HanziTales — Subprocessors
Effective date: 22 September 2026 Last updated: 30 October 2026
These are the third parties that process personal information on behalf of Rifta Studio LLC in order to run HanziTales. Each is bound by a written contract limiting it to our instructions, imposing confidentiality and security obligations, and — for transfers out of the EEA, UK or Switzerland — incorporating the European Commission's Standard Contractual Clauses and the UK Addendum, or relying on the provider's certification under the EU–US Data Privacy Framework where it holds one.
Apple, Google (as an app store) and Stripe with its Link service (as the seller of web purchases) are listed separately at the end of this page: they receive personal information from us or from you, but act as independent controllers under their own terms, not on our instructions.
This list forms part of the Privacy Policy.
Infrastructure
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, server-side functions — the core backend | Account, learning data, books and private texts, audio files, purchase records, server logs; the photos for a private text pass through its server functions on their way to Anthropic and are not stored | United States |
| Amazon Web Services, Inc. | Cloud infrastructure underlying Supabase (compute, storage, backups), and storage of our own encrypted off-site backups, kept up to 30 days | As above | United States |
| Vercel Inc. | Hosts the website and the web app; works out a visit's approximate location (country, state or region, city) from its IP address for our visit counts; counts page views without cookies (Web Analytics) | IP address and request metadata; we receive only the approximate location and page-view counts | United States |
| GitHub, Inc. | Runs the nightly job that makes the off-site backups; data passes through and is encrypted before it is stored | Database and file contents, in transit only | United States |
Artificial intelligence and speech
These providers receive the content being generated or translated — prompts, text, vocabulary constraints, and the photos you choose for a private text — but not your name, email or account identifier.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Anthropic, PBC (Claude) | Story, chapter, plot, character and annotation generation; reading the Chinese text in the photos you choose for a private text | Prompt and text content; the photos of a private text | United States |
| OpenAI, L.L.C. | Word and character translation, some generation and title tasks | Prompt and text content | United States |
| Together AI, Inc. (Qwen models) | Some generation and translation tasks | Prompt and text content | United States |
| Google LLC — Cloud Text-to-Speech | Converting Chinese text into speech audio | Text to be spoken, chosen voice | United States |
All four are used under API or business terms providing that submitted content is not used to train their models and is retained only briefly, if at all, for abuse monitoring.
Payments and subscriptions
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| RevenueCat, Inc. | Subscription and purchase state across platforms, entitlement webhooks | Account identifier, purchase and subscription events, product identifiers, store receipts | United States |
Communications
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Resend, Inc. | Sends the account emails from Supabase Auth: email confirmation, password resets, sign-in links | Email address, message content | United States |
Independent recipients (not subprocessors)
These parties receive personal information in connection with purchases, but decide for themselves how to use it, under their own terms and privacy policies. They are not bound to our instructions.
| Recipient | Role | Data | Location |
|---|---|---|---|
| Apple Inc. | App distribution and in-app purchases; merchant of record for iOS/macOS purchases | Purchase and subscription data, under Apple's own privacy policy | United States and global |
| Google LLC (Google Play) | App distribution and in-app purchases; merchant of record for Android purchases | Purchase and subscription data, under Google's own privacy policy | United States and global |
| Stripe, Inc. and its Link service | Merchant of record for purchases made on the web ("Sold through Link"): payment processing, sales tax, VAT and GST, receipts, refunds and payment support | Payment details, billing address, email and purchase data, which Stripe and Link handle as controllers under their own privacy policies; we never receive card numbers | United States and global |
These ad networks receive reports when someone who arrived from one of their ads signs up, reads a first chapter or buys (Privacy Policy, section 5.1). They, too, decide for themselves how to use them.
| Recipient | Role | Data | Location |
|---|---|---|---|
| Google LLC (Google Ads) | Ad network; measures and optimises our ads | Ad click identifier, the event, its time, a purchase's price, our reference number | United States and global |
| Meta Platforms, Inc. | Ad network for Facebook and Instagram ads; measures and optimises our ads | As above | United States and global |
| Microsoft Corporation (Microsoft Advertising) | Ad network for Bing ads; measures and optimises our ads | As above | United States and global |
Changes to this list
We will update this page before, or as soon as reasonably practicable after, a new subprocessor begins processing personal information. Schools and other organisational customers who ask to be notified of changes in advance will receive notice by email under the School and Educator Addendum; to subscribe, write to support@hanzitales.com with the subject "Subprocessor notifications".