Sub-processors
EasyWeek GmbH engages the sub-processors listed below to deliver the EasyWeek Business Service. This page forms Annex III of the EasyWeek Data Processing Addendum and is updated whenever the list changes.
Last updated: 15 May 2026
Cross-border data transfers (DPDP Act 2023, Sec. 16): EasyWeek GmbH transfers personal data of data principals to the sub-processors listed below, which may involve processing outside India. Such transfers are conducted in accordance with Section 16 of the Digital Personal Data Protection Act, 2023 and any rules or notifications issued thereunder by the Government of India. Customers who are data fiduciaries under the DPDP Act 2023 remain responsible for ensuring their own compliance obligations with respect to cross-border transfers of personal data of Indian data principals.
1. How we use sub-processors
A sub-processor is a third party engaged by EasyWeek that processes Customer Personal Data on EasyWeek's behalf as part of delivering the EasyWeek Business Service. Each sub-processor is bound by a written contract that imposes data-protection obligations no less protective than those between EasyWeek and the Customer. EasyWeek remains fully responsible to the Customer for the acts and omissions of its sub-processors.
Where sub-processors are located outside India, transfers of personal data of Indian data principals to those sub-processors are carried out in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), Section 16, and any restrictions or conditions notified by the Government of India from time to time. EasyWeek ensures that appropriate contractual safeguards are in place with each sub-processor to protect such transferred data.
The full conditions are set out in our Data Processing Addendum.
2. Notice of changes and right to object
EasyWeek announces additions and replacements of sub-processors at least thirty (30) days in advance through:
- The in-app notification centre of EasyWeek Business
- This page (the "Last updated" date is bumped on every change)
- Email to Customers who have subscribed to the change-notice mailing list (see Section 5)
Customers may object on reasonable, documented data-protection grounds within thirty (30) days of the notice. See Section 7 of the DPA for the resolution procedure.
3. Current list
Infrastructure and hosting
| Sub-processor | Purpose | Categories of data | Processing region |
|---|---|---|---|
| Hetzner Online GmbH (Germany) | Primary application and database hosting, Kubernetes infrastructure, network | All Customer Personal Data stored in the Service | Falkenstein, (EU) |
| Google Cloud EMEA Limited (Google Cloud Storage) | Object storage for files uploaded to the Service (photos, exports, documents) | Customer files | EU multi-region |
| Cloudflare, Inc. | Content delivery network, DDoS protection, edge routing, WAF | Request metadata, IP address, headers | EU-routed for EEA traffic |
Payments and billing
| Sub-processor | Purpose | Categories of data | Processing region |
|---|---|---|---|
| Stripe Payments Europe Ltd. | Subscription billing and payment card processing for EasyWeek subscription fees | Customer billing data, last 4 digits of card, transaction history | Ireland (EU); cross-border transfers to Stripe Inc. (US) conducted in compliance with DPDP Act 2023, Sec. 16 |
Note on cross-border data transfers: EasyWeek processes personal data of Indian data principals through certain sub-processors located outside India. Such transfers are conducted in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Section 16. EasyWeek will comply with any restrictions on cross-border data transfers notified by the Government of India under the DPDP Act.
Communications
| Sub-processor | Purpose | Categories of data | Processing region |
|---|---|---|---|
| Twilio Ireland Limited | SMS and WhatsApp messages sent through the Service | Recipient phone number, message body, delivery status | Ireland (EU); cross-border transfers to the US conducted in compliance with DPDP Act 2023, Sec. 16 where required |
| Postmark (Wildbit, LLC) | Transactional email delivery (booking confirmations, password resets, receipts) | Recipient email address, message body, delivery status | EU region; cross-border transfers to the US conducted in compliance with DPDP Act 2023, Sec. 16 |
Customer support
| Sub-processor | Purpose | Categories of data | Processing region |
|---|---|---|---|
| Chatwoot, Inc. | In-app support chat, ticket management | Ticket content, attachments, contact details of the requester | EU (self-hosted instance under EasyWeek operational control) |
Monitoring, analytics, and developer tooling
| Sub-processor | Purpose | Categories of data | Processing region |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error monitoring and crash reporting | Pseudonymised stack traces, technical context | EU instance |
| Segment Inc. (Twilio Segment) | Product analytics event routing | Pseudonymised event data, hashed identifiers | EU region |
| Google Ireland Limited (Google Analytics 4) | Aggregated traffic analytics on EasyWeek public-facing surfaces (subject to cookie consent) | Pseudonymised pageview data, region, device class | EU; cross-border transfers to the US conducted in compliance with DPDP Act 2023, Sec. 16 |
AI features
| Sub-processor | Purpose | Categories of data | Processing region |
|---|---|---|---|
| Anthropic PBC (Claude API) | Powers AI assistant and AI summary features within EasyWeek | Indexed Customer-public content and the AI conversation in scope of the user request | United States — engaged under a Zero Data Retention agreement (no training on Customer data, no retention beyond the API request); cross-border transfer conducted in compliance with DPDP Act 2023, Sec. 16 |
| Typesense Cloud (Typesense, Inc.) | Search index for catalog and listings | Public catalog data (business name, services, location) | EU |
| Qdrant Cloud (Qdrant Solutions GmbH) | Vector database for AI retrieval-augmented generation | Embeddings of Customer-public content | Germany (EU) |
Internal operations
| Sub-processor | Purpose | Categories of data | Processing region |
|---|---|---|---|
| n8n GmbH | Workflow automation for internal operations | Limited operational data routed through specific automations | Berlin, (EU) |
4. Affiliates
EasyWeek does not currently have affiliate entities that process Customer Personal Data on behalf of the Customer. Should this change, the affiliate will be added to this list in accordance with Section 2.
5. Subscribe to change notices
To receive email notifications when this list changes, write to privacy@easyweek.io with the subject line "Subscribe — sub-processor notices" and the email address that should be subscribed.
For questions about a specific sub-processor or to request additional information about the safeguards that apply, contact us at the same address.
Cross-border data transfers (DPDP Act 2023, Section 16): EasyWeek transfers personal data of data principals to sub-processors located outside India. Such transfers are conducted in accordance with Section 16 of the Digital Personal Data Protection Act, 2023, and any restrictions notified by the Central Government thereunder. Data principals who have questions about the countries to which their personal data is transferred or about the applicable safeguards may contact privacy@easyweek.io.
See also: Data Processing Addendum · Business Privacy Policy · Legal Information.
