NeoKaam Subprocessors
Last updated: October 28, 2026
Draft — pending legal review.
These are the third-party services we rely on to run NeoKaam, and the personal data each one can see. This page is referenced by section 5 of our Data Processing Addendum; changes are published here before a new provider starts processing.
Rows that begin “only when” are optional providers, listed for completeness even while the feature that uses them is switched off. A bracketed [to confirm: …] note marks a detail this draft has not yet verified.
NeoKaam is published by Sumit Sourabh and is also distributed under the name Tickbox; the same service, the same account, and this same policy cover both, on the web and in the iOS and Android apps.
| Provider | What it does | Data it can see | Where |
|---|---|---|---|
| Hetzner Online GmbH | Server and database hosting | All application data | [to confirm: hosting region — verify in the hosting console] |
| Cloudflare, Inc. | DNS, CDN, TLS termination, bot protection, email routing | IP addresses, request metadata, inbound support email | Global edge network; US-headquartered |
| Cloudflare R2 | Storage for file attachments | Files you attach to tasks | [to confirm: bucket jurisdiction — verify in the Cloudflare R2 dashboard] |
| Resend (Plus Five Five, Inc.) | Transactional and notification email | Email address, name, message content | United States |
| Stripe, Inc. | Card payments and subscription billing | Billing contact and payment metadata (card details never reach us) | United States / EU |
| Razorpay Software Private Limited | Payments for customers billed in Indian rupees | Billing contact and payment metadata | India |
| Dodo Payments | Merchant of record for plans billed in US dollars: the legal seller of those subscriptions, which also collects sales tax or VAT and handles refunds and chargebacks. Only when US-dollar billing is enabled for your deployment. | Billing contact (name, email address, country) and payment metadata (card details never reach us) | Global; India-headquartered |
| Apple Inc. | App Store distribution, in-app purchases, Sign in with Apple, push notifications | Purchase records, device push tokens, Apple account identifier | United States / global |
| Google LLC | Google Play distribution and billing, Google sign-in | Purchase records, Google account identifier | United States / global |
| Anthropic PBC | AI extraction of task lists from spreadsheets, documents, photos and voice notes you import, and matching a voice update to the existing tasks it names, and (only if you turn on voice personalization) choosing the project and teammates for a voice import, or a project for each task and the tasks to update across your projects | The content of a file or message you explicitly submit for import, and the names of the chosen project's members when you choose a project before the import runs; only when you ask a voice recording, a dictation or typed text to update existing tasks, also the open, non-secret tasks of the project you chose (titles, status, priority, due dates, assignees' names, description starts, subtask titles); only with voice personalization turned on, also, with each voice import, the saved profile, project names, teammates' names and the nicknames taught for them, and up to 10 recent open task titles per project — or, when the AI picks the project for each task, up to 60 projects with up to 30 teammates' names each and up to 250 open tasks across them (title, project, due date, status, priority, assignees' names, the first 80 description characters, up to 3 open subtask titles) — never secret ones; and, to write or rewrite the profile when the person turns it on, asks for a refresh, and about once a week, the same project, teammate, nickname and task data plus how many tasks each teammate was given in the last 90 days, but not the saved profile itself | United States |
| Better Stack (BetterStack s.r.o.) | Uptime monitoring and log storage | Application error logs (user IDs only, never names or email addresses) | [to confirm: log storage region — verify in the Better Stack console] |
| Functional Software, Inc. (Sentry) | Error tracking | Error messages, stack traces, and a user ID — never a name or email address | United States |
| Meta Platforms (WhatsApp Business Platform) | Delivering the messages you forward to our import bot. Only when the WhatsApp task-import feature is enabled for your deployment; it is off by default. | Your WhatsApp number and the message, file, photo or voice note you forward to the bot | [to confirm: contracting entity and region — a business solution provider may sit in front of Meta] |
| Hetzner AI inference endpoint | Reading text out of a photo you send for import. Only when the deployment selects this provider for vision; the default provider is Anthropic. | Only the photo you explicitly submit for import | [to confirm: inference region — verify in the provider console] |
| Groq, Inc. (speech-to-text) | Writing down the words of the audio you submit for import: a recording made in the phone app or in the browser, an audio file you upload, or a voice note you send to the WhatsApp bot when that feature is enabled. We use Groq's hosted Whisper model; a self-hosted model on our own server can be used instead, which involves no third party. | Only the audio you explicitly submit for import, and the language you chose for it, if any | United States |
Objecting to a subprocessor
If you object to a new subprocessor on reasonable data-protection grounds, write to [email protected] and we will try to resolve it. If we cannot, you may terminate the affected part of the service.
The AI import providers are engaged only for content you explicitly submit for import. Except for the chosen project's member names and what a voice update or voice personalization adds (see the Anthropic row above), nothing else in your account is ever sent to them.