Subprocessors
Version 1.1 · Effective October 2, 2026
In short
- These are the companies that process personal information for DuckyHelper, what each one does, what it receives, and where.
- Each works for us under its own contract and terms, and may use the information only to provide its service to us.
- We'll update this list before we add or replace one.
This list is part of the Privacy Policy of MingLLM, Inc.
| Company | What for | What it receives | Where | Their terms |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Hosting the backend (Lambda, API Gateway), running Python code from the web app (Lambda, with no internet access), the database (DynamoDB), file storage (S3), the website (S3 and CloudFront), encryption keys (KMS), logs (CloudWatch), and sending email (SES) | Everything we store: accounts, transcripts, learning records, memories and files, billing records, email settings and logs, where sign-ups came from and invite records, site analytics; Python code you run in the web app; the email we send | United States (us-east-1, Virginia; email also from us-west-2, Oregon) | AWS Customer Agreement, AWS GDPR Data Processing Addendum, AWS Privacy Notice |
| OpenAI, L.L.C. (OpenAI's API) | The live voice conversation; the typed conversation; the tutor's thinking and tools, including web search; screen descriptions; captions and text of memory pictures and files; session summaries; tests and grading; reports; pictures Ducky makes; pronunciation scoring | Your voice (live, straight from your Mac or browser), what you type to Ducky, pictures of your screen, what you type and click during a step, transcripts, your learning brief, memory pictures and files, report facts, picture requests, pronunciation recordings | United States | OpenAI Services Agreement, Data Processing Addendum, API data usage: not used to train models; kept up to 30 days for abuse monitoring |
| Google LLC (Google Calendar, Gmail, Drive and Docs APIs) | Only if you connect them: reading your events, email and documents when you ask, and sending or creating what you confirm | Your Google sign-in (an encrypted token we hold), your requests, and the drafts you confirm | United States | Google API Services User Data Policy, Google Privacy Policy |
| Stripe, Inc. | Payments, card storage, checkout, subscriptions, invoices, receipts, the billing portal, account credit from invites, and the parent card check for children's accounts | Your email, your card (Stripe holds it; we never see the number), what you buy; invite rewards (the account credit and both account ids); a parent's card for the 50-cent check | United States | Stripe Services Agreement, Data Processing Agreement, Stripe Privacy Policy |
Not subprocessors, but good to know
- Apple checks (notarizes) each version of the app before we publish it. Apple receives the app, not your information. Text recognition on screenshots runs on your Mac with Apple's built-in tools.
- Wikipedia (Wikimedia Foundation). When Ducky shows a knowledge panel, the app fetches pictures and summaries directly from Wikipedia's public API, so Wikipedia sees your network address, as with any site you visit. See the Wikimedia privacy policy.
- Google Fonts. Some of our emails load fonts from Google Fonts, which your email app fetches from Google.
- Your email provider receives the emails we send you.
Changes
We'll update this page, with a new version and date, before a new subprocessor starts processing personal information. Questions: privacy@duckyhelper.com.
