Sub-processors
Mobius Labs Inc., doing business as Matarus (“Matarus,” “we,” or “us”), uses service providers to operate, secure, and support the Matarus services.
Where Matarus processes personal information on behalf of a school, organization, or other customer, these providers may act as sub-processors. Where Matarus determines why and how personal information is processed, they may instead act as processors or service providers to Matarus. This page should be read together with our Privacy Policy and any data processing agreement between Matarus and the applicable customer.
Current Sub-processors
| Provider | Service and purpose | Personal information that may be processed | Primary processing locations |
|---|---|---|---|
| Amazon Web Services (opens in a new tab) | Cloud hosting, databases, storage, content delivery, security, backups, and supporting infrastructure; and, through Amazon SES, email delivery of message notifications to Users who have enabled email | Account and profile information, learning and service data, User Content, files, security records, and technical logs; for email notifications, the recipient’s email address and notification content | Primarily Canada for Matarus-hosted production data; the United States and other locations may be used for selected services, support, or provider sub-processing |
| Calendly | Scheduling consultations and learning evaluations booked through the calendar embedded on Matarus marketing and tutoring pages | The booking details a visitor enters, such as name, email address, chosen time, and any answers to booking questions; and IP address, device, and browser information | United States and other locations used by Calendly and its sub-processors |
| Cloudflare | Bot and abuse detection on public forms, currently the Tutor public-profile enquiry form | IP address, device and browser characteristics, and interaction signals used to distinguish human visitors from automated traffic | Cloudflare’s global network, including the United States |
| Courier (opens in a new tab) | Transactional email preparation and delivery | Email address, account identifiers, notification content, template data, and delivery metadata | United States and other locations used by Courier and its sub-processors |
| FullStory (opens in a new tab) | Error diagnosis and usability analysis. Session replay and diagnostic records are used to investigate faults and usability problems in the Services. Not used for advertising, and not used for product or funnel analytics. | Account identifier, time zone, and role, attached as session identity; device, browser, IP address, page addresses, and interaction events; and rendered page content, including learning activity content such as questions attempted and answers given — but excluding private message content, conversation subjects, conversation participant names, and account, sign-in, and billing form entries, which are excluded from capture before any data reaches FullStory. Matarus does not send names or usernames to FullStory. | United States and other locations used by FullStory and its sub-processors |
| Honeycomb (opens in a new tab) | Application monitoring, diagnostics, incident response, and service reliability | Names, account identifiers and usernames (which may be email addresses), session identifiers, request and device information, error details, and technical telemetry; private message content is not intentionally sent to Honeycomb | United States and other locations used by Honeycomb and its sub-processors |
| ImageKit | Image hosting, transformation, and delivery for activity screenshots and related service images | Activity screenshot images, which may show a Student’s on-screen work, answers, and displayed name; and image metadata including a session-replay link, activity and question addresses, and class section and time-slot identifiers | United States and other locations used by ImageKit and its sub-processors |
| ipinfo | Country detection to show regional pricing on the purchase page | The visitor’s IP address and request metadata | United States and other locations used by ipinfo |
| Meta Platforms | WhatsApp Business Platform delivery for WhatsApp notification messages, including message-template handling and delivery status | The recipient's WhatsApp address, notification or permitted message content, message-template information, delivery status, and abuse-prevention data | United States, Ireland, and other locations used by Meta Platforms and its affiliates |
| OpenAI | Automated marking of photographs of worksheets and math problems submitted through the Services; safety review of text entered on shared game boards; generating a stylised version of a Tutor’s profile photograph; and drafting outreach messages that a Tutor requests to promote their profile | Photographs of submitted work, which may show a Student’s handwriting, answers, and any name written on the page; text entered on shared game boards; and, for Tutors, their profile photograph, name, headline, biography, education, grades served, public profile link, and any campaign idea they enter | United States and other locations used by OpenAI and its sub-processors |
| remove.bg | Automated background removal for Tutor profile photographs | The photograph a Tutor submits for their public profile, which is an image of an identified adult | Locations used by remove.bg and its sub-processors |
