Sub-processors
In short: limequiz uses a few providers to run the service. Supabase and Vercel handle participants' data. Anthropic receives the text of participants' sticky notes, without saying who wrote them, only when a presenter has them grouped by idea. Resend only sees presenters' data. This page is the list that the data processing agreement refers to.
| Provider | What it does for limequiz | Data it handles | Where | Safeguard for transfers |
|---|---|---|---|---|
| Supabase | Database and sign-in | Everything stored in limequiz: accounts, quizzes and, for rooms, participants' names and answers. Participants' phones connect to it directly for live updates, so its technical logs include network addresses. | Frankfurt, Germany. Support access and some backups can involve the United States. | EU Standard Contractual Clauses in Supabase's data processing agreement |
| Vercel | Web hosting and servers | Everything that passes through the site, including participants' requests, and technical logs (network address, browser) | Servers in Frankfurt, Germany. Its global network, and its account and log systems, can involve the United States. | EU-US Data Privacy Framework, and Standard Contractual Clauses |
| Anthropic | AI: generating quizzes, improving a question, sorting sticky notes by idea | What a presenter sends to generate a quiz or improve a question (topic, notes, PDF, the question). From participants, only the text of sticky notes, when the block has «Group by idea when shown» on (the default): the notes and the block's question, without saying who wrote them. Notes the presenter has hidden are not sent. Deleted by Anthropic after at most 30 days (longer only for content flagged for violating its usage policy). Not used for training. | United States only | Standard Contractual Clauses in the agreement with Anthropic Ireland |
| Resend | Email delivery: sign-in emails, and invitations to join a school's team | Presenters' email addresses and the emails we send them (sign-in codes and links; an invitation carries the school's and the inviter's names). No participant data. | United States | EU-US Data Privacy Framework, and Standard Contractual Clauses |
Google is not a sub-processor either. If you sign in with Google, Google is an independent controller of your Google account.
The companies behind each name, as in their data processing agreements: Supabase, Inc. (United States); Vercel Inc. (United States); Anthropic Ireland, Limited, which contracts with customers in the EU, with processing by Anthropic, PBC (United States); and Plus Five Five, Inc., which trades as Resend (United States).
Changes to this list
Before we add or replace a sub-processor that handles participants' data, we email the owner of each workspace and update this page. We give 30 days' notice. If you object on reasonable data protection grounds within that time, tell us. We then work with you on a solution, and if there is none, you may end the service and we will refund the unused part of any paid period.
Where to read the safeguards
Ask hello@limequiz.com for the current data processing agreements, transfer clauses and transfer impact assessments for these providers. See also the Privacy policy, section 5.