Sub-processors
Data Processors engaged by us
1. Overview
This page lists every sub-processor engaged by Timesheet - Mobile Time Tracking OG in accordance with the General Data Protection Regulation (GDPR). These service providers process personal data on our behalf and according to our instructions. A data processing agreement under Article 28 GDPR is in place with each of them.
The list is grouped by where each provider is used. Not every processor is involved in every use of Timesheet: payment providers are only involved if you take out a paid subscription, AI providers only when you actively use an AI feature, and analytics and marketing providers only after you consent in the cookie banner.
2. Data Processors
Infrastructure and operations
These processors run the service itself. They are involved whenever you use Timesheet.
| Service | Purpose | Processor | Place of processing | Documents |
|---|---|---|---|---|
| Google Cloud | Application hosting, database, file storage, task queues, logging and secret management. All production services run in the europe-west1 region (Belgium). | Google Cloud EMEA Limited 70 Sir John Rogerson's Quay Dublin 2, Ireland | European Union | Data Processing TermsSub-processors |
| Firebase, Google Identity Platform | Sign-in and account management, push notifications, app integrity checks, crash reports and performance measurement in our mobile apps. | Google Cloud EMEA Limited 70 Sir John Rogerson's Quay Dublin 2, Ireland | EU, onward transfer to the USA under standard contractual clauses | Firebase privacyData Processing Terms |
| ALL-INKL.COM | Hosting of our documentation site. | ALL-INKL.COM - Neue Medien Münnich Hauptstraße 68 02742 Friedersdorf, Germany | Germany | Privacy information |
| Slack | Internal notification of new subscriptions. The message contains the email address, country and booked plan. | Slack Technologies Limited One Park Place, Floor 1, Hatch Street Upper Dublin 2, Ireland | EU, onward transfer to the USA under standard contractual clauses | Privacy policy |
Email delivery
Used to send transactional messages such as password resets and reports, and, if you subscribed, our newsletter.
| Service | Purpose | Processor | Place of processing | Documents |
|---|---|---|---|---|
| Brevo | Primary provider for transactional email and newsletter delivery. | Brevo GmbH Köpenicker Straße 126 10179 Berlin, Germany | European Union | Privacy policyData processing agreement |
| SendGrid | Fallback provider for transactional email. Delivery runs on Twilio EU infrastructure. | Twilio Ireland Limited 25-28 North Wall Quay Dublin 1, Ireland | European Union | Privacy policyData protection addendum |
Payment processing
Involved only if you take out a paid subscription. Which provider applies depends on how you booked.
| Service | Purpose | Processor | Place of processing | Documents |
|---|---|---|---|---|
| Stripe | Card and SEPA payments, subscription billing and invoicing for bookings made on our website. | Stripe Payments Europe Limited 1 Grand Canal Street Lower, Grand Canal Dock Dublin, D02 H210, Ireland | EU, onward transfer to the USA under standard contractual clauses | Privacy policyData processing agreement |
| PayPal | PayPal payments, including through the Braintree gateway. | PayPal (Europe) S.à r.l. et Cie, S.C.A. 22-24 Boulevard Royal L-2449 Luxembourg | European Union | Privacy policy |
| Apple | Processing of in-app purchases and subscriptions booked on iOS, iPadOS or watchOS. | Apple Distribution International Ltd. Hollyhill Industrial Estate, Hollyhill Cork, Ireland | EU, onward transfer to the USA under standard contractual clauses | Privacy policy |
| Google Play | Processing of in-app purchases and subscriptions booked on Android. | Google Ireland Limited Gordon House, Barrow Street Dublin 4, Ireland | EU, onward transfer to the USA under standard contractual clauses | Privacy policy |
AI features
Involved only when you actively use an AI feature, such as the assistant or automatic insights.
| Service | Purpose | Processor | Place of processing | Documents |
|---|---|---|---|---|
| OpenAI | Generating answers, summaries and insights from the content you submit to an AI feature. Your content is processed to answer your request only and is not used to train models. | OpenAI Ireland Limited 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper Dublin 1, D01 YC43, Ireland | EU, onward transfer to the USA under standard contractual clauses | Data processing addendumEnterprise privacy |
Website and reach measurement
These services relate to our website, not to the data in your account. Analytics and marketing tags load only after you consent in the cookie banner, and you can withdraw that consent at any time.
| Service | Purpose | Processor | Place of processing | Documents |
|---|---|---|---|---|
| Google Analytics, Google Ads | Reach and usage analysis of our website and apps, and conversion measurement for our advertising. Loaded only with your consent. | Google Ireland Limited Gordon House, Barrow Street Dublin 4, Ireland | EU, onward transfer to the USA under standard contractual clauses | Privacy policyAds data processing terms |
| Meta | Reach measurement for our advertising via the Meta pixel, loaded only with your consent, and the optional "Sign in with Facebook" login in our iOS app. | Meta Platforms Ireland Limited Merrion Road Dublin 4, D04 X2K5, Ireland | EU, onward transfer to the USA under standard contractual clauses | Privacy policyData processing terms |
| Reach and conversion measurement for our advertising on LinkedIn via the Insight Tag. Loaded only with your consent. | LinkedIn Ireland Unlimited Company Wilton Plaza, Wilton Place Dublin 2, Ireland | EU, onward transfer to the USA under standard contractual clauses | Privacy policy |
3. Services you connect yourself
Timesheet can be connected to third-party services at your request. Data is transmitted only after you have set up the connection yourself, and only to the extent you have authorised. The provider of the connected service is responsible for what it does with that data. You can disconnect an integration at any time in your settings.
Asana, Basecamp, ClickUp, FreshBooks, Google Calendar, Google Health, Monday, Notion, Outlook Calendar, QuickBooks, Xero.
4. International transfers
All contracting parties listed in section 2 are established in the European Union. Where a processor passes data to group companies or sub-processors outside the European Economic Area in order to deliver the service, it does so on the basis of the European Commission's standard contractual clauses together with supplementary safeguards. The place of processing is shown for each entry in the table.
5. Changes to this list
We update this page whenever we add or replace a sub-processor. Business customers with a data processing agreement are notified in advance of intended changes so that the contractually agreed right to object can be exercised.
6. Privacy Information
For more information about privacy and the processing of personal data, please refer to our Privacy Policy and our Data Processing Agreement.
If you have any questions about our sub-processors or data protection in general, please feel free to contact us at privacy@timesheet.io.
Last updated: August 12, 2026