Draft for counsel’s review, not yet in force. This text is the draft of 3 October 2026 as handed to counsel; highlighted marks are the places counsel or the founder still has to fill. It is shown so that the words can be read and judged now. It becomes binding only in the version counsel clears, which will carry its own date at the top.

Leo, named in this document: A computer program, not a person. Named for Leonhard Euler.

Sub-processor List and Records of Processing

Version	v1.0 draft
Date	3 October 2026
Status	Draft for counsel's review, not yet in force
Controller	Schweizer Bildungsglobus AG (Swiss eduGLOBE AG), c/o Benediktiner Kloster Disentis, Via Claustra 1, 7180 Disentis/Mustér, Switzerland, UID CHE-219.746.858 (correspondence: Leimbachstrasse 153, 8041 Zürich)
Applies to	euler.swiss and stella.academy

Part A. Sub-processor list

This list names every company that processes personal data on our behalf, or receives content from the Platform, with the country, the purpose, the data involved and the safeguard for any disclosure abroad. We update this list before any addition or change and tell Account Holders by e-mail where a change concerns a child's data. Last change: 20 October 2026 (row 9, Cloudflare Turnstile, SEC-CAPTCHA).

#	Provider and legal entity	Country of processing	Service	Data categories	Safeguard	Agreement
1	Exoscale, operated by Akenes SA, Lausanne	Switzerland (Geneva and Zürich zones)	Compute hosting, managed PostgreSQL, backups	All Platform data: identity store, activity store, problem store, logs	None needed; processing in Switzerland	Exoscale Data Processing Agreement (applicable from 5 May 2025). [PLACEHOLDER: date signed or accepted]
2	Mailpro, operated by Maxony SA, Geneva	Switzerland	Transactional e-mail sending	Account Holder and Faculty e-mail addresses, message content (light: a line and a link)	None needed; processing in Switzerland	[PLACEHOLDER: DPA reference]
3	Hostpoint AG	Switzerland	Fallback SMTP relay if Mailpro is unavailable; domain and DNS	E-mail addresses and message content in the fallback case only	None needed; processing in Switzerland	[PLACEHOLDER: confirm retained at launch; DPA reference]
4	Stripe Payments Europe Ltd, Dublin, with Stripe, LLC, San Francisco (not live)	Ireland; United States	Payments, subscriptions, tax calculation, receipts, Faculty payouts (Connect)	Adult payer: name, e-mail, payment details (held by Stripe only), plan codes, Euler IDs covered by a plan; Faculty payout account references	Ireland on the Swiss Federal Council's list of adequate states (DPO Annex 1); Stripe, LLC certified under the Swiss–U.S. Data Privacy Framework (policy effective 28 April 2026); SCCs as fallback	Stripe Services Agreement and DPA. [PLACEHOLDER: date]
5	Anthropic, PBC, San Francisco	United States	AI model behind Leo (hints, later coaching), machine review of problems, draft Faculty profile from a pasted CV	Leo and review: no personal data; problems, attempts, answers, de-labelled history summaries, author-stripped problem text. Faculty CV: the Faculty Member's own professional data, with consent	Leo and review: no personal data disclosed, so FADP Art. 16 not engaged; named for transparency. Faculty CV: SCCs in Anthropic's data processing addendum. No training on inputs or outputs; deletion within 30 days by default	Anthropic Commercial Terms and DPA. [PLACEHOLDER: date; whether zero-data-retention terms are requested]
6	GitHub, Inc.	United States	Source code hosting, CI/CD, deployment secrets	No personal data (code and configuration only)	Not applicable	GitHub Terms. Secrets held in GitHub Actions only
7	Paddle.com Market Ltd (documented fallback only; not in use)	United Kingdom	Merchant of record for subscriptions, only if ever activated	None today	United Kingdom on DPO Annex 1	None. Would be announced and added here before any use
8	Wise, Payoneer, PayPal (not live)	Various	Faculty payout rails where Stripe Connect is unavailable	Faculty payout account references only; identity verification done by the provider	[PLACEHOLDER: per provider, before tutoring opens]	[PLACEHOLDER]
9	Cloudflare, Inc., San Francisco (Turnstile; on only once the founder sets the keys)	United States (edge network; the check runs where the visitor is)	The "is this a person" check on the public forms of both sites (registration, contact, feedback, the school door, the Faculty sign-up, the password-reset request, a visitor's waiting-list wish); never on a child's screen, never on a signed-in form	The visitor's IP address and browser signals during the check only; no cookie of ours, no identifier of ours, no form content, no child data	Cloudflare, Inc. certified under the Swiss–U.S. Data Privacy Framework; SCCs in Cloudflare's DPA as fallback; the check is transient and the Platform stores only a pass/fail count	Cloudflare self-serve terms and Data Processing Addendum. [PLACEHOLDER: date accepted; whether the Turnstile "no-cookie" (non-managed) widget mode is chosen] [COUNSEL: added 20 October 2026 (SEC-CAPTCHA) — please confirm the DPF/SCC posture and that one line in the notices (EN: "To stop automated spam, the public forms run a human check by Cloudflare, Inc., which sees your IP address and browser signals for that moment and nothing you type"; DE: "Um automatisierten Spam zu stoppen, prüfen die öffentlichen Formulare mit einem Verfahren von Cloudflare, Inc., ob eine Person sie absendet; Cloudflare sieht dabei für diesen Moment Ihre IP-Adresse und Browsermerkmale, aber nichts von dem, was Sie eingeben") is enough. The German notice does not exist yet; the line is kept here for it.]

