Sub-processors

1. Supabase

Supabase, Inc. provides the Postgres database, the authentication service, and the file storage behind Underlayer. It holds everything the product stores: workspaces and their members, courses and their content, themes, the identities you provision, the progress and answers recorded against those identities, and issued certificates.

It also sends the sign-in link when an Authorized User signs in by email. Supabase is a processor acting on our instructions, under its own data processing agreement.

• Receives: everything above.
• Purpose: database, authentication, and storage — the infrastructure the Services run on.

2. Stripe

Stripe, Inc. processes subscription payments. Card details are entered on Stripe's own form and never reach our servers; we store a customer reference, a subscription reference, and the plan they resolve to.

Stripe receives a billing email address and the billing details a customer types into its form. It does not receive course content, learner identities, progress, or anything else about what a workspace has built.

• Receives: billing email address, payment details entered on Stripe's form, subscription and invoice records.
• Purpose: taking payment, issuing invoices, and managing subscriptions.

3. Resend

Resend delivers the transactional email the product sends on your instruction — a course-completion notice, a confirmation that somebody accepted a team invitation, and the test certificate you send yourself from the certificate designer.

It receives the recipient address and the contents of that message, which can include a learner's name and a course title where the message is about a completion.

• Receives: recipient email address and the contents of the message being sent.
• Purpose: delivering email you asked the product to send.

4. Anthropic

Anthropic, PBC generates course drafts. It receives only the brief and source material an author explicitly submits for generation, and the draft it returns. It never receives learner identities, progress, answers, or anything from a course it was not asked to write.

Your content is not used to train any model — see the AI section of the Privacy Policy, which states that commitment and how it is held in place.

• Receives: the brief and source material submitted for generation, and nothing else.
• Purpose: drafting course content on an author's explicit instruction.

5. What is not on this list

There is no analytics vendor, no advertising network, no session-recording tool, and no customer-data platform. Neither underlayer.outworx.io nor the embedded player sets an advertising or analytics cookie, and neither loads a third-party script.

One exception worth naming, because a blanket claim would be untrue: the demo course on this site contains an embed block pointing at a third-party map, so opening it loads that third party's page in a frame and lets it set its own cookies. That is the embed block doing exactly what it does for your learners when you point one at somebody else's page — not something we collect.

If that changes, this page changes with it, and Section 6 says what notice you get first.

6. Changes to this list

We will update this page before a new sub-processor begins processing personal data, and customers on a signed Data Processing Addendum can ask to be notified by email when it does. Where the DPA gives you a right to object to a new sub-processor, that right runs from the date this page changes.

Questions, or a request to be added to the notification list, go to privacy@underlayer.outworx.io.