Subprocessors
Every third party that stores or processes data on Kuraplan's behalf. Each is bound by a data processing agreement or business terms. We give at least 30 days' notice before adding one that handles personal information.
Updated 16 September 2026
Database, authentication and file storage
All account data, created resources, uploads, authentication records
Uptime monitoring and the public status page
Public URLs, response times and status; no user data
Encrypted database backups (weekly, retained 90 days)
Full database backup, encrypted with a key Cloudflare does not hold
Serves OpenAI models for Kuraplan's AI features via Vercel AI Gateway under zero data retention
Prompts and outputs (names and contact details replaced by placeholders when Kuraplan Shield is on); not retained, not used for training
Fallback route for OpenAI models via Vercel AI Gateway when the primary route is unavailable (under 1% of calls)
Prompts and outputs on fallback calls; not used for training
Application hosting, API servers, firewall, request logs
All data in transit through the app and API, request logs
Routes AI requests to model providers with zero data retention
Prompts and generated outputs
AI model provider
Prompts and generated outputs
AI model provider, including image generation
Prompts and generated outputs
AI model provider (Gemini) and Google sign-in
Prompts and generated outputs; name and email for sign-in
Image generation models
Image prompts
Image and audio generation models
Image and audio prompts
Payments and subscription billing
Name, email, billing address, payment method (held by Stripe only)
Transactional email delivery
Email address, name, email content
Lifecycle and product email
Email address, name, country, subscription status, product usage totals. The account's saved AI instructions are currently included; being removed.
Product analytics and session replay
Account identifier, product usage events, device and browser information, session recordings with text inputs masked
Error monitoring
Error reports, which may include account identifier and request context
Customer relationship records for support and sales
Name, email, country, plan, usage totals
Internal operational alerts
Account identifier and email in support and billing alerts seen only by Kuraplan staff. Student first names currently appear in one activity alert; being removed.
Reads publicly available school websites to suggest colleagues to invite
Public school website content only; no account data is sent
Renders previews and PDFs of resources
Content of the resource being rendered
Web search used to research topics for resources
Search queries derived from the teacher's request
Image and video search for resources
Search queries derived from the teacher's request
Streams help videos inside the product
Viewer IP address and playback events; no account data
Embedded videos in resources and help
Viewer IP address and playback events when a video is played
Advertising measurement for kuraplan.com sign-ups
Hashed email, name and phone, IP address and browser identifiers for conversion events
Under review for removal from the product for school users.
Advertising measurement for kuraplan.com sign-ups
Hashed email and phone, IP address and browser identifiers for conversion events
Under review for removal from the product for school users.
Advertising measurement for kuraplan.com sign-ups
Hashed email, IP address and browser identifiers for conversion events
Under review for removal from the product for school users.
Session replay and heatmaps
Page interactions and session recordings with inputs masked
Under review for removal from the product.
Product analytics
Account identifier and product usage events
Prints and ships posters ordered from the kuraplan.com shop
Name, delivery address, order contents
Prints and ships books ordered from the kuraplan.com shop
Name, delivery address, order contents
Source code hosting
No user data