Data Controller
YourWeg (yourweg.com) is the Data Controller for all personal data processed through the platform. For data protection enquiries, contact us at [email protected].
All sub-processors listed below are engaged under Data Processing Agreements (DPAs) as required by GDPR Article 28. We will notify users of any material changes to this list.
Sub-processors
Supabase Inc.
Role: Database, user authentication, and file storage.
- Data shared: All user account data, academic profile, uploaded document files (transcripts, APS certificates, IELTS reports), and application data.
- Data location: India — Mumbai (ap-south-1 region). India does not hold an EU adequacy decision.
- Transfer safeguard: Standard Contractual Clauses (SCCs).
- DPA: supabase.com/dpa
Resend Inc.
Role: Transactional email delivery (account verification, deadline reminders, welcome emails).
- Data shared: User email address and display name.
- Data location: United States.
- Transfer safeguard: Standard Contractual Clauses (SCCs).
- DPA: resend.com/legal/dpa
PostHog Inc.
Role: Product analytics — page views and feature interaction events.
- Data shared: Anonymised usage events. No personally identifiable information is included in event properties. IP addresses are not forwarded. Only active when you have accepted analytics cookies.
- Data location: EU — Frankfurt (eu.i.posthog.com). No international transfer.
- Transfer safeguard: EU cloud — no cross-border transfer applies.
- DPA: posthog.com/dpa
Dodo Payments
Role: Subscription and payment processing.
- Data shared: User email address and display name (passed during checkout). Payment card details are handled exclusively by Dodo Payments and never stored by YourWeg.
- Data location: Refer to the Dodo Payments privacy policy for current data location details.
- Transfer safeguard: Standard Contractual Clauses (SCCs).
Vercel Inc.
Role: Website hosting, edge delivery, and build infrastructure.
- Data shared: Request metadata (IP address, URL, headers) processed transiently for routing and security. No persistent personal data is stored by Vercel beyond standard server logs.
- Data location: United States, with edge nodes globally.
- Transfer safeguard: Standard Contractual Clauses (SCCs) and EU–US Data Privacy Framework.
- DPA: vercel.com/legal/dpa
Google Ireland Limited
Role: Web and conversion measurement via Google Analytics 4 and/or Google Tag Manager when these tools are enabled for the site.
- Data shared: Online identifiers, device/browser data, and on-site behaviour (e.g. page views, events as configured in your tags). Only loaded after the user accepts analytics cookies.
- Data location: Google operates globally; measurement data may be processed in the United States and other regions per Google's settings and product terms.
- Transfer safeguard: Standard Contractual Clauses and Google's measurement processor terms as applicable.
- Privacy / terms: policies.google.com/privacy, Google controller–controller terms (where relevant).
International Transfers
Data processed by Supabase (India), Resend (US), Dodo Payments, Vercel (US), and Google (where Analytics / Tag Manager is used) may involve transfers outside the European Economic Area. India and the United States do not hold EU adequacy decisions for all processing. Transfers are safeguarded by Standard Contractual Clauses (SCCs) under GDPR Article 46(2)(c) and, where applicable, the EU–US Data Privacy Framework (e.g. Vercel, Google).
Changes to This List
We review our sub-processor list regularly. Where a change involves a new sub-processor or a material increase in the scope of data processing, we will provide notice via email (if you have an account) or by updating the "Last Updated" date on this page.
For questions, contact us at [email protected]. See also our Privacy Policy and Terms of Service.