Sub-processors
Last updated: 11 October 2026
1. What this list is
These are the outside services that process personal data for CurTask, what each one receives and when. Your main data — account, files, text, notes, codes, writing and AI results — is stored on our servers in Malaysia. How we use data is explained in our privacy policy.
The optional Save to CurTask browser extension sends what you save only to CurTask's own servers, so it adds no service to this list. The Chrome Web Store and Microsoft Edge Add-ons, where you install it, deliver the extension and its updates under their own terms; they receive nothing from CurTask about you or your papers.
2. Hosting and backups
| Service | Company / country | What it receives | Retention | When |
|---|---|---|---|---|
| Hostinger | Hostinger; servers at a data centre in Kuala Lumpur, Malaysia | All CurTask data, on servers we manage | As long as we keep the data (see the privacy policy) | Always |
| Amazon Web Services (S3) | Amazon Web Services; Asia Pacific (Malaysia) region | Encrypted backups of our database and files | 35 days | Every night |
3. AI providers
This is the list of AI service providers that the End-User Agreement points to. We use only providers that do not train AI models on your data, and each one keeps data as shown here, under its own policy. Your stored data stays on our servers in Malaysia.
| Company | Country | What it receives | What it keeps | Trains on your data | When |
|---|---|---|---|---|---|
| OpenCode Zen (OpenCode) | United States | The page text of the papers you choose to analyse (without reference lists); for matrix and coding jobs, the column or codebook definitions; when you use AI coding or themes, code names, descriptions and coded passages; for writing features, the paragraphs or section text the feature looks at, with passages of your papers; the project interview's title, answers and problem statement. Never your notes, memos, name, email or account number | Nothing: we use only its models whose providers process the request while answering and keep nothing afterwards | No | Only when you use an AI feature |
| OpenRouter (backup) | United States; routed only to services that keep nothing and collect nothing | The same request, unchanged | Nothing: every request is limited to services that keep no data and collect no data | No | Only when OpenCode Zen is unavailable |
| TypeSafe (Jev) | United States | To double-check AI results: the page text an AI value cites, the value being checked (with its matrix column's name and description), for Check my citations, your cited sentence with the passages of the paper it cites and, for Find support, your claim with the passage of your paper suggested to support it. Never your notes, memos, name, email or account number | Data and logs "for as long as necessary" under its own policy, including usage statistics (telemetry) it makes from them | No (its terms allow training only with our consent, which we don't give) | After our AI fills a matrix value, flags a citation or suggests a passage that supports a claim, to double-check it (fewer false alarms; a "Check this one" mark on values to look at; suggested passages it doesn't back are left out). Only once we switch it on; we will announce it by email before it starts |
4. Email
| Service | Company / country | What it receives | Retention | When |
|---|---|---|---|---|
| Resend | Resend; United States | Your email address and the content of the email (for example a sign-in code, an invite, a receipt or product news you agreed to) | Kept by Resend for delivery records under its own policy | Every email we send |
5. Payments
| Service | Company / country | What it receives | Retention | When |
|---|---|---|---|---|
| Stripe | Stripe (the Malaysian Stripe entity in its terms; processing by Stripe, Inc. and affiliates in the United States and elsewhere) | Your email address, your CurTask account number, the plan or top-up you buy and its price. You type card details or choose your FPX bank on Stripe's own page: they never reach CurTask. Never any paper, note, code, writing or AI result | Payment records as financial law requires; our own invoice record is kept 7 years | When you buy a plan or top-up, or manage a card subscription |
6. Sign-in services you choose
| Service | Company / country | What it receives | Retention | When |
|---|---|---|---|---|
| Google, Apple, Facebook | Google LLC, Apple Inc., Meta Platforms, Inc.; United States | That you are signing in to CurTask; they send us your name and email address | Under their own policies | Only if you choose "Continue with" one of them |
7. Research catalogues we search for you
These free, open catalogues of research are not under contract with us and are not processors, but they receive the search words described below. Nothing identifies you to them: our servers ask on your behalf with CurTask's own key.
| Service | Company / country | What it receives | Retention | When |
|---|---|---|---|---|
| OpenAlex | OurResearch; United States | The words and filters you type on the Discovery page; on paid plans, a few short keywords made from claims you chose for claim support (never your sentences); a record's number when you import it | Their public service; nothing about you | Discovery, claim support, import |
| Semantic Scholar | Allen Institute for AI; United States | The words and filters you type on the Discovery page; when you press "Find similar papers", the DOIs of up to 20 of the project's papers; a record's number when you import it | Their public service; nothing about you | Discovery, "Find similar papers", import |
8. Changes to this list
We announce changes to this list — including adding, removing or changing an AI provider — by email (an account notice) before they take effect, and update the date at the top of this page. Questions: hello@hackedu.tech.