Legal
Sub-processors
Effective date: May 2026
OrderToAI LLC (operating as Diraasa) engages the third party service providers listed below to operate the platform. Each is contractually bound by a Data Processing Addendum (or equivalent) to use personal information only as Diraasa directs and to apply appropriate security. This list is updated whenever a sub-processor is added, removed, or replaced. Material changes are emailed to users at least 30 days in advance.
Current sub-processors
| Provider | Purpose | Personal information shared | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, identity verification, payouts (Stripe Connect) | Card details, identity documents, bank account, name, email, country | United States, with EU SCCs in place |
| Wise Payments Limited | International teacher payouts (countries outside Stripe Connect’s supported list) | Teacher full name, bank account number or IBAN, IFSC or SWIFT / BIC, country, currency, transfer amount | United Kingdom (FCA-regulated), with UK-IDTA / EU SCCs in place |
| Daily.co | Video classroom | Display name, session token, IP address | United States |
| Deepgram, Inc. | Real time audio transcription | Class audio (not retained by Deepgram), session metadata | United States |
| Pusher | Real time messaging events | Event metadata, channel identifiers | United States, United Kingdom |
| Neon Inc. | Managed PostgreSQL database hosting | All platform data at rest | United States or European Union |
| Upstash Inc. | Managed Redis cache and rate limiting | Session tokens (hashed), counters, transient cache | United States or European Union |
| Meilisearch SAS | Search indexing for teacher profiles and content | Public profile data only | European Union |
| Microsoft Azure (Speaker Recognition) | Voice consistency checks for teachers | Voice comparison scores only (no voiceprints retained by Diraasa) | United States or European Union |
| Resend, Inc. | Transactional email delivery | Email address, name, message content | United States |
| Google LLC (Google Cloud Platform) | Application hosting (Cloud Run, Load Balancing, Artifact Registry, Secret Manager) | All HTTP traffic, IP addresses, container logs | Region selected per environment (US or EU) |
| Cloudflare, Inc. | Content delivery and DDoS protection | IP addresses, request metadata | Global edge network |
| PostHog, Inc. | Product analytics (only with user consent) | Session replays (with PII masking), event data | United States or European Union |
| Sentry | Error monitoring | Error stack traces, request metadata, user ID | United States |
Notes
- Stripe Identity stores verification documents on Stripe’s servers. Diraasa does not store the document images.
- Wise Payments Limited receives only the data required to execute a transfer (teacher full name, bank account number or IBAN, IFSC or SWIFT / BIC, country, currency, transfer amount). Wise-rail bank details are also stored on Diraasa servers, encrypted at rest with AES-256-GCM, so that subsequent payouts can be initiated without re-collection.
- Deepgram processes audio in real time and does not retain the audio under our contract. Only the resulting transcript is retained, on Diraasa servers.
- Daily.co does not record video. Audio passes through Daily.co briefly to be transcribed.
- For each sub-processor that hosts data outside the user’s region, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable) or another approved transfer mechanism.
Notification of changes
When we add, remove, or replace a sub-processor, we update this page and email all account holders at least 30 days in advance, except for replacements made urgently for security or continuity reasons.
Contact
Questions about sub-processors: info@diraasa.com.