Not used: no analytics provider, no advertising network, no tracking service, no third-party font host, no third-party script other than the Cloudflare Turnstile check on the public forms (row 9, once switched on), no customer-relationship tool holding parent data, no survey tool holding child data.

[COUNSEL: confirm that naming Anthropic as a recipient of de-identified content, while stating that no personal data is disclosed, is the right transparency posture under FADP Art. 19 para. 4 and POPIA s. 18(1)(g).]

Part B. Records of processing activities (FADP Art. 12)

Exemption analysis. Art. 12 para. 5 FADP and DPO Art. 24 exempt companies with fewer than 250 employees from the duty to keep a record unless they process sensitive personal data on a large scale or carry out high-risk profiling. Swiss eduGLOBE AG has fewer than 250 employees, processes no sensitive personal data on the Platform (the Faculty vetting verdict is the only sensitive-adjacent item and is a verdict, not the record), and takes the view, subject to counsel's confirmation, that the Euler Index is profiling but not high-risk profiling. The company is therefore exempt today. We keep the record anyway: it costs little, it is the description for the DPIA, and it will be required under GDPR Art. 30 when EU children join. [COUNSEL: confirm the exemption analysis and the view that the Ei is not high-risk profiling (FADP Art. 5 lit. g).]

Controller for every activity: Swiss eduGLOBE AG. Privacy contact: [PLACEHOLDER: name], privacy@euler.swiss. Information Officer (South Africa): [PLACEHOLDER].

