Subprocessors
This is the new version 2.0, which takes effect on November 16, 2026. Until then, the current version applies. See every document that is changing.
Version 2.0 · Effective date: November 16, 2026 · Last updated: October 15, 2026
Havra LLC ("Havra", "we") operates Corvano. We use the service providers below to host and run Corvano. Each one is bound by written terms to protect personal information and use it to provide its service: a written agreement with us or, for the model hosts OpenRouter selects, OpenRouter's terms and the zero-retention requirement we set on every request. Stripe, Cloudflare and Google also use limited data for their own fraud prevention, security and service improvement, as their own privacy notices explain; for students who hold a school's Seat or have a School-managed Account, only Cloudflare receives any of this data, for the sign-in check, as the Student Data Privacy Agreement describes. This list is part of our Privacy Policy and of the Student Data Privacy Agreement we sign with schools.
1.Current subprocessors
| Company | What they do for us | What they receive | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Everything stored in an account, including uploaded files | United States |
| Vercel | Hosting, content delivery and running our servers | Every request to and from Corvano as it passes through, and request logs with IP address and browser details | United States, with a global delivery network |
| Stripe | Payments, subscriptions, receipts and invoices | The payer's name, email address and card or bank details (entered on Stripe's own checkout page), the Corvano account ID the plan belongs to, plan and offer details, the time zone used for a trial, and the random analytics browser identifier described in the Privacy Policy | United States |
| OpenRouter | Routing requests from Corvano's AI Features to AI model providers | The content an AI request needs (for example, your message, the cards or question involved, your answer, text from a file you upload, or photos you give the set writer). We never attach a name, email address or account ID; text a user types is sent as written. For generation, tutoring and second-stage content review requests we require providers that do not store the content or use it for training, and endpoints with zero data retention. | United States |
| AI model hosting providers selected by OpenRouter (today, providers hosting DeepSeek models) | Running the AI model that writes the answer | The content OpenRouter forwards for generation, tutoring and second-stage content review requests, only through endpoints with zero data retention | United States and other countries |
| TypeSafe (its Jev decision models, reached through OpenRouter) | Automated checks: choosing how the tutor answers, deciding whether a written answer can be marked without further review, whether a card needs a picture, which parts of a document matter for a study guide, and the first screen of sets for content that may break our rules | The text a check needs: a student's message to a tutor (up to 1,500 characters) and the tutor's last reply, the card or set text involved (including a whole set for a moderation check), answers and document excerpts. We never attach a name, email address or account ID. These requests are not covered by the zero-retention setting above. For students with a Seat from a school or a School-managed Account, we send text only under written terms that bar TypeSafe from keeping it or training on it; where those terms aren't in place, those checks don't use that text. | Not yet confirmed; we will update this page when TypeSafe confirms it |
| Resend | Delivering email: account emails, trial and renewal reminders, partner program emails and invitations | Recipient email address and the email's content | United States |
| Twilio | Sending sign-in codes by text message, for people who sign in with a phone number | Phone numbers and the text sent to them | United States |
| Cloudflare (Turnstile) | A check that tells people from automated programs on the sign-in, sign-up, password-reset and partner application forms | IP address and browser details while the check runs | United States, with a global network |
| Google Analytics (through Firebase), free-plan ads (AdSense and Ad Manager), Google's consent message in the European Economic Area, the United Kingdom and Switzerland, and Google sign-in where offered | As the Privacy Policy describes in its Ads and Analytics sections. Never used for analytics or ads for students who hold a Seat from a school or have a School-managed Account; for those students Google learns only that a student chose Google sign-in, where it is offered. | United States and other countries | |
| Zoho Mail (Zoho Corporation) | Hosting the legal@, support@ and partners@corvano.app inboxes | Whatever people send to those addresses | United States |
2.Other services we use
- PubChem (US National Library of Medicine): when a study tool shows a molecule, we look up the compound's name or structure. Nothing about you is sent.
- Apple: if you use Sign in with Apple in a Corvano app, Apple confirms your identity under its own privacy policy and shares the sign-in details described in the Privacy Policy (section 3.1). Apple is an identity service you choose, not our subprocessor.
- Quizlet: if you ask Corvano to import a set from a quizlet.com link, our server requests that page. Quizlet sees a request from Corvano's server, not from you, and the link you pasted.
3.Changes
We update this page before a new subprocessor starts receiving personal information. OpenRouter chooses among hosts of the models we use that meet our zero-retention requirement, in the United States or other countries; a host it selects within those limits is not listed separately, but we give notice before we replace OpenRouter or add a new AI model company. Schools that have signed our Student Data Privacy Agreement also get at least 30 days' notice by email before a new subprocessor receives student data, as that agreement explains.
4.Contact
Questions about this list: legal@corvano.app (or partners@corvano.app for schools and tutoring companies).
Havra LLC · legal@corvano.app
Corvano Prep is a product developed by HAVRA LLC.