Sub-processors

Hosting, database and authentication. Runs the database, user accounts and sign-in that the Service is built on.

• Data handled — Account details (email address, date of birth, state, guardian email where applicable), authentication credentials, subject selections, all study data and AI-generated study content, security and usage logs.
• Basis — Necessary to provide the Service you signed up for.
• Processing locations — Australia (Sydney region) for storage; limited support and operational access from overseas.
• Privacy policy — supabase.com/privacy

Web hosting and AI gateway. Serves the website, and routes AI requests to the AI models. Requests through the gateway are not used to train models.

• Data handled — Technical request data (IP address, device/browser information), and the text or images you submit to AI features while each request is processed.
• Basis — Necessary to provide the Service and the AI features you invoke.
• Processing locations — United States and European Union.
• Privacy policy — lovable.dev/privacy

AI models, optional sign-in, opt-in analytics, tutorial videos. Generates AI study content you request; signs you in if you choose Google; helps us understand site usage; hosts tutorial films.

• Data handled — AI features (all except practice questions from your notes): the text or images you submit, sent to Google's Gemini models via our AI gateway. Google sign-in (only if you choose it): your Google account email. Google Analytics 4 (only if you accept analytics cookies): IP address and site activity as aggregate events — never your name, email or answers. YouTube (only after you press play on a tutorial video): IP address and YouTube's own cookies.
• Basis — AI and sign-in: necessary to provide features you invoke. Analytics: your consent, withdrawable any time via “Cookie preferences” in the footer.
• Processing locations — United States.
• Privacy policy — policies.google.com/privacy

AI model for practice questions from your notes. Writes practice questions and model answers from your own notes when you ask for them.

• Data handled — The notes text you paste or pick, or the transcribed text of a page you photograph, while the request is processed. The gateway is told not to store the request.
• Basis — Necessary to provide the feature you invoke. Not used to train models.
• Processing locations — United States.
• Privacy policy — openai.com/policies/privacy-policy

Subscription billing. Processes subscription payments and manages billing.

• Data handled — Email address, subscription plan and status, and the payment card details you enter directly with Stripe — we never see or store full card numbers.
• Basis — Necessary to provide the paid subscription you purchase.
• Processing locations — United States and Ireland.
• Privacy policy — stripe.com/privacy

Our home page and About page carry a 7NEWS Melbourne news story in Facebook’s video player. Meta Platforms is not a sub-processor: it handles nothing on our behalf and receives nothing from your account. If you press play, your browser loads the player straight from Facebook, and Meta receives your IP address and device information and may set its own cookies, under Meta’s privacy policy. Until you press play, nothing is requested from Facebook.

If we add a sub-processor, or an existing one changes what it handles or where, we will update this page and notify account holders in advance as described in our Privacy Policy — including at least 30 days’ notice before your stored data moves to a different country. Questions about any provider on this list: contact@captivateexamhub.com.au.