This page lists the third parties that Process Customer Personal Information in connection with the ProjectPacer Service, as contemplated by Section 6 of our Data Processing Addendum. We keep it current, and we give notice of new subprocessors as described there.
We keep this page current. For a change that materially affects how your data is processed — a new category of data, a new location, or a materially different security posture — we email subscribers at least 30 days in advance, so you have time to raise a good-faith objection under DPA Section 6.2. For routine changes, such as replacing a provider with an equivalent one under the same protections, we update this page but don’t run the 30-day process. Either way, every subprocessor is bound to protections no less strict than our DPA.
Infrastructure & operational subprocessors
These providers are engaged by ProjectPacer to run and support the Service. They Process Customer Personal Information on our behalf and under obligations no less protective than our DPA.
| Provider | What it does | Data it Processes | Location |
|---|---|---|---|
| Render Services, Inc. | Application hosting and managed PostgreSQL database — the Service runs here and your Customer Data is stored here. | All Customer Data held in the Service. | United States |
| Cloudflare, Inc. | Encrypted off-site storage for our routine database backups (Cloudflare R2). | Backup copies of Customer Data. | United States |
| Resend, Inc. | Delivery of transactional email — sign-in, verification, notifications, and legal notices. | Recipient name and email address, and the contents of those messages. | United States |
| Google LLC (Google Workspace) | Business email and calendar — hosts our support inbox and the internal correspondence we use when responding to your requests. | Names, email addresses, and the contents of support correspondence, including any Customer Data you choose to include in a support request (for example, a screenshot or an exported file you send us). We do not routinely export Customer Data from the Service into Workspace. | United States |
| Mapbox, Inc. | Geocoding and directions for the travel-time and mileage features — only used if you use those features. | The addresses you enter for a travel or mileage estimate — never your time entries. | United States |
| Apple Inc., Google LLC, and Mozilla Corporation (browser push services) | Deliver the browser notifications you opt into, by relaying our messages to the browser or installed app you enabled them in. Which service is used is determined by that browser or app, not by us — only used if you turn on browser notifications. | The push endpoint issued by your browser and the notification payload, which is encrypted end-to-end so the relaying service cannot read it, plus routing metadata (such as delivery timing). No time entries or Customer Data content. | United States |
Addresses are sent to Mapbox only when you enter one for a travel-time or mileage estimate. If you never use those features, no address data leaves the Service.
Nothing is sent to a browser push service unless you turn on browser notifications in that browser or installed app. When you do, the notification content is encrypted end-to-end (Web Push), so Apple, Google, or Mozilla relay it without being able to read it. Turn browser notifications off, or clear them in your browser or app, and the stored subscription is deleted.
Optional integrations you connect
These services Process data only if you choose to connect your own account. When you do, data flows because you authorized that connection, and the third party’s own terms and privacy policy also govern its handling of that data. You can disconnect any of them at any time in Settings.
| Integration | What it does | Data exchanged | Provider |
|---|---|---|---|
| Calendar (ICS) | Reads your calendar feed to suggest time entries from events. | Event times, titles, and details from the feed URL you provide (e.g. Google, Apple, or Microsoft calendars). | The calendar provider you connect |
| Slack | Corroborates activity for suggestions and sends you notifications you opt into. | Message and presence timestamps and metadata for attribution, and the content of notifications we send you. | Slack Technologies, LLC |
| GitHub | Two-way sync between GitHub issues and your tasks. | Issue titles, bodies, states, and identifiers for the repositories you connect. | GitHub, Inc. |
| Clockify | One-time or ongoing import of time entries. | The time-entry, project, and client data in the Clockify account you connect. | Cake.com Inc. |
| AI assistant (MCP) | Connects an AI assistant you choose to your workspace over the Model Context Protocol, so it can read and update your data as you, at your direction. | Whatever the assistant reads, or you ask it to change — such as your time entries, projects, and clients — passes to that assistant when you use it. | The AI-assistant provider you connect |
Because you connect your own account, your use of Slack, GitHub, Clockify, a calendar provider, or a connected AI assistant is also subject to that company’s terms and privacy policy. ProjectPacer isn’t responsible for how those services handle data on their side — see Section 12 of the Terms.
ProjectPacer does not currently send Customer Personal Information to any third-party AI provider — today’s suggestions are generated by our own logic, not an external model. When we introduce AI-assisted features that rely on a third-party model, we’ll add that provider here and, for any change that materially affects the Processing, give notice under DPA Section 6.2. Any such provider will be contractually barred from using your data to train its models, consistent with DPA Section 4.2. This is separate from an AI assistant you connect yourself over MCP (listed above): that assistant accesses your data as you, at your direction, and is governed by its own provider’s terms — not engaged by us to Process data on our behalf.
Questions
To raise an objection to a subprocessor, or with any question about this page, contact us at support@projectpacer.com.