| Hostinger International Ltd |
Hosting and database |
Platform data, application logs |
Malaysia |
Core infrastructure |
| Telegram FZ-LLC / Telegram Messenger Inc |
Messaging for check-in/out and approvals |
Telegram usernames, IDs, messages, shift notes |
Global / distributed |
No card or payment data sent to chat |
| Stripe |
Billing and subscription payments |
Billing email, business name, payment identifiers |
Australia / United States (and Stripe's processing regions) |
Hosted checkout; we do not store full card numbers |
| OpenRouter Inc and model providers it routes to |
Narrow AI text structuring of shift notes |
Shift notes and similar free text after identifier tokenisation |
Includes the United States |
Common personal identifiers in free text are tokenised before the model call |
| Google (Maps Geocoding) |
Turning map pins / coordinates into a place label when a site location is set |
Coordinates or map links you supply |
United States / Global |
Only when geocoding a site location |
| OpenStreetMap Nominatim |
Reverse geocoding fallback for place labels |
Coordinates |
Global (OSM community infrastructure) |
Only when geocoding a site location |
| Resend (Plus Five Five, Inc.) |
Transactional email (welcome, login links, password resets, invites, notices) |
Recipient email, name, email content, one-time links |
United States |
TLS in transit |
| Google Analytics 4 |
Product and site usage analytics |
Pseudonymised client IDs, event types |
United States |
Only if enabled; no names, emails or raw timesheet contents |
| Google Drive |
Customer-connected file storage |
Files the customer chooses to store or export there |
Per the customer's Google account |
Only if you connect it |
| Xero |
Customer-connected accounting |
Data the customer authorises via OAuth |
Per Xero's regions for the connected organisation |
Only if you connect it |
