Subprocessors and third-party services
Cocovox uses carefully selected third-party service providers ("subprocessors") to deliver our educational platform. This page provides complete transparency about who processes student data, why, and how it's protected.
What are subprocessors?
Subprocessors are third-party companies that process data on behalf of Cocovox to provide specific services. We carefully vet all subprocessors to ensure they meet our strict privacy and security standards, especially for children's data under COPPA and FERPA.
Processor Registry
This table is generated from the repo-managed processor registry used for diligence and public disclosures.
| Processor | Purpose | Data sent | Retention | DPA status |
|---|---|---|---|---|
| Anthropic(opens in a new tab) | Primary conversational AI for tutoring, explanations, and adaptive responses | Learner prompts, model instructions, and structured learning context. Direct identifiers are reduced where the application flow allows, but message content can still contain learner-provided information. | Anthropic can keep API data under its own terms, tracked outside the repo. Cocovox keeps each chat until it is deleted, and the tutor's copy of each message, cut to its first 500 characters, until the account is deleted. | Tracked outside the repo |
| ElevenLabs(opens in a new tab) | Speech-to-text and text-to-speech processing | Microphone audio from voice features, audio files people upload (chat attachments and documents), and text to be read aloud. Cocovox saves the transcripts and notes made from them. | ElevenLabs can keep a copy of the audio under its own terms. Cocovox does not save uploaded audio files. It holds a live voice session's audio for up to three hours while it is transcribed. Transcripts stay in the student's records. | Tracked outside the repo |
| DigitalOcean(opens in a new tab) | Application, database, and storage hosting | Primary platform hosting for stored learner and parent data. | Data persists according to Cocovox retention rules until deleted or aged out. | Tracked outside the repo |
| SendGrid(opens in a new tab) | Transactional email delivery for verification and parent notices | Parent, teacher, and account-holder contact details plus message content needed to deliver notices. | Delivery logs retained under provider settings and Cocovox operational needs. | Tracked outside the repo |
| Sentry(opens in a new tab) | Crash and error reporting, so we find out when something breaks for a learner instead of waiting to be told | Error events plus the technical trail around them: the page address, recent in-app network calls and their status codes (request URLs can contain resource identifiers), console error text written by Cocovox developers, and the Cocovox account ID via Sentry.setUser. sendDefaultPii is false, so no identity is attached automatically — but that setting does not sanitise strings our own code logs, which is a discipline control, not a technical guarantee. Session replays attach on error with maskAllText and blockAllMedia; 2% of performance traces are sampled. | Held by Sentry under our account's retention settings; Cocovox keeps no separate copy. Settings and the signed agreement are tracked outside the repo. | Not established in repo |
| Stripe(opens in a new tab) | Credit-card verification for verifiable parental consent | Parent verification requests use Stripe payment method details for low-value authorization and identity verification. | Verification artifacts retained according to Cocovox audit needs and Stripe account settings. | Tracked outside the repo |
| ARASAAC(opens in a new tab) | AAC pictogram (symbol) image delivery for the communication keyboard and literacy cards | Symbol images are loaded straight from ARASAAC's image host, so ARASAAC receives the viewer's IP address and the pictogram id being requested. No account details, names, or learning data are sent. This is a child-facing path: a nonspeaking learner tapping symbols on the keyboard triggers these requests. | Whatever ARASAAC's own web server logs retain. Cocovox stores nothing on ARASAAC and sends them no records. | None — public CC BY-NC-SA pictogram library, not a contracted processor |
| Google OAuth(opens in a new tab) | Optional sign-in and identity federation | Only account identity fields needed for optional OAuth login. | Identity data persists with the Cocovox account until deleted. | Tracked outside the repo |
AI service providers
These companies power our AI tutoring features:
Anthropic (Claude AI)
Primary AI| Purpose | Primary conversational AI for tutoring interactions |
|---|---|
| Data Shared | User messages, prompts, and chat context |
| Data Retention | Anthropic can keep what we send under its own terms. Those terms say it may not use it to train its AI. Cocovox keeps each chat until it is deleted. The tutor also keeps its own copy of each message, cut to the first 500 characters, until the account is deleted. |
| Location | United States |
| Designed for COPPA | Yes (with parental consent for under 13) |
| Privacy Policy | anthropic.com/privacy(opens in a new tab) |
ElevenLabs
Audio| Purpose | Speech-to-text transcription, and text-to-speech voice synthesis |
|---|---|
