Subprocessors

Infrastructure

Cloudflare, Inc. (United States, global network): hosting (Workers), the database (D1, created with EU jurisdiction so the data is stored in the EU), realtime per unit (Durable Objects), the roster solver (Containers), scheduled jobs and email delivery (Cloudflare Email Service). Receives all workplace and account data that eTime stores; names and contact details are stored encrypted.

AI features

OpenRouter, Inc. (United States): routes AI requests (chat, rule drafting from agreements, rule discovery for a country, drafting a setup) to the model host, with data collection disabled, so prompts aren't stored or used for training.

Anthropic, PBC (United States): runs the Claude models that answer those requests. We restrict OpenRouter to Anthropic as the only host.

What they receive: aliased text only. Before a request leaves eTime, names are swapped for aliases and contact details and ID numbers are removed, and a request that still holds a known name is blocked. Two exceptions you control: a screenshot you upload (you cover the names first) and a PDF agreement or handbook you import (sent as it is). These providers only receive content when someone uses an AI feature.

Email

Cloudflare Email Service (Cloudflare, Inc.) delivers sign-in codes and links, invitations, shift offers, meeting invitations and the Monday briefing. It receives the recipient's address and the message.

Notifications

Expo (650 Industries, Inc., United States) relays push notifications for the eTime phone app to Apple Push Notification service (Apple Inc.) and Firebase Cloud Messaging (Google LLC). They receive a device token and a generic message such as New shift offer, with no names, shift details or pay.

Web push notifications in the browser go through the push service of your browser's maker (Google, Mozilla, Apple or Microsoft). The message is encrypted for your browser, so the push service can't read it.

Payments

Stripe (Stripe, Inc., United States, and its affiliates, including Stripe Payments Europe, Ltd., Ireland) processes payments as merchant of record: checkout, invoices, tax and the billing portal. It receives the workplace name, plan and number of active people, plus the payment and billing details you give it. It never receives staff names or rosters. For payment data Stripe acts as an independent controller under its own privacy policy. Stripe's events reach eTime through Sansa Group's own billing relay, which runs on Cloudflare.

Services you choose to connect

These aren't our subprocessors; they act for you, and eTime only exchanges data with them when you connect them.

• Google Calendar (Google LLC) and Microsoft Outlook (Microsoft Corporation): if you link your calendar, eTime reads the start and end of your busy blocks and keeps your work in a separate eTime calendar there.
• Calendar apps that subscribe to your private eTime calendar feed fetch it from eTime with a secret link.

Website

Google Fonts (Google LLC, United States): the web app loads its typeface from Google, which receives visitors' IP address and browser details when the font files are fetched. No other data is sent.

Safeguards

Each subprocessor is bound by a data processing agreement. Transfers outside the EU/EEA and the UK rely on the EU–US Data Privacy Framework where the provider is certified, and on standard contractual clauses otherwise.

Updates

To be told about changes, email support@etime.my with the subject “Subprocessor updates”.