Subprocessors
Effective: July 18, 2026
This page lists the third-party companies ("Subprocessors") that process personal information on Decka's behalf in order to operate our Services. Each Subprocessor is bound by a written data processing agreement that requires confidentiality, security, and use of the data only for the purposes described below.
We may update this list from time to time as our infrastructure evolves. Where applicable law requires advance notice of subprocessor changes (for example, under our Data Processing Addendum), we will provide the notice required by the applicable agreement before adding a new Subprocessor.
Hosting and infrastructure
| Subprocessor | Purpose | Region(s) | Privacy notice |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting (Workers), durable storage (Durable Objects, R2, KV), DNS, edge security, transactional email delivery, and video upload, transcoding, storage, and delivery (Stream) | Global | cloudflare.com/privacypolicy |
Identity and authentication
| Subprocessor | Purpose | Region(s) | Privacy notice |
|---|---|---|---|
| WorkOS, Inc. | User identity, password authentication, single sign-on (Google, Microsoft) | United States | workos.com/privacy |
| Google LLC | Sign-in with Google; Google OAuth and Slides API access for the Chrome extension; Google Fonts CSS and font-file delivery | United States | policies.google.com/privacy |
| Microsoft Corporation | Sign-in with Microsoft, Office add-in surfaces | United States | privacy.microsoft.com |
Payments
| Subprocessor | Purpose | Region(s) | Privacy notice |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management, billing | United States, European Union, United Kingdom | stripe.com/privacy |
Analytics and observability
| Subprocessor | Purpose | Region(s) | Privacy notice |
|---|---|---|---|
| PostHog, Inc. | Product analytics and operational exception reporting, only while the user has a current explicit Accept choice for optional analytics | United States | posthog.com/privacy |
| Functional Software, Inc. (Sentry) | Operational error tracking and stack-trace capture; request query strings and bodies are removed, credential-bearing fields and URL data are scrubbed recursively, and browser reporting is disabled in the extension presenter | United States | sentry.io/privacy |
AI-assisted features
When you use AI-assisted features in Decka (such as quiz question generation, drawing commentary, or avatar generation), prompts and uploaded media are transmitted to one or more of the following providers under contractual restrictions that prohibit using your content to train their general-purpose models.
| Subprocessor | Purpose | Region(s) | Privacy notice |
|---|---|---|---|
| Anthropic, PBC | Large language model inference (Claude) | United States | anthropic.com/privacy |
| Google LLC (Gemini API) | Large language model inference (Gemini) | United States | policies.google.com/privacy |
| Groq, Inc. | Large language model inference | United States | groq.com/privacy-policy |
| Cerebras Systems, Inc. | Large language model inference | United States | cerebras.net/privacy |
| Replicate, Inc. | Hosted model inference (image/avatar generation) | United States | replicate.com/privacy |
How we use Subprocessors
Each Subprocessor receives only the data necessary to perform its function. For example, Stripe receives the billing information needed to process your payment but does not receive the contents of your presentations; Cloudflare hosts the runtime that serves the Service but does not have an independent right to access your account data.
International data transfers between Decka and its Subprocessors that originate from jurisdictions requiring specific safeguards (such as the European Economic Area, United Kingdom, or Switzerland) are protected by the lawful transfer mechanisms recognized by those jurisdictions, including Standard Contractual Clauses approved by the European Commission where applicable.
Contact
Questions about this list, or requests for the underlying data processing agreements where you are entitled to them, can be sent to legal@decka.dev.