Data path: where your data travels in heyprof (3D)
About this app
A piece of data travels across the stations it actually touches: device, hosting, database and files, AI service, email delivery. Each station names provider, location, legal basis, retention period and who sees the data. Plus safeguards with their status and the switch Today | STACKIT target (in preparation).
With explain mode: an AI tutor walks you through the app, points out what matters in the scene and answers your questions.
The idea
Anyone using a learning platform wants to know where their data is processed. In heyprof a piece of data touches up to five stations: your own device (browser, HTTPS only), hosting at Vercel with server functions in Frankfurt, database and files at Supabase in Frankfurt, the AI service from OpenAI with processing in the USA, and email delivery via Resend. Data processing agreements exist with all five providers; transfers to third countries are covered by standard contractual clauses, in some cases also by the EU-U.S. Data Privacy Framework. The presentation is simplified and is not legal advice.
What the app shows
A 3D map with the EU, Frankfurt inside it, and the USA. Five pieces of data travel their routes: a question to the AI tutor, uploaded slides, the photo of a solution, a live quiz answer and creating an account. The live quiz answer and the account touch no AI service. Each station names the provider, location, legal basis, retention period and who can see the data. Safeguards are listed with their status, such as two-factor sign-in, tenant separation by Row Level Security, semester deletion and an AI throttle. The switch Today | STACKIT target shows operation in data centres in Germany and Austria, which is in preparation.
Try it yourself
Pick a piece of data and follow its path across the map. For the question to the AI tutor you will see that the conversation stays in the browser and heyprof does not store the question itself, only usage without content and a topic keyword. Click a station to read the provider, location and retention period. Then switch to the STACKIT target and compare which stations change and which points are still open.
Frequently asked questions
- What is a data processing agreement?
- A data processing agreement under Art. 28 GDPR governs how a service provider processes personal data on behalf of a company. It sets out the purpose, the types of data, safeguards and the right to give instructions. heyprof has such agreements with all five providers on the data path.
- What are standard contractual clauses?
- Standard contractual clauses are contract templates published by the European Commission for transferring personal data to countries outside the EU. In them the recipient commits to a level of protection in line with European law. They are used, for example, when a provider processes data in the USA.
- Are questions to the AI tutor stored?
- In heyprof the chat history stays in the browser, and the question itself is not stored. What is stored is usage without content and the topic as a keyword of two to four words; teachers only see counts per topic. heyprof stores a chat only on request, and it is visible only to that person.
- What does the “Data path” app show?
- It shows in 3D which stations five typical pieces of data touch in heyprof, with provider, location, legal basis, retention and visibility for each station. It also lists the safeguards with their status and offers a switch to the STACKIT target picture, which is in preparation.
Subject: heyprof
More from heyprof
- heyprof explained
- The heyprof cycle
- AI dial: heyprof with and without AI
- Platform atlas: heyprof as a living map
- Watch or step in: video and interactive film
A VisuApp by heyprof: interactive, free in your browser, no sign-up. What is a VisuApp? · All apps