Sub-processors
Last updated: September 20, 2026
To run AgencyHours we rely on a small number of vetted third-party services. Under GDPR Article 28 these are our sub-processors (Danish: underdatabehandlere). This page lists every sub-processor that may process personal data on your behalf, what they do, where they process it, and the legal basis for any transfer outside the EU/EEA.
If you sign a Data Processing Agreement (DPA) with us, this list is the authoritative source of approved sub-processors. We publish changes here at least 30 days before a new sub-processor is added, so you have time to object.
Questions or objections: [email protected].
Core sub-processors
These are used to run the service for every customer.
| Sub-processor | Purpose | Data categories | Location | Transfer basis | |---|---|---|---|---| | Vercel Inc. | Application hosting, edge network | Account, workspace + request data | US / EU | SCC + EU-U.S. Data Privacy Framework | | Managed PostgreSQL provider (contact us for the current host) | Primary database + encrypted backups | All workspace content | EU (Frankfurt) | EU/EEA — no transfer | | Cloudflare, Inc. | DNS, CDN, DDoS protection | IP, request metadata | Global edge | SCC + EU-U.S. Data Privacy Framework | | Anthropic PBC | AI features (Refine / Expand / Summarize / Rewrite) when the workspace's AI is set to a Claude model | Time-entry text the operator asks to transform | US | SCC + Zero-retention policy |
Optional / customer-controlled sub-processors
These only receive data when you enable them from workspace settings, connect them, or configure them per workspace.
| Sub-processor | Purpose | Data categories | Location | Transfer basis | |---|---|---|---|---| | Stripe, Inc. | Payment processing (paid plans only) | Billing details, invoice metadata | US / EU | SCC + EU-U.S. Data Privacy Framework | | Dinero (Visma Dinero A/S) | Accounting export when you connect it | Client, invoice + tax data | EU (Denmark) | EU/EEA — no transfer | | e-conomic (Visma e-conomic A/S) | Accounting export when you connect it | Client, invoice + tax data | EU (Denmark) | EU/EEA — no transfer | | Your SMTP provider (Gmail, SendGrid, Amazon SES, Postmark, or self-hosted — you pick) | Outbound email (invoices, notifications, client reports) | Recipient address, message content | Varies with provider | Determined by your provider agreement | | OpenAI / other AI provider | AI features if the workspace's AI is set to a provider other than Anthropic | Time-entry text the operator asks to transform | Depends on provider | SCC where applicable | | Atlassian (Jira Cloud) | Task ingest when you connect Jira | Issue + comment metadata for imported tickets | EU / US | SCC + EU-U.S. Data Privacy Framework | | Google LLC (Google Calendar) | Meeting ingest when you connect a Google account | Event titles, times, attendees | US | SCC + EU-U.S. Data Privacy Framework | | Slack Technologies, LLC | Slack notifications when you configure a workspace webhook | Notification text (member names, timesheet summaries) | US | SCC + EU-U.S. Data Privacy Framework |
What we don't share
We never share your data with advertising networks, data brokers, or analytics providers. We don't use marketing or third-party tracking cookies. We don't sell your data.
Change history
We update this page whenever a sub-processor is added, removed, or replaced. Material changes are announced to workspace owners at least 30 days in advance.
- 2026-09-20 — Initial publication.