Sub-processors
Last updated: 17 August 2026
These are the providers that process personal data on our behalf. Each is bound by a data processing agreement that permits processing only on our instructions and requires security measures at least as strong as our own. This list is part of our Privacy Policy and our Data Processing Addendum.
Current sub-processors
| Provider | What it does | What it receives | Where | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud / Firebase (Google Ireland Ltd) | Hosting, database (Firestore), authentication, file storage | Account data, lesson content, live-session data including student names | EU and United States | EU Standard Contractual Clauses; EU-US Data Privacy Framework |
| Google (Gemini API) | Generating lesson text, comprehension questions and synthetic speech | Lesson prompts and source transcripts you submit | EU and United States | Standard Contractual Clauses. Paid API traffic is not used to train Google models. |
| OpenAI, L.L.C. (Whisper) | Speech-to-text transcription of audio you upload or import | The audio file and its resulting transcript | United States | Standard Contractual Clauses. API data is not used to train OpenAI models by default. |
| Stripe Payments Europe, Ltd. | Subscription payments, invoicing and the billing portal | Email address, billing details, payment card data (collected by Stripe, never by us) | EU and United States | Standard Contractual Clauses; PCI-DSS Level 1 |
| Podcast Index | Searching podcast episodes when you build a lesson from a podcast | Your search terms only — no account data | United States | No personal data is transferred |
| Google Fonts | Serving the typefaces used by the interface | Your IP address and browser user-agent, as part of the font request | United States | EU-US Data Privacy Framework |
Notes on the AI providers
Google (Gemini) and OpenAI (Whisper)are used through their paid API tiers, whose terms state that content submitted via the API is not used to train their models. Gemini receives the prompts and transcripts behind a lesson; Whisper receives audio you upload or import, along with the transcript it produces. Neither receives your account credentials, your billing details, or a live-session student’s name.
Audio sent for transcription is held only for as long as the request takes; the temporary files our servers create are deleted once transcription completes.
Changes to this list
We will update this page before a new sub-processor starts handling personal data. Customers with a signed DPA may object to a new sub-processor on reasonable data-protection grounds within 30 days’ notice, as clause 7 of that document sets out. To be told about changes, email privacy@listeningnokidding.com and ask to be added to the notification list.