OLAR AI (app.olar.ai)
Last updated: October 26, 2026
9 sub-processors
This page lists the third-party providers OLAR AI uses to process personal data in delivering its services at app.olar.ai. For each provider, it describes the processing, the personal data involved and where that data is stored.
Where OLAR AI processes data on behalf of an institutional customer, providers acting on our behalf are sub-processors under the applicable agreement. Some providers also act as independent controllers for particular activities.
Vendors that only handle OLAR AI’s internal corporate data are not included, nor are integrations that are disabled or removed from the service.
Description of processing
Authentication, database hosting, file storage and backend processing.
Data categories used
Account and profile information, authentication records, uploaded images, handwritten work, problem statements, learning activity, AI-generated feedback and operational logs.
Categories of data subjects
Learners and account holders, and people whose personal information is included in submitted content.
Where data is stored
United States — Northern California (us-west-1) for the primary database, authentication service, storage objects and backups. Supabase stores platform logs in European Union data centres. Edge processing, content delivery and authorised support access may occur outside the primary region.
How to contact privacy
Description of processing
Website and application hosting, content delivery and request routing.
Data categories used
IP addresses, request metadata, browser and device information, and hosting and diagnostic logs.
Categories of data subjects
Website visitors and application users.
Where data is stored
United States and other jurisdictions where Vercel operates. Website content is delivered through Vercel’s global network.
How to contact privacy
Description of processing
AI tutoring, analysis of mathematical and physics problems, handwriting-image interpretation and generation of feedback.
Data categories used
Problem statements, prompts, follow-up questions, handwritten-work images, extracted text, solution steps and AI-generated responses. Submitted content may contain personal information included by the user.
Categories of data subjects
Learners and people whose personal information is included in submitted content.
Where data is stored
Google’s Gemini API terms permit processing across countries where Google or its agents maintain facilities. No OLAR-specific regional residency commitment has been verified.
How to contact privacy
Description of processing
Recognition of handwritten and printed mathematical notation, including conversion into text and identification of positions within submitted work.
Data categories used
Digital handwriting strokes, images of submitted work and extracted text. Images may contain personal information included by the user.
Categories of data subjects
Learners and people whose personal information is included in submitted content.
Where data is stored
OLAR AI uses Mathpix’s global API endpoint, which Mathpix documents as operating in the United States — Northern Virginia.
How to contact privacy
Description of processing
Delivery of transactional emails, including password-reset messages, account-security notifications and subscription-renewal reminders.
Data categories used
Recipient email addresses, email content, relevant account or subscription information, and delivery records.
Categories of data subjects
Account holders and recipients of account or subscription notifications.
Where data is stored
United States, according to Resend’s data-handling documentation.
How to contact privacy
Description of processing
Product analytics where enabled and permitted by the user’s analytics settings.
Page views, product-usage events, user identifiers, account properties and technical information.
Categories of data subjects
Application users who enable analytics.
Where data is stored
United States. OLAR AI uses PostHog’s US cloud service.
OLAR AI’s configuration supports identified user profiles. Analytics is disabled by default and restricted by minor-user privacy settings.
How to contact privacy
Description of processing
Browser-based error monitoring, performance monitoring and masked session replay where configured.
Data categories used
Error reports, diagnostic events, performance traces, browser and device information, and masked session-replay data. OLAR AI applies data scrubbing and configures replay to mask text and inputs, block media and exclude network request bodies.
Categories of data subjects
Application users whose activity generates diagnostic or replay data.
Where data is stored
United States. OLAR AI’s browser monitoring uses Sentry’s US region.
How to contact privacy
Description of processing
Bot detection and abuse prevention on protected account and authentication flows.
Data categories used
IP addresses, browser and device signals, challenge tokens and verification results.
Categories of data subjects
Visitors and users accessing protected account flows.
Where data is stored
Cloudflare states that it primarily stores personal information in the United States and the European Economic Area, with transfers and access from other countries where it operates.
Cloudflare acts as a processor when protecting customer websites and as an independent controller for certain uses of signals to improve bot detection.
How to contact privacy
Description of processing
Payment processing, subscription management, checkout, invoicing and access to the billing portal.
Data categories used
Billing contact information, email addresses, payment details, transaction records and customer and subscription identifiers. Full card numbers and card security codes are processed by Stripe and are not stored by OLAR AI.
Categories of data subjects
Subscribers, payers and billing contacts.
Where data is stored
United States and other countries where Stripe, its affiliates and service providers process information to provide payment services.
Stripe acts as a processor for some activities and as an independent controller for others, including certain fraud-prevention and legal-compliance activities.
How to contact privacy
The following services also receive information when their features are used. Their inclusion here does not imply that they act as sub-processors for every activity.
Description of processing
Google account sign-in and delivery of website fonts.
Data categories used
For sign-in: authentication information and authorised Google account profile information. For font delivery: IP addresses and browser request information.
Categories of data subjects
Users choosing Google sign-in and visitors whose browsers request Google-hosted fonts.
Where data is stored
Google operates servers worldwide, and information may be processed outside the user’s country of residence.
How to contact privacy
Description of processing
Checking whether a password appears in known data breaches.
Data categories used
A partial password-hash prefix and network request information. The plaintext password and full password hash are not sent.
Categories of data subjects
Users whose passwords are checked through the service.
Where data is stored
HIBP states that personal information it holds is stored in Microsoft Azure in the western United States. Requests also pass through Cloudflare infrastructure.
HIBP’s general web-server logging policy states that operational logs are retained for up to 31 days; this is not a verified retention period for every password-check request. HIBP also states that Pwned Passwords does not store identifying information about who a password belongs to.
How to contact privacy
Notification of changes. OLAR AI maintains this list as its providers change. Where required by an institutional customer agreement, OLAR AI will provide advance written notice of new or replacement sub-processors and an opportunity to object in accordance with that agreement.
[Confirm the notification method and notice period before publication.]
Privacy questions. Contact official@olar.ai.
