At Walnut Learning Assistant, we take data privacy seriously.
We work only with trusted third-party service providers (“subprocessors”) who help us deliver, secure, and maintain our services.
Each subprocessor is carefully reviewed for their data protection practices, and we ensure all processing complies with the UK GDPR and relevant international data transfer safeguards.
We choose data storage and processing locations that prioritise security, reliability, and compliance.
Where possible, data is processed and stored within the United Kingdom or the European Economic Area (EEA).
If data must be transferred outside these regions, we rely on approved safeguards such as the UK’s International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs).
| Sub Processor | Purpose of processing | Location | Legal Safeguards |
| Amazon Web Services (AWS) | Cloud hosting, data storage, and infrastructure services used to operate the Walnut platform. | United Kingdom / European Union | UK GDPR compliant; Data Processing Addendum in place; UK & EU SCCs as applicable. |
| Anthropic | AI model processing and conversational functionality that powers learning support within the Walnut Assistant. | United Kingdom / European Union (via secure API endpoints) | UK GDPR compliant; Standard Contractual Clauses (SCCs) in place. |
| Stripe Payments UK Ltd | Secure payment processing, billing, and subscription management. | United Kingdom / European Union | UK GDPR compliant; regulated by the FCA; SCCs for any transfers outside the UK. |
| FreeAgent Central Ltd | Accounting and financial record-keeping (limited customer billing metadata, no learning data). | United Kingdom | UK-based processor; complies with UK GDPR. |
| SendGrid (Twilio Inc.) | Transactional email delivery (e.g., password resets, payment confirmations, and notifications). | European Union / United States (with EU data centre routing) | SCCs and UK IDTA in place; ISO 27001 certified. |
Notes
- Walnut does not sell or share personal data with third parties for marketing purposes.
- Only the minimum necessary personal data is processed by each subprocessor for their defined purpose.
- Data retention and deletion follow Walnut’s internal retention policy and Data Processing Agreement.
- This list may change as we improve our platform or engage new partners. Any material changes will be reflected on this page and, where required, notified to customers in advance.