Sub-Processors
Last updated: May 4, 2026
EventTime is operated by Ömral Cörüt, an independent developer based in Turkey. To run the service we share limited personal data with the third-party providers listed below (“sub-processors”). Each operates under their own privacy policy and Data Processing Agreement (DPA), linked in the table.
We will update this page when sub-processors are added or removed. If you have a contractual right to advance notice of sub-processor changes (for example under our DPA), email contact@eventtime.app and we will add you to that notification list.
Current sub-processors
| Provider | Purpose | Data | Location | Legal |
|---|---|---|---|---|
| Supabase, Inc. | Postgres database, authentication, file storage | Account email, hashed password, name, app metadata you save (app names, store URLs, categories, regions, notes) | United States — data hosted in the EU (Frankfurt) region | PrivacyDPA |
| Vercel Inc. | Web hosting, edge network, deployment, page-level analytics | IP address, request metadata, aggregated page-view stats (cookie-less) | United States — global edge network | PrivacyDPA |
| Resend, Inc. | Transactional email delivery (signup confirmation, password reset, event reminders, billing notifications) | Account email, name, message contents (event names, dates, app names referenced in the email) | United States | PrivacyDPA |
| Lemon Squeezy (Lemon Squeezy LLC) | Payment processing, subscription management, Merchant of Record | Account email, name, billing address, payment-method tokens (card details never reach EventTime) | United States | PrivacyDPA |
Data Processing Agreement (DPA)
If you are a customer subject to GDPR, UK GDPR, or another regulation requiring a written DPA between controller and processor, we are happy to sign one. Email contact@eventtime.app with your company name and address and we will return a counter-signed DPA, including the sub-processor list above as Annex.
Cross-border transfers from the EU/UK to the United States are covered by the Standard Contractual Clauses (SCCs) included in each sub-processor’s DPA.
International transfers
Your account and app data is stored in Supabase’s EU (Frankfurt) region. Resend, Lemon Squeezy, and Vercel are based in the United States; data sent to them is protected by the SCCs referenced in their DPAs.
Questions or requests
For any privacy or sub-processor question — including objections to a new sub-processor — email contact@eventtime.app. See the Privacy Policy for the full list of your rights and how to exercise them.