Sub-processors
Last updated: 3 September 2026
STUDIA DI RENZO IVAN DIAZ DELGADO uses the third-party providers below to deliver its two products — the one-to-one coaching service and the Ascentiq standalone subscription. Each acts only as a processor, on the controller’s instructions, under a written data-processing agreement meeting Article 28 GDPR (in place, or being finalised where a provider requires a separate signature). The "applies to" column shows which users a provider processes data for. ascentiq-core, the service that generates practice exercises (ascentiq-core-api.onrender.com, hosted on Render), is not listed: it works from non-personal parameters — a topic, a difficulty and a numeric seed — and processes no personal data.
How we tell you about changes
The provider list is kept current. Where a change to it affects enrolled families or Ascentiq subscribers, we give at least 30 days’ notice by email before a new provider starts processing data, so there is time to raise a concern.
Current providers
| Provider | What it does | Data it sees | Where | Transfer safeguard | Applies to | Agreement |
|---|---|---|---|---|---|---|
| Zoom Video Communications, Inc. | Runs the live lesson; records the audio and video, generates the transcript, hosts the recording, and can provide a share link to it. | Student name and email, the meeting join link, the lesson audio and video, the recording, and the transcript. | EU (EEA data residency) | Within the EEA | 1:1 tutoring only | Open |
| Make (Celonis a.s.) | Automation layer: runs the handwriting-recognition (OCR) step for practice submissions. | Handwriting images (in transit). | EU (Prague) | Within the EEA | The Ascentiq platform | Open |
| Supabase, Inc. | Application database, sign-in and file storage. | All service data: profile and guardian contact, date of birth, academic details, lesson recordings and transcripts, AI study notes, practice attempts, handwriting images, chat messages and billing metadata. | EU (Ireland) | Within the EEA | The Ascentiq platform | Open |
| OpenAI, L.L.C. | Generates the study notes from a lesson transcript, grades practice work, powers the AI tutor, reads handwriting, and produces illustrations and audio. | Lesson transcript, pseudonymised — speakers are labelled Tutor / Student, not by name; practice answers and handwriting images; chat messages. | United States | Standard Contractual Clauses | The Ascentiq platform | Open |
| Groq UK Limited | Language model for the AI study coach. Not used to train or fine-tune Groq’s models. | Progress summary, error patterns, recent lesson summaries and study-coach messages. | United States | Standard Contractual Clauses | The Ascentiq platform | Open |
| Stripe, Inc. | Subscription billing and invoicing. | Payer name, email, billing address and codice fiscale. Card details are held by Stripe only. | United States / Ireland | Standard Contractual Clauses | The Ascentiq platform | Open |
| Excalidraw s.r.o. | Shared lesson whiteboard. | The lesson and topic titles. The board is shared by a guest link; joiners are not named on it. | EU (Czech Republic) | Within the EEA | 1:1 tutoring only | Open |
| Vercel, Inc. | Hosting and content delivery for both websites. | HTTP request data, IP address and coarse traffic statistics. | United States (EEA edge locations preferred) | Standard Contractual Clauses | Both | Open |
| Functional Software, Inc. (Sentry) | Error monitoring, including a replay of the screen when an error occurs. | Error traces, browser data and a user ID; an error replay can capture on-screen text, which may include names, student work or transcript text. | EU | Within the EEA | The Ascentiq platform | Open |
| Google Ireland Ltd — Google Analytics 4 | Aggregate website usage statistics on renzo-diaz.com, loaded only with consent. | Pseudonymous usage events and a truncated IP address; event and user data retention set to 2 months (the minimum). | EU / United States | Standard Contractual Clauses; consent-gated | The renzo-diaz.com website | Open |
| Typeform S.L. | The IGCSE and IB DP application forms on renzo-diaz.com. | The applicant’s and student’s name and email and the academic background entered in the form. | EU (Spain) | Within the EEA | The renzo-diaz.com website | Open |
International transfers
Providers marked "Standard Contractual Clauses" operate, in whole or in part, in the United States, which is not the subject of an EU adequacy decision. Those transfers rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) together with supplementary measures assessed in line with EDPB Recommendations 01/2020. A copy of the Clauses is available from privacy@renzo-diaz.com. The lesson, its recording, its transcript and its storage stay with providers inside the EEA.
Sign-in with Google
Sign-in to the Ascentiq platform uses Google. In that flow Google acts as an independent controller for the Google Account and the authentication data it handles under its own terms — it is not a processor acting only on our instructions, so it is not in the table above. What reaches us is your name, email address and basic profile information, used only to create and secure your account (Article 6(1)(b) GDPR). The authentication infrastructure on our side is Supabase, listed above.
How to contact us
Questions about this register, or about how a particular provider is used, go to privacy@renzo-diaz.com; formal notices to the certified email (PEC) renzodiaz@postecert.it.