What lrnit keeps about you, and who can see it.

Subprocessors

These are the third-party services that process data on our behalf, and what each one sees.

This table is the subprocessor annex to our processor agreement, which is why it lives here and is not restated there. Read the Data Processing Agreement →

AI & your data

• lrnit generates courses, assessments, and feedback by sending prompts to large language models. Those prompts can include your learner profile, your answers, and lesson context. That is what makes the content tailored to you.
• We never use your data to train models. All AI calls go through API providers (via the Vercel AI Gateway, Google Cloud for speech, Voyage AI for embeddings) whose API terms do not grant them the right to train on the data we send.
• AI calls run exclusively server-side. Provider keys never reach the browser, and prompts are not stored by us beyond the generated output saved to your account.
• Generated content belongs to your account (or your organization, for company courses).

Data retention & deletion

• Your record (profile, courses, mastery history) is retained while your account is active; longitudinal memory is the product.
• You can download all of it as JSON at any time from Settings ("Download my data").
• Deleting your account from Settings permanently removes your profile, courses, mastery records, and generated content. This is immediate and irreversible.
• Deleted rows age out of provider database backups automatically as backups rotate (at most 30 days).

Authentication & access

• Authentication is handled by Supabase Auth with secure, http-only session cookies.

Data handling

• All database writes happen server-side. Service-role credentials never reach the browser.
• API routes enforce authentication, rate limiting, and input caps to resist abuse.
• We do not log auth tokens or personal data in production.

Encryption & infrastructure

• All traffic is encrypted in transit with TLS 1.2+. Data is encrypted at rest by our database and hosting providers (AES-256).
• The application runs on Vercel; the database and authentication run on Supabase (managed Postgres).
• Error monitoring (Sentry) is configured to exclude auth tokens; we do not log credentials or personal data in production.

For companies

• Row Level Security is enabled on every table holding organization or learner data.
• Each company’s data is scoped by organization; one tenant can never read another’s rows.
• Privileged reporting runs through audited security-definer functions that verify admin rights before returning org-scoped data. They never widen row access.
• Company knowledge documents are retrievable only within the owning organization, enforced at the database layer.
• Role-based access control: owner, admin, and member roles gate every admin surface and action.
• Seat limits are enforced server-side on invite and acceptance.
• Enterprise SSO / SAML can be enabled for your identity provider on request.
• Membership, access and configuration changes are recorded in a per-organization audit log, and each entry is hash-chained to the one before it so a deletion or an edit is detectable.
• Organization owners can delete their organization, which permanently removes all company data: members, invites, course templates, company documents, reports, and the audit log.