Legal
Subprocessors
Last updated: May 8, 2026
A “subprocessor” is a third-party provider we use to operate Passd. Each subprocessor receives only the personal data necessary to perform its function. This list is the authoritative record; we update it when the set of providers changes.
For categories only, see our Privacy Policy. For questions, email support@passd.io.
| Subprocessor | Category | Data involved | Region |
|---|---|---|---|
| Stripe | Payments | Email, billing address, payment method (tokenized), customer ID, subscription status. | Global |
| Supabase | Database & auth | Email, user ID, practice data, profile data, session cookies. | US |
| Vercel | Hosting & delivery | IP address, request logs, usage telemetry. | Global |
| Anthropic | AI model inference | User-submitted text and contextual signals passed to the model to generate a response. | US |
| OpenAI | Voice synthesis, transcription & Voice Tutor sessions | Text content being synthesized into speech, audio sent for transcription, and audio plus text exchanged during Voice Tutor speech-to-speech sessions. No billing or identity data. | US |
| Resend | Transactional email | Email address, email body, send metadata. | US |
| Inngest | Background jobs | User ID and aggregated data scoped to the scheduled task. | US |
| Upstash | Rate limiting | User ID or IP address, request timestamps. | Global |
Changes
We update this list within 30 days of adding or removing a subprocessor. Material changes are also noted in our Privacy Policy, which is versioned with a last-updated date.