Subprocessors

Last updated: July 2026

This page lists categories of third parties that may receive personal data when you use VibeKoala. It supports transparency under Hong Kong PDPO notification expectations. It is not a substitute for executed data-processing or cross-border contractual clauses with each vendor (recommended before wide public launch).

Always or commonly used

• PostgreSQL host — stores account and classroom data. Privacy materials describe EU-hosted / OVH infrastructure when so configured.
• Stripe — payment processing for Tutor Pro and course packs (email, name, customer/subscription identifiers).
• Google — if you choose Google sign-in (name, email, profile image via OAuth).
• OpenRouter — AI inference and embeddings when selected or when platform-hosted inference is used (chat/prompts/material excerpts).

When you or your classroom enable them (often BYOK)

• Hugging Face / Poe — AI chat completions via your key.
• Pinecone — vector store for knowledge-base chunks and queries.
• ElevenLabs — text-to-speech for audio features.
• Flowise / Dify— only if a teacher or student configures an external chatbot endpoint (data goes to that URL's operator).

Not used on student-facing pages (current product)

We do not currently load third-party product analytics (for example PostHog or Google Analytics) on student-facing pages.

Related: Privacy Policy, Terms. Contact hello@vibekoala.ai.