| Slack (opens in a new tab) | Internal operational and support workflows, including class activity reporting, account and billing notifications, and contractor invoice review; and, where a conversation is explicitly bridged to a Slack channel, delivery of permitted message content | Student and Teacher display names and avatar usernames, activity, contest, and lesson context, activity screenshot images, account-creation and invoice notification details, and, for explicitly bridged conversations, permitted message content | United States and other locations used by Slack, Salesforce, and their sub-processors |
| Stripe (opens in a new tab) | Payment processing, subscription billing, invoicing, refunds, and payment fraud prevention | Name, email address, billing address, purchase and subscription history, payment tokens and partial payment-card details, and transaction and fraud-prevention records; full payment-card numbers are collected by Stripe and are not stored by Matarus | United States and other locations used by Stripe and its sub-processors |
| Twilio (opens in a new tab) | Mobile-address verification and, for eligible Users and permitted conversations, SMS and WhatsApp service-notification delivery, delivery reporting, opt-out handling, and abuse prevention | The eligible User’s verified mobile phone number or WhatsApp address, consent and opt-out information, generic notices or permitted notification content, provider identifiers, delivery status, and limited inbound messaging activity | United States and the countries in which Twilio, its sub-processors, and telecommunications networks provide the requested service |
| Vercel (opens in a new tab) | Website and web-application hosting, content delivery, security, and technical logging | IP address, device and request information, account or session information processed through the web application, and technical logs | United States and global content-delivery locations |
| Xero (opens in a new tab) | Accounting, invoicing, and financial record-keeping, including customer and contractor billing records | Name, email address, billing and contact details, invoice and payment records, and contractor payment information | United States, Australia, New Zealand, and other locations used by Xero and its sub-processors |
| Zoom | Video conferencing for live online tutoring sessions, including meeting scheduling and hosting | Tutor host email addresses, meeting scheduling details, participant display names, and the audio, video, and chat of a session; and, where a session is recorded, the recording | United States and other locations used by Zoom and its sub-processors |
The location summaries above identify primary or typical processing locations and are not exhaustive. A provider may use affiliates or downstream sub-processors in additional jurisdictions in accordance with its agreement with Matarus. Where required, Matarus uses contractual or other safeguards for international transfers.
Analytics and Advertising
Matarus uses Google Tag Manager, Google Analytics, and Google advertising services on its public website only — the marketing pages and the sign-in, sign-up, and purchase pages. These services are not loaded on signed-in pages of the Matarus application, so they do not observe a Student’s use of the Services.
For these services Matarus is the controller of the information it collects, and Google may act as an independent or joint controller for its own purposes rather than as a sub-processor of Matarus. The information involved is IP address, cookie and device identifiers, page addresses, referral information, and advertising-conversion signals. Google’s handling of that information is governed by its own terms and privacy notices.
Communications Networks
WhatsApp messages are delivered through the WhatsApp Business Platform, so Meta Platforms processes the recipient's WhatsApp address, message or notification content, delivery status, and message-template information for every WhatsApp message. Meta acts as a sub-processor for WhatsApp delivery and is listed in the table above.
SMS and WhatsApp messages may additionally pass through telecommunications carriers, network operators, and other communications intermediaries needed to reach the recipient. Those parties may process addressing information, message or notification content, routing information, delivery records, and abuse-prevention data under their own legal and network obligations. Unlike Meta, they are not sub-processors of Matarus or Twilio — they carry the message under their own network and regulatory obligations.
Twilio maintains its own list of downstream sub-processors (opens in a new tab). That list may change independently of this page.
Changes to This List
We review this list as our services and providers change. We will update this page when we add or replace a sub-processor that processes personal information covered by this notice. Customers with contractual notification or objection rights will receive notice in accordance with their agreement with Matarus.
Questions or objections concerning a provider or international transfer may be sent to privacy@matarus.com.
Last Modified Date: September 23, 2026