreement.
Note on text-to-speech (tts-1-hd): When text-to-speech features are active, the text being synthesized is sent to OpenAI. No voice profile or user identity is transmitted.
Authentication & Identity
| Vendor | Purpose | Data Processed | Transfer Mechanism | Data Location |
|---|---|---|---|---|
| Google LLC (OAuth) | Social sign-in | OAuth token, email address, display name | SCCs | United States |
Payments
| Vendor | Purpose | Data Processed | Transfer Mechanism | Data Location |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management | Payment card data, billing address, email | PCI-DSS compliant; SCCs | United States / EU |
Communications & Notifications
| Vendor | Purpose | Data Processed | Transfer Mechanism | Data Location |
|---|---|---|---|---|
| Mailjet SAS | Transactional and marketing email | Email address, name, subscription status | DPA + SCCs | EU (primary) |
Monitoring & Analytics
| Vendor | Purpose | Data Processed | Transfer Mechanism | Data Location |
|---|---|---|---|---|
| ipapi.co (Kloudend, Inc.) | IP-based geolocation for geographic compliance checks | IP address only (no storage) | SCCs | United States |
What We Do Not Share
MHLE does not share user data with:
- Advertising networks or data brokers.
- Social media platforms for tracking purposes.
- Any party for the purpose of training AI models on your personal content (see our Data & Training Policy).
FERPA / COPPA Applicability
Sub-processors that receive student data covered by FERPA or COPPA are contractually restricted from using that data for any purpose other than providing the contracted service. All AI provider agreements include a prohibition on training on school-official-designated student records.
Contact
For sub-processor questions, data-processing objections, or DPA requests, contact: privacy@mhle.com