Sub-processors
Last updated: September 30, 2026
A sub-processor is a company we use to run UseTimio that may handle personal data in the process. This is the complete list. Each one is bound by its own data processing terms, gets only the data its function requires, and may not use it for anything else.
1. Infrastructure
These providers store or transmit customer data as part of running the platform itself.
| Provider | What it does for us | Data it can touch | Where it operates |
|---|---|---|---|
| Vercel | Application hosting and content delivery | Everything that passes through the application, in transit | United States, global edge network |
| MongoDB Atlas | Managed database — the primary store for all customer data | Accounts, members, attendance, billing records, communications | Cloud region assigned to our cluster |
| Cloudflare | R2 object storage for uploads and database backups; Turnstile bot protection on public forms | Logos, uploaded images, proof-of-payment files, encrypted database backups | Global |
| Upstash | Managed Redis for background jobs, scheduling and rate limiting | Job payloads while they run — recipients and message text for a queued send | Cloud region assigned to our instance |
2. Product services
These receive data only when a specific feature is used — sending a message, taking a payment, asking the AI assistant for a draft.
| Provider | What it does for us | Data it receives | Where it operates |
|---|---|---|---|
| Resend | Transactional and bulk email delivery | Recipient name and email address, message content | United States / EU |
| 80kobo SMS | Bulk SMS delivery | Recipient phone number, message content, sender name | Nigeria |
| Flutterwave | Payment processing, subscription charges and affiliate bank payouts | Payer name and email, amount, card or bank details entered on their page, payout bank account | Nigeria / Africa |
| Google (Gemini API) | Optional AI drafting of communications, and the website support chat | Only the prompt text typed into those features, and messages sent to our WhatsApp line | United States |
| Meta (WhatsApp Business Platform) | Our WhatsApp sales and support line | The phone number, profile name and messages of people who write to us on WhatsApp | Global |
3. Analytics on the public website
These run on the marketing site, not inside your workspace. They do not receive attendance records or member data. See the Cookie Policy for what is stored in your browser.
| Provider | What it does for us | Data it receives | Where it operates |
|---|---|---|---|
| Umami | Privacy-friendly website analytics | Page views, referrer, approximate country. No cookies, no cross-site identifiers | Hosted instance |
| Google Analytics 4 | Marketing site traffic measurement, where enabled | Page views, device and browser type, approximate location, an analytics identifier | United States |
| Meta (Pixel and Conversions API) | Measuring which of our Facebook and Instagram ads lead to signups and paid plans. Public pages and the account owner dashboard only, never worker check-in pages | Page views, a browser identifier, and for account owners who sign up: email address and phone number, hashed before they are sent | Global |
4. What we require of them
- A written data processing agreement, or equivalent terms, before any customer data reaches them.
- Confidentiality obligations, and security measures appropriate to what they handle.
- Use of the data strictly to provide the service to us — no independent use, no resale.
- Recognised transfer safeguards where data leaves Nigeria, the EEA or the UK.
We remain responsible to you for what our sub-processors do with your data, as set out in the Data Processing Agreement.
5. Changes to this list
When we add or replace a sub-processor that handles customer personal data, we update this page and email organization owners at least 14 days before the change takes effect. If you object to a new sub-processor on reasonable data protection grounds, tell us within those 14 days: we will try to offer an alternative, and if there is none, you may cancel your subscription and receive a pro-rata refund of the unused period.
To be notified of changes, email info@usetimio.com with “Sub-processor notifications” in the subject line.
Who to contact
Spent Digital Lab Limited operates UseTimio. Write to info@usetimio.com with “Legal”, “Privacy” or “Security” in the subject line and it reaches the right person. Post reaches us at 3 Idishin Street, Surulere, Ondo, Ondo State, Nigeria; the phone line is +234 902 346 6899.
This document describes how UseTimio works and the commitments we make. It is not legal advice. Organizations with specific regulatory obligations should have it reviewed by their own counsel.
Other documents
- Terms of ServiceThe agreement that governs your organization’s use of UseTimio.
- Acceptable Use PolicyWhat you may and may not do with the platform, and how we enforce it.
- Billing, Refund & Cancellation PolicyHow subscriptions, credits, renewals, refunds and cancellations work.
- Privacy PolicyWhat personal data we collect, why we hold it, and the rights you have over it.
- Data SafetyA plain-language, item-by-item account of every category of data UseTimio collects, why, who sees it and how long it is kept.
- Cookie PolicyThe cookies and local storage UseTimio sets, what each one does, and how to control them.
- Data Processing AgreementThe controller-to-processor terms that apply when UseTimio processes your employees’ or members’ personal data.
- Security PracticesHow accounts, tenant data, backups and our infrastructure are protected day to day.
- ComplianceOur position under the Nigeria Data Protection Act, the GDPR and payment-industry rules, and how we handle data-subject requests and breaches.