Sub-processors

Pathshala OS sub-processors

Effective date: May 25, 2026 · Pathshala Inc., Commonwealth of Virginia, USA

1. Overview

To deliver Pathshala OS, Pathshala Inc. relies on the third-party service providers listed below (each a “sub-processor”). Each entry includes the legal entity name, the purpose for which Pathshala uses that provider, the categories of personal data shared, and the geographic region where the provider stores or processes the data.

Every sub-processor is engaged under a written contract that obligates them to protect personal information on terms substantially similar to those in our Privacy Policy, MSA, and DPA.

We will give Institute owners thirty (30) days' advance email notice before adding or replacing a sub-processor. During that window an Institute may object, and if Pathshala cannot reasonably accommodate the objection the Institute may terminate the affected portion of the Service under the MSA.

2. Hosting & infrastructure

AWS

Amazon Web Services, Inc.

Hosting, compute (Lambda, ECS), database (DynamoDB, RDS), object storage (S3), CDN (CloudFront), DNS (Route 53), identity (Cognito), key management (KMS), monitoring (CloudWatch, GuardDuty), secrets (Secrets Manager).

Data categories: Account & profile, Customer Content, Usage & device, Communications metadata, Recording files
Region: United States (us-east-1, us-east-2)

Vendor site Vendor DPA / Privacy

Cloudflare, Inc.

Edge DNS for custom institute domains, DDoS protection, WAF, bot management, Turnstile CAPTCHA on public forms.

Data categories: Usage & device, IP address (transient)
Region: Global edge; logs in United States

Vendor site Vendor DPA / Privacy

3. Identity & authentication

AWS Cognito

Amazon Cognito (Amazon Web Services, Inc.)

User identity, password hashing, email/SMS verification codes, MFA, session token issuance, OAuth federation.

Data categories: Account & profile, Login security logs
Region: United States (us-east-1)

Vendor site Vendor DPA / Privacy

4. Payments & billing

Stripe, Inc.

Subscription billing, invoicing, payment processing, tax calculation, refunds, recording-overage metered billing. Stripe collects card data on its own pages; Pathshala does not store full card numbers (PCI delegation).

Data categories: Billing contact, Card last-4 + brand (display only), Stripe customer & subscription IDs, Invoice records
Region: United States (data may be processed globally)

Vendor site Vendor DPA / Privacy

5. Email & messaging

Amazon SES

Amazon Simple Email Service (Amazon Web Services, Inc.)

Transactional email delivery (login codes, billing notices, deletion confirmations, DSAR acknowledgements, support replies).

Data categories: Email address, Message content (transactional), Delivery metadata
Region: United States (us-east-1)

Vendor site Vendor DPA / Privacy

Google Workspace

Google LLC (Google Workspace)

Inbound mail handling for compliance aliases (privacy@, security@, abuse@, legal@, dpo@, accessibility@, support@), calendar, documents used by the internal team.

Data categories: Email correspondence
Region: United States / Global Google data centers

Vendor site Vendor DPA / Privacy

6. Live video & recordings

Daily.co

Daily Co.

Real-time video infrastructure for live tutoring sessions. Daily delivers the WebRTC media stack; Pathshala stores the resulting recordings in its own AWS S3 buckets.

Data categories: Session metadata (start/end, participants), Audio/video stream (transient), Recording files (handed off to AWS S3)
Region: United States (Daily edge servers globally)

Vendor site Vendor DPA / Privacy

7. AI & machine learning

OpenAI, L.L.C.

Model inference for the AI tutor-assist features in Pathshala OS. Pathshala calls OpenAI from its own backend (not from the browser) and uses the API tier where prompts and completions are NOT retained for model training (zero-retention setting + 30-day abuse-monitoring deletion).

Data categories: Prompt content (assignment text, lesson plan drafts), Pathshala-generated API request IDs
Region: United States

Vendor site Vendor DPA / Privacy

8. Support & scheduling

Cal.com, Inc.

Sales-inquiry and procurement scheduling embedded on the marketing site. Visitors who book a call provide their name/email to Cal.com directly.

Data categories: Name, Email, Scheduling preferences
Region: United States / EU (Cal.com Cloud)

Vendor site Vendor DPA / Privacy

9. Objections & questions

To object to a sub-processor, request our current data-processing documentation, or ask any question about this list, contact privacy@pathshala.co from the email on file for your Institute.

Contact

Pathshala Inc.

1240 Barksdale Dr NE, Leesburg, VA 20176, USA

Legal & data requests: admin@pathshala.co

General support: hello@pathshala.co · +1.571.999.1234