Who we use
A subprocessor is a company that handles personal data on our behalf. Hosts are not on this list: they receive the details of the people who book them, and handle them under their own responsibility. See the privacy policy for the legal basis and retention.
| Vendor | Purpose | Data it handles | Region | Its privacy policy |
|---|---|---|---|---|
| Amazon Web Services | Hosting of the application and its database. | Everything Haabtime stores: accounts, bookings, encrypted calendar tokens, logs. | eu-west-3 (Paris) | Privacy policy |
| Cloudflare | DNS and traffic proxy in front of haabtime.com. | IP address and request details of everyone who visits. | Global network | Privacy policy |
| Sign-in and Google Calendar for hosts who connect it. | Account name, email and ID, the list of calendars, free/busy times, and the events Haabtime creates for bookings. | Global | Privacy policy | |
| Microsoft | Outlook calendar, only for hosts who connect it. | Account name, email and ID, the list of calendars, free/busy times, and the events Haabtime creates for bookings. | Global | Privacy policy |
| PostHog | Product analytics and masked session replay, only if you accept the analytics banner. | Page addresses, clicks and scrolling, browser and device type, and masked replays. Signed-in hosts are linked to their account ID; guests are not identified. | EU | Privacy policy |
| Resend | Sending account confirmation emails to people signing up, invitations to join an organization, and booking emails: confirmations, reminders, cancellations and follow-ups. | Names and email addresses of the invitee and the host, and the booking details in the message. For sign-ups: the email address and name from your Google or Microsoft account. For invitations: the address the invitation is sent to, the inviter’s name (or email address if there is no name) and the organization’s name. | EU sending region. Resend is a US company, so see “International transfers” in the privacy policy. | Privacy policy |
| Sentry | Error monitoring and performance traces. | Error reports and traces. Configured not to send request bodies or user identifiers. | EU | Privacy policy |
| Stripe | Haabtime subscription billing, and payments on hosts’ own connected Stripe accounts. | Payment details entered at Stripe checkout, which never reach Haabtime, plus account, customer and payment IDs. Stripe acts as an independent controller for its own compliance and fraud prevention. | Global | Privacy policy |
How this list changes
We update this page when we add or replace a subprocessor, and change the date at the top. For a change that affects hosts’ data in a material way we also email hosts or show a notice in the dashboard, as the privacy policy describes.
Questions: [email protected]. A plain-language overview is on How we handle your data.