The complete list of third parties that process data on our behalf. We give 30 days’ notice before adding one, and you can object.
1. Current sub-processors
Each is engaged under a written contract with obligations no less protective than our data processing agreement, and we remain liable for their performance.
| Sub-processor | Purpose | Location | Data it can access |
|---|---|---|---|
| Railway | Application and API hosting | EU / UK | Everything processed by the platform |
| PostgreSQL (managed, on Railway) | Primary database | EU / UK | All customer and employee records |
| Redis (managed, on Railway) | Caching and background job queue | EU / UK | Transient job payloads only |
| Stripe | Subscription billing and payment processing | EU / US (SCCs) | Billing contact and payment details; no employee data |
| SMTP email provider | Transactional email — invitations, resets, notifications, reports | EU / UK | Name, email address and message content |
| Sentry | Error monitoring and diagnostics | EU | Technical diagnostics; user identifier where an error is user-specific |
| Expo push service | Push notification delivery to the staff app | US (SCCs) | Device push token and notification content |
| OCR provider (optional) | Receipt scanning for expenses, only if the customer enables it | Depends on provider; disclosed on enabling | Receipt images submitted for scanning |
The specific SMTP and OCR providers depend on your deployment configuration and are confirmed on request or in your order form. Where a sub-processor is optional, it processes nothing unless the feature is switched on by your administrator.
2. Notice of changes
We give customer administrators at least 30 days' written notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may terminate the affected service without penalty and receive a pro-rata refund of prepaid fees.
To be notified, make sure your administrator email addresses are current, or write to privacy@taskbithr.com to be added to the notification list directly.
3. What we do not use
Worth stating, because it is unusual:
- No advertising or analytics networks on taskbithr.com. No pixels, no tag manager, no session recording.
- No third-party font networks. Fonts are self-hosted, so reading this page sends no request to another company.
- No data brokers, and no sale of personal data in any form.
- No use of customer data to train machine-learning models, our own or anyone else's.
4. Contact
Questions about this list, or about a specific provider's arrangements: privacy@taskbithr.com.