Last Updated: July 20, 2026
This page lists the external service providers (subprocessors) that ottava (“we”, “us”, or “our”) uses to provide the Service. Pursuant to Sections 3 and 4 of our Privacy Policy, we publish the current list of providers here and update this page whenever a provider is added or changed.
Service Providers #
| Provider | Purpose | Location | Key Measures |
|---|---|---|---|
| Supabase, Inc. | Data storage and authentication | Japan (Tokyo) | SOC 2 Type II certified. Data encryption at rest (AES-256) and in transit (TLS). Logical data isolation via Row-Level Security (RLS) |
| Anthropic, PBC | AI-assisted scheduling and response generation | United States | Under Anthropic’s Commercial Terms of Service, data sent via API is not used for model training. Encryption in transit (TLS) |
| Apple Inc. | Push notifications (Apple Push Notification service) and authentication (Apple Sign In) | United States or Ireland | ISO 27001 certified. Encryption in transit (TLS). Processes notification content (which may include the classroom name and student name) required for delivery |
| 650 Industries, Inc. (Expo) | Push notification delivery (Expo Push) | United States | Encryption in transit (TLS). Stores the device token required for delivery; the notification content (which may include the classroom name and student name) is deleted after delivery |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics | EU (Germany) | Encryption in transit (TLS). Personal data is redacted on the app and server side before sending; however, iOS native crash reports are not covered by this redaction |
The location of each provider is as listed above (Japan, the United States, the EU, etc.). The primary store of personal data, Supabase, is located in Japan (Tokyo); only limited information is provided to third parties located outside Japan. For our approach to international data transfers and the data protection regimes of each country, please see Section 4 of our Privacy Policy.
Additions or changes to service providers that do not materially change how personal data is handled are made by updating this page and by notice under Section 9 of the Privacy Policy. Where we would newly transfer personal data to a third party located outside Japan, we do so only after obtaining the prior consent of the individual (guardian or teacher), or satisfying an alternative requirement under the law, in accordance with Article 28 of the Act on the Protection of Personal Information.