Sub-processors
Last updated: 4 September 2026
LittleAIMaster Technologies Private Limited uses the following third-party providers to run its service. Each processes personal data only on our instructions and under a written data-processing agreement or equivalent terms. "Children's data" means data about learners, who are mostly under 18.
Infrastructure and hosting
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Google Cloud Platform (Google LLC) | Application servers and primary database | All account, progress, support and safety data | India (Mumbai region) |
| Vercel Inc. | Hosting of the web application | Requests to app.littleaimaster.com, including IP address and the session cookie | Global edge network; static assets only, no database |
| Amazon Web Services (S3 and CloudFront) | Storage and delivery of curriculum content, narration audio, certificate PDFs, avatar images and encrypted database backups | Certificate files (learner name, certificate number); avatar images; backups of the full database | India (Mumbai and Hyderabad regions) |
| Google Firebase Cloud Messaging | Push notifications to Android devices | Device push token, notification text | Global (Google) |
| Apple Push Notification service | Push notifications to iOS devices | Device push token, notification text | Global (Apple) |
| Expo (push relay) | Push notifications to a small number of older app versions only | Device push token, notification text | United States |
AI models
Every message a learner sends to an AI feature is screened by our safety layers before and after the model call. We send the message text and limited lesson context. We do not send the learner's name, email or account identifier to any AI provider, and our agreements prohibit the providers from using the data to train their models.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Anthropic PBC | AI tutor (Byte) responses, project critique, prompt lab, safety classification | Message text, lesson context, drawing images in the sketch tool | United States |
| Google (Vertex AI, Gemini) | Some tutor and creative-lab responses | Message text, lesson context | Google Cloud, paid Vertex tier |
| OpenAI | Voice mode: speech-to-text and text-to-speech | Audio of the learner's spoken question; text of Byte's reply | United States |
- Voice mode is off until a parent enables it in the app and accepts a notice that audio is processed by a third party.
Payments
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Apple Inc. (App Store) and RevenueCat Inc. | Subscriptions bought on iPhone and iPad; entitlement sync | Apple transaction identifiers, subscription status, an anonymous app-user identifier. We never see card details. | United States |
| LemonSqueezy LLC (merchant of record) | Subscriptions bought on Android and web; invoices, tax and refunds | Name, email, billing country, order and subscription identifiers. Payment method handled entirely by LemonSqueezy. | United States |
| Google Play (Google LLC) | App distribution on Android | Installation and crash statistics; no payment data | Global |
Communications and operations
We do not use third-party advertising SDKs, behavioural advertising networks or data brokers inside the app, and we do not sell personal data. Product analytics inside the app are collected by our own servers. Our marketing website uses Google tags for advertising measurement and analytics, described in the Cookie Notice.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Google Workspace (Gmail) | Transactional and support email sent from our domain; the support mailbox | Email address, name, the content of emails and support tickets | Global (Google) |
| ipapi.co | Detecting the billing region to show local pricing | IP address only, at the moment of checkout | Global |
| Google Cloud Monitoring | Uptime checks and alerting on our own hosts | No personal data | Global |
Schools and partners
Where a school or reseller uses LittleAIMaster, that organisation's staff (teachers, administrators, the partner's account team) can see the learning data of the students under its licence through their portals. They act as independent or joint controllers for that data under their own agreements with families; they are not our sub-processors.
Changes
We post changes to this page and, for schools and partners with a signed data-processing agreement, email the named contact at least 30 days before a new sub-processor begins processing their students' data, so they can object under the terms of that agreement.
Questions: privacy@littleaimaster.com.