| Data Shared | Microphone audio, and the text we want read aloud. Voice features send the recording exactly as the microphone captured it, including other voices in the room. |
| Data Retention | ElevenLabs can keep a copy of the audio under its own terms. Cocovox holds the recording only while it is being transcribed, up to three hours for a long session. The transcript stays in the student's records. |
| Location | United States |
| Children's Data | A child's voice is personal data, and ElevenLabs receives it. Voice features send a child's microphone audio, and the voice of anyone else speaking nearby, to be turned into text. A parent or guardian must approve voice features before a child under 13 can use them. |
| Privacy Policy | elevenlabs.io/privacy(opens in a new tab) |
Infrastructure and hosting
Services that host and secure our platform:
DigitalOcean
Hosting| Purpose | Cloud infrastructure hosting for application servers and database |
|---|---|
| Data Stored | All user data, including accounts, messages, and learning progress |
| Location | United States (configurable by region) |
| Security | SOC 2 Type II certified, encrypted at rest and in transit |
| Privacy Policy | digitalocean.com/legal/privacy-policy(opens in a new tab) |
Authentication services
Optional third-party login providers:
Google OAuth
Optional| Purpose | Optional "Sign in with Google" authentication |
|---|---|
| Data Shared | Email address, name, profile picture (if you choose to use Google sign-in) |
| Location | United States |
| Note | This is entirely optional - users can create accounts with email/password instead |
| Privacy Policy | policies.google.com/privacy(opens in a new tab) |
Email services
Services used to deliver our email:
SendGrid (Twilio)
Email Delivery| Purpose | Email delivery for account verification, parental consent requests, notifications, weekly digests, and our newsletter |
|---|---|
| Data Shared | Email addresses, recipient names (within email content) |
| Data Retention | Email logs retained for 30 days per Twilio's data retention policy |
| Location | United States |
| Designed for COPPA | Yes — handles email addresses for consent requests, account and progress email, and our newsletter (only for people who sign up) |
| Privacy Policy | twilio.com/legal/privacy(opens in a new tab) |
Error reporting
One service helps us notice when the app breaks:
Sentry
Error Reporting| Purpose | Tells us when the app breaks, so we can fix it instead of waiting for someone to report it |
|---|---|
| Data Shared | What broke. Which page it happened on. Which parts of the app were being called just before. And a code number for the account signed in — we do not attach a name or an email to it. We also send a short replay of the seconds before the error. Before it leaves the device, every word on the screen is covered by a grey block. Every picture and video is removed. So the replay shows where someone clicked. Not what they wrote, or what they were looking at. One honest caveat. An error message written by our own developers could mention something it should not. We treat that as a bug and fix it. We would rather name that risk than promise it can never happen. |
| Data Retention | Sentry deletes these reports on a schedule set by our plan with them. We cannot promise you an exact number of days here yet, and we would rather say so than guess. Cocovox keeps no copy of its own. |
| Location | United States |
| Children's Data | A child's session is handled exactly the same way. There is no path in Cocovox that sends a child's voice recording to Sentry, and the replay masking covers what they write and draw. |
| Note | We use this only to find and fix problems. We do not use it to learn about your child, to sell anything, or to follow anyone around other websites. We pass none of it on. Sentry is its own company, with its own suppliers. What happens on their side is covered by their privacy policy, linked below. Any questions, email us at support@cocovox.ai. |
| Privacy Policy | sentry.io/privacy(opens in a new tab) |
What we DON'T use
For transparency, here are common third-party services we explicitly do not use:
- ❌ Advertising networks (Google Ads, Facebook Pixel, etc.)
- ❌ Data brokers or marketing companies
- ❌ Trackers that follow your child around the internet, or measure them for an audience. We use none. The counting we do is our own, and our Privacy Policy explains it.
- ❌ Social media tracking pixels
- ❌ A separate email-marketing platform. Our newsletter goes only to people who sign up for it, and it is sent through SendGrid like the rest of our email.
- ❌ Cross-site tracking or behavioral advertising tools
One thing to be straight about. Some of these companies get something the moment a page loads, without you or your child choosing it. Sentry is one, each time the app breaks — what it gets, and what it never gets, is under Error Reporting above. Others send the fonts, pictures and map tiles a page needs. We are still writing those up properly, and we would rather tell you that than leave it out.
Updates to this list
We will update this page whenever we add, remove, or change subprocessors. Significant changes will be communicated via email to account holders.
If you have questions about our subprocessors or data processing, please contact us at support@cocovox.ai
