Sub-Processors
Last updated: May 4, 2026
EventTime is operated by Ömral Cörüt, an independent developer based in Turkey. To run the service we share limited personal data with the third-party providers listed below ("sub-processors"). Each operates under their own privacy policy and Data Processing Agreement (DPA), linked in the table.
We will update this page when sub-processors are added or removed. If you have a contractual right to advance notice of sub-processor changes (for example under our DPA), email contact@eventtime.app and we will add you to that notification list.
Current sub-processors
| Provider | Purpose | Data | Location | Legal |
|---|---|---|---|---|
| Supabase, Inc. | Postgres database, authentication, file storage | Account email, hashed password, name, app metadata you save (app names, store URLs, categories, regions, notes) | United States — data hosted in the EU (Frankfurt) region | PrivacyDPA |
| Vercel Inc. | Web hosting, edge network, deployment, page-level analytics | IP address, request metadata, aggregated page-view stats (cookie-less) | United States — global edge network | PrivacyDPA |
| Resend, Inc. | Transactional email delivery (signup confirmation, password reset, event reminders, billing notifications) | Account email, name, message contents (event names, dates, app names referenced in the email) | United States | PrivacyDPA |
| Lemon Squeezy (Lemon Squeezy LLC) | Payment processing, subscription management, Merchant of Record | Account email, name, billing address, payment-method tokens (card details never reach EventTime) | United States | PrivacyDPA |
| Functional Software, Inc. (Sentry) | Error monitoring and (with consent) session replay for debugging client-side bugs | IP address, user ID, browser metadata, error stack traces. Session replays mask all text, inputs, and media by default and only run when you accept the cookie notice. | United States — EU region (Frankfurt) used for EventTime | PrivacyDPA |
| Cloudflare, Inc. | Bot protection (Turnstile) on signup, login, and password-reset forms | IP address, browser metadata, challenge token. Turnstile is privacy-preserving and does not use third-party tracking cookies. | United States — global edge network | PrivacyDPA |
Data Processing Agreement (DPA)
If you are a customer subject to GDPR, UK GDPR, or another regulation requiring a written DPA between controller and processor, we are happy to sign one. Email contact@eventtime.app with your company name and address and we will return a counter-signed DPA, including the sub-processor list above as Annex.
Cross-border transfers from the EU/UK to the United States are covered by the Standard Contractual Clauses (SCCs) included in each sub-processor's DPA.
International transfers
Your account and app data is stored in Supabase's EU (Frankfurt) region. Sentry events are routed to Sentry's EU region. Resend, Lemon Squeezy, and Vercel are based in the United States; data sent to them is protected by the SCCs referenced in their DPAs.
Questions or requests
For any privacy or sub-processor question — including objections to a new sub-processor — email contact@eventtime.app. See the Privacy Policy for the full list of your rights and how to exercise them.