Subprocessors
Last updated: August 15, 2026
IQ Apparatus uses the third-party service providers listed below to operate the platform. Each is bound by contractual confidentiality and data protection obligations, and each receives only the data needed for its stated purpose.
| Provider | Purpose | Data categories | Processing location |
|---|---|---|---|
| Supabase | Primary database, authentication, and file storage | Account, professional profile, activity progress, certificates, uploaded files | United States |
| Cloudflare | Application hosting, edge delivery, and DDoS protection | IP address, request metadata, session cookies | Global edge network |
| Stripe | Payment processing, subscriptions, and marketplace payouts to seller organizations | Name, email, billing details, transaction history | United States |
| Resend | Transactional and educational email delivery, including tenant-branded messages | Name, email address, message content | United States |
| Google AI Studio (Gemini) | AI-assisted authoring: content drafting, script generation, and image generation | Author-supplied prompts and source content submitted by administrators | United States |
| HeyGen | Rendering talking-avatar presenter videos from author-supplied scripts | Script text, selected avatar and voice identifiers, rendered video assets | United States |
| Zoom | Live webinar sessions and attendance records for live activities | Name, email, session join/leave times | United States |
| PostHog | Product analytics on how the platform is used | Pseudonymous user ID, page views, feature usage events, device and browser type | United States |
| Sentry | Error monitoring and, on errors only, session replay for debugging | Error details, page URLs (tokens removed), browser type, pseudonymous user ID | United States |
| Lovable | Application development platform and hosting management | Application logs and request metadata | European Union / United States |
Organization-specific providers
Organizations that publish activities on IQ Apparatus may connect additional services to their own tenant, such as a video conferencing provider for live events or their own payment account. Those providers are engaged by the organization, not by IQ Apparatus, and are governed by that organization's own agreements with its learners.
Changes to this list
We update this page when we add or remove a subprocessor. Organizations with a data processing agreement in place may request advance notice of changes by writing to privacy@iqapparatus.com.