Subprocessors
Last updated: October 2, 2026
These are the third-party providers that process personal data for Stunda in production. Each is bound by a contract with data protection terms, and transfers outside the EU and UK are covered by Standard Contractual Clauses or another valid mechanism. Workspace customers authorize these providers under our Data Processing Addendum.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Neon | Primary PostgreSQL database | All account, workspace, tracking and work data stored by the Service | Singapore |
| Fly.io | Hosting for the Stunda API | All data passing through the API | Singapore |
| Vercel | Hosting for the web app (app.stunda.io) and this website | Pages and requests passing through the web app, IP address and browser details | United States (global network) |
| Cloudflare (R2) | File storage for screenshots and uploaded images such as avatars and logos | Screenshots, profile pictures, workspace logos | Cloudflare network |
| Upstash | Redis for caching and rate limiting | Short-lived cached responses, counters and identifiers | Singapore |
| OpenAI | AI features (digests, questions, assistant, suggestions, report summaries) | The limited summaries described in the Privacy Policy: time totals, project, client and task names, descriptions, app names, website hosts, and window titles unless switched off. Never screenshots or input counts. | United States |
| Resend | Sending email (sign-in links, invitations, notifications, invoices, contact form messages) | Recipient email addresses and email content | United States |
| Polar | Merchant of record: sells subscriptions, takes payment, handles sales tax and VAT, issues receipts | Billing name and email, payment details (held by Polar), plan, seats and subscription status | United States |
| PostHog (US cloud) | Product analytics in the web app, only after consent | Chosen product events, account ID, email address and name | United States |
| Google (Tag Manager and Analytics) | Analytics on this website (stunda.io), only after consent | Page visits, IP address, browser details and cookie identifiers | United States |
| Google and GitHub sign-in | Optional sign-in with an existing account | Name, email address and profile picture shared at sign-in | United States |
| Browser push services (Apple, Google, Mozilla, Microsoft) | Delivering web push notifications, if you enable them | Notification content and the push subscription address | Depends on your browser |
Getting notified of changes
We update this page before adding or replacing a subprocessor, and email the owners of every workspace at least 14 days in advance. To also get notice as someone without a workspace, or to object to a change, email help@stunda.io.