Subprocessors
Last updated: October 2, 2026
These are the companies that process personal data on our behalf to run Planra. This list is Annex III of our Data Processing Agreement and is referred to in our Privacy Policy.
1. Subprocessors we use
| Company | What for | Personal data it receives | Location | Transfer safeguard |
|---|---|---|---|---|
| Clerk, Inc. | Sign-in, user accounts, sessions, subscription billing | Name, email, profile picture, sign-in methods, session data, IP address, browser user agent, plan and subscription status | United States | Standard Contractual Clauses |
| Stripe, Inc. (through Clerk Billing) | Card payment processing | Card details, billing name, email and address, payment history | United States | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Supabase, Inc. | Database, file storage and realtime messaging | All account data and workspace content, uploaded files, logs described in our Privacy Policy | the United States (US East) | Standard Contractual Clauses |
| Vercel Inc. | Application hosting, serverless functions and content delivery | All data in transit between your browser and our servers; request logs including IP address | United States (with a global edge network) | Standard Contractual Clauses |
| Google LLC — Gemini API | Planra AI features, audio transcription and the workspace search index | Text, task data, audio and documents sent by the AI features you use. Content sent to Google’s unpaid Gemini API service may be used by Google to improve its products and may be read by human reviewers (see Privacy Policy, section 4). | United States | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Resend, Inc. | Sending service emails (invitations, notifications, signing links) | Recipient name and email address, email content | United States | Standard Contractual Clauses |
| Inbound email provider (Postmark, SendGrid or Mailgun) | Receiving emails sent to a workspace’s intake address — only when email-to-task is switched on | Sender address, subject, body and attachments of those emails | United States | Standard Contractual Clauses |
2. Services you choose to connect
The services below are not our subprocessors. They receive data only when you or a workspace member connects them, and they process it under your own agreement with them:
- Google Workspace (Calendar, Docs, Sheets, Drive)
- Slack, Discord, GitHub, Linear and Atlassian Jira
- Your own AI provider: OpenAI, Anthropic, or any OpenAI-compatible endpoint you configure
- MCP clients and API callers you give a key to (for example Claude Desktop, Cursor or n8n)
- Webhook destinations you configure (for example Zapier, Make or n8n)
3. Changes to this list
We will update this page, and the date at the top, at least 30 days before a new subprocessor starts processing personal data, unless we must act sooner to keep the service running or secure. To be told by email, write to privacy@planra.co. Customers with a Data Processing Agreement may object to a new subprocessor within that 30-day period, as set out in the DPA.