Sub-processor List
Every third-party service AssisT can contact, what triggers it, what is sent, and how the student is asked first.
Applies to AssisT 1.0.0 · Last updated 5 October 2026
Read this first
Fiavaion has no sub-processors for AssisT. We operate no server that receives data from the extension, we hold no account for you, and no text you process ever reaches us. Under GDPR we are neither controller nor processor of your personal data.
What follows is therefore not a sub-processor list in the usual sense. It is the complete list of third-party services the extension can talk to, so that a disability service or data protection officer can see exactly where anything can go and decide what to tell students.
On a fresh install, nothing leaves the browser. Each service below is used only after the student says yes to it, or, for Browser AI model downloads from Hugging Face, chooses a model. Before anything the student selects, types or says is sent, AssisT asks once per service, in plain language that names the service and what would be sent. The question comes during the welcome setup, or the first time a feature needs it. On a course page, the question opens in a small AssisT window, because Chrome only lets an extension ask for a site permission from its own windows. Chrome’s permission prompt appears in the same press. Until the student says yes, nothing is sent. Every answer can be changed in the popup, under Advanced options, Your data, and a change applies to the very next request.
Where a student says yes to one of these, that provider becomes the student’s own processor, under the agreement between the student (or the institution, if it supplies the key) and that provider. Fiavaion is not in that chain and cannot see what passes through it.
Services that receive what a student is working on
| Provider | Purpose | When it is used | Data sent | Provider terms | How the student is asked |
|---|---|---|---|---|---|
Free Dictionary API, api.dictionaryapi.dev | Word definitions | When the student looks a word up | The word or short phrase looked up, up to three words. No surrounding text, no page address | dictionaryapi.dev | Asked once, at setup or first lookup. Nothing is sent until the student allows it. Chrome asks for its permission in the same press; nothing is asked for at install |
MyMemory (Translated srl), api.mymemory.translated.net | Translation of a selection | When the student translates text they selected | The selected text and the two languages | Usage and privacy | Asked once, at setup or first use. Chrome asks for its permission in the same press; nothing is asked for at install |
| MyMemory, Translate Page | Translation of a whole page | When the student presses Translate Page | All the visible text of the page and the two languages. Hidden text and AssisT’s own controls are left out. Can include names shown on the page, such as classmates on a discussion or grades page | As above | A separate question from translating a selection. It shows how much text the page holds and how it starts. Chrome asks for its permission in the same press; nothing is asked for at install |
Crossref, api.crossref.org | Citation details | When a citation has a DOI, or the student adds a source by DOI | The DOI only | Privacy policy | Asked once, at setup or first use. Chrome asks for its permission in the same press; nothing is asked for at install |
Semantic Scholar (Allen Institute for AI), api.semanticscholar.org | Checking a reference by title | Only with online citation checking switched on | Up to the first 120 characters of the reference’s title, with punctuation removed | Privacy policy | Off by default. Turning it on asks for consent and for a Chrome permission |
| Google speech recognition (in Chrome), for dictation | Dictation, the sticky note microphone, voice commands | While the microphone is listening | The sound of the student’s voice, sent by Chrome to Google to be turned into text | Google privacy policy | Asked before dictation first starts |
| Google speech recognition (in Chrome), for lecture capture | Lecture companion captions and notes | While lecture capture is on | Everything the microphone hears, including other people’s voices such as the lecturer and classmates | As above | Its own question, separate from dictation |
| Google or Microsoft online voices | Read Aloud | Only if the student picks an online voice | The text being read aloud | Google privacy policy · Microsoft privacy statement | Read Aloud uses an on-device voice by default. The voice picker labels each online voice with who it sends the text to |
Google (Gemini), generativelanguage.googleapis.com | Cloud AI | Only with Cloud AI chosen and the student’s own Gemini key saved | The text the student asked about and their question. While Personalised AI is on, a short line about how the student likes things explained can go with it | Gemini API terms · Google privacy policy | Saving the key, or pressing “Allow access”, is the yes. Chrome asks for the host permission at the same moment. Google offers a free tier |
Anthropic (Claude), api.anthropic.com | Cloud AI | Only with Cloud AI chosen and the student’s own Anthropic key saved | As for Gemini | Privacy policy · Commercial terms | As for Gemini |
OpenAI, api.openai.com | Cloud AI | Only with Cloud AI chosen and the student’s own OpenAI key saved | As for Gemini | Privacy policy · DPA | As for Gemini |
Perplexity, api.perplexity.ai | Cloud AI | Only with Cloud AI chosen and the student’s own Perplexity key saved | As for Gemini | Privacy policy | As for Gemini |
Services that only serve downloads
These receive an ordinary download request, which carries the student’s IP address and the name of the file. No text the student is working on is ever sent to them.
| Provider | Purpose | When it is used | Data sent | Provider terms | How the student is asked |
|---|---|---|---|---|---|
Hugging Face (Hugging Face, Inc.), huggingface.co, hf.co, xethub.hf.co | Browser AI model download | Only when the student downloads a Browser AI (WebLLM) model. Only the model’s weights are downloaded; the code that runs it ships inside AssisT. The model is then kept in the browser, and answering questions makes no further request | IP address and the model requested | Privacy policy | Not asked: choosing a model to download is the choice. The only third-party host granted at install |
jsDelivr, cdn.jsdelivr.net | Read from Images in a language other than English | The recognition engine and English ship inside AssisT, so English needs nothing. For another language, AssisT’s background script downloads that language’s file once, checks its pinned version, size and contents, and keeps it in AssisT on the device | IP address and the language file requested. No image and no text from the page | Privacy policy | Asked once, at setup or the first time another language is needed. Chrome asks for its permission in the same press; nothing is asked for at install |
| Google (Chrome Web Store) | Distribution and updates | When Chrome installs or updates the extension | Standard Chrome Web Store traffic between the browser and Google. AssisT sends nothing of its own | Google privacy policy | Part of installing any Chrome extension |
What is not on this list, and why
- Ollama (Local AI) runs on the student’s own machine at a loopback address. Nothing leaves the device, so there is no processor. Chrome asks for permission to reach it the first time Local AI is switched on, not at install.
- Browser AI (WebLLM) answers are worked out in the browser tab using WebGPU and make no network request. Only the one-off model download contacts Hugging Face, listed above.
- The site the student is on. To read text from an image or PDF on the page, AssisT may fetch that file again from the site it came from. Nothing goes to anyone else.
- Fonts. Every font AssisT offers either ships inside the extension (Lexend, OpenDyslexic, Atkinson Hyperlegible, Andika and Comic Neue) or is already on your computer. No font service is contacted.
- Analytics, crash reporting, error tracking. None. AssisT contains no analytics or telemetry of any kind.
For a data protection officer
- Default posture: on a fresh install nothing leaves the device, and the only outside host Chrome grants at install is Hugging Face. Each service above is used only after the student says yes to it, or, for Browser AI model downloads, chooses a model.
- Strictest posture: ask students to choose “Don’t allow” for every service, not to save a cloud AI key and not to download a Browser AI model. Read from Images in English still works, with no download. AssisT then makes no outbound request beyond Chrome’s own update checks, and its other supports still work.
- Withdrawal: a student can see and change every answer under Advanced options, Your data, and can remove any saved AI key there. Answers are kept on the device and are never part of an exported settings file.
- No DPA is needed with Fiavaion because there is no processing to agree over. If your procurement process requires a signed statement of that fact, email [email protected] and ask.
- Changes to this list are published here and noted in the privacy policy change log. There is no mailing list for changes; check the page, or watch the repository.