Draft — not yet in force. This document still contains
placeholders marked [[TODO…]] and has not been reviewed by a lawyer.
Do not rely on it. Remove this notice only once every placeholder is filled in and the
text has been reviewed.
Sub-processors
These are the providers that process data on our behalf to run Hourino. We list them because "we may share data with trusted partners" is not an answer. Each entry says what the provider is for, what it actually receives, and where it sits.
Always in use
| Provider | What for | What it receives | Where |
|---|---|---|---|
| [[TODO: hosting provider]] | Servers and database | Everything — this is where Hourino runs | [[TODO: country / region]] |
| SmartEmailing | Transactional e-mail (verification, password reset, invitations) | Recipient e-mail address, name, the message itself | Czech Republic (EU) |
| Sentry | Error monitoring | Technical error details and the affected user's e-mail. Request bodies, cookies and query strings are stripped before sending — see section 6 of the privacy policy | [[TODO: confirm EU or US region of your Sentry org]] |
| Cloudflare | Captcha on sign-up and password reset | IP address and browser signals of the visitor | EU/US (SCCs) |
| Google (Drive) | Off-site database backups | An encrypted database dump. The file is encrypted before it leaves our server, so Google holds data it cannot read | EU/US (SCCs) |
Only if you use the feature
| Provider | What for | What it receives | Where |
|---|---|---|---|
| [[TODO: confirm Creem]] | Payments, as merchant of record | Billing details and payment data. We never see your card number | [[TODO: country / region]] |
| OpenAI | Dictating an entry (speech to text) | The audio you record and the text transcribed from it — only when you use dictation | US (SCCs) |
| Asana | Integration you connect yourself | Project and task data from your Asana account, and the hours written back to it | US (SCCs) |
Not on this list, on purpose
The web font is served from our own servers, not from Google Fonts. Loading it from Google would send your IP address to Google on every page load, which is a transfer we have no reason to make for a typeface.
Changes
When we add or replace a sub-processor we update this page. If you have a data processing agreement with us and object to a new sub-processor, tell us at [[TODO: privacy contact e-mail]] — the agreement says what happens next.