BETA

Cookies. Advertising is switched off. We save the preferences you choose and use storage to keep Otiya working, including signing you in. Read the privacy notice

Otiya Subprocessor List

Version 1.0 · 14 October 2026

These are the third-party services Helixus Ltd (Otiya) uses to provide Otiya for Schools. We give schools at least 30 days' notice before adding or replacing a subprocessor that processes school data (Data Processing Agreement, clause 5).

Services that process school data

Provider	What it does for Otiya	School data it handles	Location	Transfer safeguard
Google Cloud: Firebase (Firestore, Authentication, App Check)	Database, staff sign-in and app verification	Staff accounts, school workspace, live game and homework data, saved class reports	Firestore: Europe (multi-region). Sign-in: Google's global infrastructure	Google Cloud data processing terms, with the UK Addendum to the EU Standard Contractual Clauses for any access from outside the UK
Netlify	Website hosting and the server functions that run games, homework, AI requests and emails	Data passing through the server functions, and short-lived hosting logs	United States, with a global network for website files	Netlify data processing agreement, with the EU Standard Contractual Clauses and the UK Addendum
Google: Gemini API	Optional otiya AI quiz writing and inclusive review, used only by staff	Topics, quiz text, files and photos of printed material that staff choose to send. No pupil data should be included	Google's global infrastructure	Google's paid Gemini API terms, under which prompts and files are not used to improve Google's products; Google's data processing terms with the UK Addendum
Brevo (Sendinblue SAS)	Account and service emails to staff	Staff name and email address	European Union (France)	UK adequacy regulations for the EU

Services the browser uses, with no school data

Provider	What it does	What it receives
Google Fonts	Typefaces on Otiya pages	No school data. The browser requests the fonts, which shares the device's IP address with Google
SheetJS (cdn.sheetjs.com)	Reads Excel files when staff import questions	No school data. The file is read in the staff member's browser and not uploaded. The browser fetches the reader, which shares its IP address

Optional services the school switches on

Provider	When it is used	What Otiya receives
Google Classroom	If a teacher posts homework to Classroom or sends scores back	Nothing on Otiya's servers. It runs in the teacher's browser with the teacher's own Google sign-in. The browser keeps only class and assignment IDs
Microsoft Teams (Microsoft Graph)	If a teacher posts homework to Teams or sends scores back	Nothing on Otiya's servers. It runs in the teacher's browser with the teacher's own Microsoft sign-in. The school's Microsoft 365 admin approves Otiya once
Google or Microsoft sign-in	If a member of staff chooses to sign in with their Google or Microsoft account	Their name and email address, passed to Firebase Authentication
Google Translate	Only if someone picks a site language other than English	The page text is sent to Google for translation, and Google may set cookies

Changes to this list

Date	Change
14 October 2026	First published (version 1.0)

Questions: hello@otiya.xyz

Trust and safety | Otiya for Schools | Privacy