Legal
Last updated: 2026-08-30. Every company that processes personal data on behalf of Miatz, under contract and on our instruction. Miatz Private Limited is the controller; each company below is a processor, and none of them is permitted to use your data for its own purposes.
This register is the operative list. The privacy policy describes the same arrangement in prose, and the data processing agreement is what an organization signs on top of it. Where the three could ever disagree about who a vendor is or what it does, this page is the one kept current.
Engaged for every account. The platform does not run without them.
| Subprocessor | Contracting entity | What it does | Established in | Where the data sits |
|---|---|---|---|---|
| Supabase | Supabase, Inc. | Database, authentication and file storage — the primary store of account, learning and assessment data. | United States | India — ap-south-1 (Mumbai) |
| Vercel | Vercel, Inc. | Application hosting, server-side compute and the edge cache that serves public pages. | United States | India — bom1 (Mumbai) for server compute; the edge cache holds published page content, not personal data. |
| Resend | Resend, Inc. | Transactional and reminder email — account, security and program messages. | United States | The vendor's own footprint — not pinned by miatz. |
| Slack | Slack Technologies, LLC (Salesforce, Inc.) | Internal staff notifications about program events; a message may name the learner it concerns. | United States | The vendor's own footprint — not pinned by miatz. |
Receives the prompt, answer or conversation turn you submit, and the context needed to answer it — nothing more of your record. Every row below NVIDIA runs only against a key you or your organization brought.
| Subprocessor | Contracting entity | What it does | Established in | Where the data sits |
|---|---|---|---|---|
| NVIDIA NIM | NVIDIA Corporation | Default AI inference for the tutor and AI grading — receives the prompt, answer or conversation turn submitted, and the context needed to answer it. | United States | The vendor's own footprint — not pinned by miatz. |
| Groq | Groq, Inc. | AI inference, when you bring your own Groq key. | United States | The vendor's own footprint — not pinned by miatz. |
| Google AI Studio | Google LLC | AI inference, when you bring your own Google AI Studio key. | United States | The vendor's own footprint — not pinned by miatz. |
| OpenRouter | OpenRouter, Inc. | AI inference routed to the model you select, when you bring your own OpenRouter key. | United States | The vendor's own footprint — not pinned by miatz. |
| Cerebras | Cerebras Systems Inc. | AI inference, when you bring your own Cerebras key. | United States | The vendor's own footprint — not pinned by miatz. |
| Together AI | Together Computer, Inc. | AI inference, when you bring your own Together key. | United States | The vendor's own footprint — not pinned by miatz. |
| Mistral | Mistral AI SAS | AI inference, when you bring your own Mistral key. | France | The vendor's own footprint — not pinned by miatz. |
| GitHub Models | GitHub, Inc. (Microsoft Corporation) | AI inference, when you bring your own GitHub token. | United States | The vendor's own footprint — not pinned by miatz. |
A sign-in method, a connected calendar, mobile push, or a lesson video you play. Turning the feature off ends the transfer.
| Subprocessor | Contracting entity | What it does | Established in | Where the data sits |
|---|---|---|---|---|
| Google LLC | Google sign-in, Google Calendar when connected, Firebase Cloud Messaging for Android push, and privacy-enhanced YouTube embeds when a lesson video is played. | United States | The vendor's own footprint — not pinned by miatz. | |
| Apple | Apple Inc. | Sign in with Apple, and the Apple Push Notification service for iOS push. | United States | The vendor's own footprint — not pinned by miatz. |
| Microsoft | Microsoft Corporation | Microsoft sign-in, and Microsoft Calendar when connected. | United States | The vendor's own footprint — not pinned by miatz. |
| GitHub | GitHub, Inc. (Microsoft Corporation) | GitHub sign-in, and the repository bridge an organization installs to mirror its own bug reports as issues. | United States | The vendor's own footprint — not pinned by miatz. |
Before a new subprocessor starts processing personal data, we publish it here and give organizations with an active agreement at least 30 days’ written notice by email to their administrator contact. Removing a subprocessor needs no notice, and takes effect here on the day it stops.
An organization that objects to a new subprocessor may tell us within the notice period. We will work to offer a way to run without it; where that is not possible, the organization may terminate the affected service without penalty for the unused remainder of its term. To be on the notice list, email hello@miatz.com.
Account, learning and assessment data is stored in India. The vendors above that are established elsewhere receive only what their function needs — the text of a notification, the address on an email, the prompt sent for an answer. The privacy policy sets out each category and the transfer mechanism we rely on for it.
Email hello@miatz.com, or write to the Grievance Officer if you are making a formal complaint.