These are the companies we use to run the hosted Taskr service. Each one handles personal data only to provide its service to us, under a written agreement. For business customers, this is the list of subprocessors under our Data processing agreement.
We will update this page at least [[TO CONFIRM: 30 days]] before we add or replace a
subprocessor, and email workspace owners who have asked to be told. A business customer can
object to a new subprocessor as described in the DPA.
[[TO CONFIRM: the location and transfer mechanism of each provider, and each DPA link, before this page is published; links marked below were not verified]]
Subprocessors in use
| Company | What it does for Taskr | Personal data | Where | Terms |
|---|---|---|---|---|
Our server host [[TO CONFIRM: VM provider and legal entity]] |
The virtual machine that runs the app, API, MCP server, database and file storage | Everything stored in Taskr | United Kingdom | [[TO CONFIRM link]] |
| Cloudflare, Inc. | DNS, the encrypted tunnel to our server, TLS and content delivery for the app, API and MCP server | All traffic, including IP addresses, request headers and the content of requests and responses in transit | Global network; company in the United States | Customer DPA |
| Vercel Inc. | Hosts the website taskr.bbdev.app | Visitors’ IP addresses and request details in its logs | Global network; company in the United States | DPA |
| Resend (Plus Five Five, Inc.) | Sends email: sign-in codes, invitations, notifications and digests | Email addresses, names, and the text of the email (for example issue titles and comment excerpts) | United States [[TO CONFIRM: region]] |
DPA [[TO CONFIRM link]] |
| OpenRouter, Inc. | Routes requests from Taskr’s AI features to AI models, with zero data retention required | The content of AI requests: issue text, comments, doc pages, planning messages, feedback, pull request changes (secrets removed, emails masked) | United States; EU endpoints when a workspace chooses “EU only” | Privacy policy · DPA [[TO CONFIRM link]] |
| AI model providers reached through OpenRouter | Run the models. Only endpoints OpenRouter lists as zero data retention are used; today these include Google (Vertex AI), Amazon (Bedrock), Mistral and other providers serving DeepSeek and OpenAI open-weight models | As for OpenRouter, for the requests each one serves | Varies; EU only when chosen | [[TO CONFIRM: whether these are our subprocessors or OpenRouter's, and how to list them]] |
| GitHub, Inc. | Sign-in with GitHub; the Taskr GitHub Apps that read repositories and, for remote agents, push branches and open draft pull requests | GitHub account id, login, name, email and avatar; repository data | United States | Data Protection Agreement |
| Apple Inc. | Delivers push notifications to Taskr for iOS (APNs); distributes the app | Device push token and notification text (for example an issue title or comment) | United States | Privacy policy |
Used only when a workspace turns them on
| Company | When | Personal data | Where | Terms |
|---|---|---|---|---|
| Anthropic, PBC | Remote agents (the Taskr Worker) run on Claude using the workspace’s own Anthropic API key, under the workspace’s own agreement with Anthropic. We pass the requests on the workspace’s instruction. | Issue content, repository code and tool output in the agent’s requests | United States | Privacy policy |
Sandbox provider [[TO CONFIRM: E2B, or Docker on our own server]] |
Runs remote agents and sandboxes | Repository code, the running app, test recordings | [[TO CONFIRM]] |
[[TO CONFIRM link]] |
Planned, not yet used
| Company | Will do | Personal data | Where | Terms |
|---|---|---|---|---|
Stripe Payments Europe, Ltd. or Stripe, Inc. [[TO CONFIRM: payment provider and contracting entity]] |
Card payments and subscriptions | Workspace owner’s name and email, billing address, card details (held by Stripe, never by us), subscription and invoice records | [[TO CONFIRM]] |
DPA |
[[TO CONFIRM: whether production uses an outside provider for object storage (S3), embeddings, or tracing (OTLP); if so, each is added above]]
Not subprocessors
- Services your workspace connects, such as webhook endpoints, agents you run yourself, or your own OpenRouter key, receive data because you told Taskr to send it. They work for you, not for us.
- jsDelivr serves the diagram library to Taskr for iOS when you open a diagram. It sees the device’s IP address but no Taskr data.
Contact
Questions to contact@bbdev.app.