#	Processing activity	Purpose	Data subjects	Data categories	Recipients	Disclosure abroad and safeguard	Retention	Security measures (outline)
1	Account Holder registration and verification	Open and run the parent account; verify an adult holds it; prove consent	Parents and legal guardians	E-mail, password hash, display name, country, role (parent or guardian), consent records (text version, hash, time, method, IP region), invitation code used	Exoscale, Mailpro	None	Account life + 12 months; unverified accounts 30 days; consent records account life + [PLACEHOLDER]	TLS, argon2id, server-side sessions, CSRF, rate limits, audit log
2	Child registration and identity store	Register the child; issue the Euler ID; link to the parent	Children (under 13 by design)	First name, year of birth, country, school link (effective-dated), alias, login name, PIN hash, Euler ID, Code of Conduct acceptance	Exoscale	None	Account life + 12 months; hard delete within 30 days on request	Identity store separated from activity store; link read only when the parent views their child; access logged
3	Child learning records (activity store)	Run adventures; compose sets; compute Ei and Eulos; show the parent everything; recalibrate problems	Children	Attempts, answers, timing, level, Ei snapshots, Eulos ledger, problems seen, keyed on Euler ID only	Exoscale	None	Account life, then pseudonymised with identity link severed	No parent key in any activity row; aggregate statistics only for calibration
4	Public leaderboards	Rank children by Ei for the Championship	Children	Euler ID, rank, country, alias where consented	Public (website visitors); Exoscale	Website is world-readable	While the account exists and the child is not withheld; alias removed with history on withdrawal	Alias default hidden; parent withhold; no school; no profile pages; alias screening
5	School registration and enrolment confirmation	Verify a real child of the stated age exists; aggregate school boards	Schools' authorised persons; children (enrolment status)	School name, town, country, status; authorised person's name and e-mail; confirmation per E-ID	Exoscale, Mailpro; the school sees alias and E-ID only	None	School records while the school is registered; confirmation with the child record	n ≥ 5 threshold for school boards; no roster to schools
6	Leo (hints; coaching later)	Give a hint when a child asks	Children (indirectly; no personal data leaves)	Problem, attempt, correct answer, de-labelled history summary; set prompts in the pilot	Anthropic (de-identified content only)	United States; no personal data disclosed; DPA with SCCs for completeness	Our logs: [PLACEHOLDER]; provider: deleted within 30 days	Single assembly function `leoPayload()`; identifier-leak test in CI; honesty label on every appearance
7	Machine and human review of problems	Quality and level of problems before children see them in scored sets	Faculty Members (authors and reviewers)	Problem text, author id (stripped before the model call), reviewer verdicts and reasons, agreement statistics (private), calibration statistics (aggregate)	Anthropic (author-stripped problem text), Exoscale	United States; no personal data in the model call	Problem life; review records retained with the problem	Blind review both ways; structural recusal; two-flag suspension
8	Parent reports and problem flags	Show the parent every adventure; let the parent flag a problem	Parents; children	Report content from the activity store rendered under the parent's session; flag rows (parent id, problem, time)	Exoscale, Mailpro (light line only)	None	With the activity record	Rendered only in an authenticated parent session; e-mail carries no question or answer
9	Transactional e-mail	Verification, consent confirmation, security, deletion, report line	Parents; Faculty Members	E-mail address, message content	Mailpro; Hostpoint as fallback	None	Outbox: [PLACEHOLDER: e.g. 30 days]; provider logs per its DPA	No e-mail to children; no marketing without opt-in
10	Marketing opt-in capture ("tell me when paid plans open")	Notify interested parents when paid plans open	Parents who opt in	E-mail address, time, page	Mailpro	None	Until the notification is sent or the opt-in is withdrawn	Opt-in recorded with text version; opt-out in every message
11	Faculty accounts, profiles and honours	Run Faculty membership; publish adult profiles; credit contributions and reviews	Faculty Members (adults)	Name, e-mail, password hash, title, country, professional summary, CV until profile approval, contribution and review counts, agreement statistics (private)	Exoscale, Mailpro; Anthropic for the CV draft (with consent); public (profile)	United States for the CV draft; SCCs	Account life + [PLACEHOLDER]; CV deleted on profile approval	Name and country public by design for adults only
12	Payments (built dark, not live)	Sell parent plans and lessons; pay tutors	Parents (payers); Faculty Members (payees)	Customer record, plan, subscription state, receipt, Euler IDs covered; payout account references; tax self-declaration	Stripe (Ireland/US); payout rails	Ireland (adequate); US under Swiss–U.S. DPF; SCCs fallback	10 years for accounting records (Art. 958f CO)	Card data never on our systems (SAQ A); only adult accounts can be customers; no card columns (tested)
13	Backups	Recover from loss	All	Full database	Exoscale	None	Daily; rolled off within 90 days	Encrypted at rest; same Swiss zones
14	Security logging and rate limiting	Prevent abuse; investigate incidents	All users	IP address, user agent, timestamps, failed-login counters; the public-form gate's refusal counts (form, reason, site — never the sender)	Exoscale; Cloudflare, Inc. for the human check on public forms (row 9)	Cloudflare: Swiss–U.S. DPF / SCCs	[PLACEHOLDER: e.g. 30 days]	Access restricted to administrators; reviewed on incident
15	Support and rights requests	Answer parents and Faculty; fulfil access, correction, deletion and export requests	Parents; Faculty Members; children through parents	Correspondence, identity-check link, the data exported	Mailpro, Exoscale	None	Correspondence [PLACEHOLDER: e.g. 24 months]	Identity confirmed by link to registered e-mail; requests logged
16	Championship archive (from 2027)	Keep the historical record of a competition	Children (former participants)	Euler ID, alias if consented, country, result	Public (results); Exoscale	Website is world-readable	Indefinite as an archive, identity link severed on account deletion. [COUNSEL: Art. 31 justification]	No name, no school, no photograph without separate consent under the Rules and Regulations

Countries of disclosure, in summary: Switzerland (all personal data); Ireland and the United States (adult payment data, when live; Faculty CV drafts with consent; de-identified content only for Leo and review). No other country receives personal data from the Platform.

Review. This record is reviewed with the DPIA in November 2026 and at every change to the sub-processor list.