Providers & Subprocessors

7.1 Important classification principle

Not every third party used by StriideAi is a subprocessor.

Depending on the service, a provider may act as:

• processor/subprocessor;
• independent controller;
• platform provider;
• payment provider;
• mixed-role provider.

7.2 Provider register

Provider	StriideAi use	Proposed role	Public / contractual position
Amazon Web Services (AWS)	ECS, RDS, S3, CloudFront, ElastiCache, Lambda, backups	Processor	Include in formal subprocessor schedule
Google Cloud	Gemma-based AI video analysis in StriideAi's own enterprise project	Processor	Included in subprocessor schedule; footage not used for model training
OpenAI	AI recommendations, embeddings and approved AI functions	Processor for StriideAi API processing	Include in formal subprocessor schedule; retain DPA/transfer evidence
Sentry	Error/crash/APM monitoring	Processor	Include in subprocessor schedule; PII minimisation required
Resend	Transactional email	Processor	Include in subprocessor schedule
Slack	Internal operational alerts	Processor where personal data is transmitted	Minimise personal data; include only where relevant
Stripe	Payments, subscriptions, coach payouts	Processor and/or independent controller depending on activity	Explain dual role; do not simply classify as subprocessor
Apple	App Store billing, Sign in with Apple	Generally independent controller for Apple's own platform processing; role varies by activity	Public provider disclosure, not automatically a StriideAi subprocessor
Google	Google Play billing, Google Sign-In	Generally independent controller for platform/account processing; service-specific role	Public provider disclosure
YouTube / Google	Video playback and metadata	Service-specific Google role	Public provider disclosure
Meta / Facebook	Facebook Login	Likely separate/independent controller for Meta platform processing	Public provider disclosure

7.3 Initial formal subprocessor schedule

The StriideAi School DPA subprocessor schedule should initially include clearly instruction-based processors such as:

• AWS;
• Google Cloud;
• OpenAI;
• Sentry;
• Resend;
• other future operational vendors only after review.

Apple, Google, Meta and Stripe should not automatically be listed as subprocessors where their actual legal role differs.

7.4 Provider review process

Before introducing any new SDK/API/provider, StriideAi should:

1. identify the data involved;
2. define purpose;
3. classify the provider's legal role;
4. conduct security/privacy due diligence;
5. confirm hosting/processing location;
6. confirm retention;
7. execute required contractual terms;
8. assess international transfers;
9. update the provider register;
10. update the DPIA/privacy information where necessary.

---