About this page
TimeGraphics uses a limited number of third-party service providers ("subprocessors") to operate and maintain the Service. This page lists each subprocessor, the categories of data they process, their purpose, and location. All subprocessors are contractually bound to protect personal data and use it only for the purposes described below.
Current subprocessors
| Subprocessor | Purpose | Categories of data | Location(s) | School Accounts? |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing | Email address, transaction amounts, payment method token, last 4 card digits, card brand | United States | Yes (if school purchases Premium) |
| Cloudflare, Inc. | Content delivery (CDN) and security | IP addresses, HTTP request headers, browser type, connection metadata | Global (nearest edge node) | Yes (infrastructure; no student content is cached in identifiable form) |
| Google LLC (Analytics 4) | Usage analytics | Pseudonymous page views, browser type, language, approximate location | United States | No — disabled for School Accounts |
| Yandex 360 Business SMTP | Transactional email delivery (non-School Accounts only) | Recipient email address, email message content | International (Yandex 360 Business) | No — excluded; School Account emails use a separate US-based channel |
Note on email delivery for School Accounts: School Account transactional emails (password resets, notifications) are delivered through a separate US-based email channel and do not pass through Yandex 360 Business SMTP. No student data is transmitted to or processed by Yandex at any time.
Flow-down obligations
- All subprocessors are contractually required to implement data protection measures at least as protective as those described in our Privacy Policy and Terms of Service
- Subprocessors may only process data for the specific purposes described above
- Subprocessors are prohibited from using data for their own commercial purposes
- Subprocessors must delete or return data upon termination of the service relationship
Changes to subprocessors
- We update this page when subprocessors change
- For School Accounts: We provide at least 30 days' advance written notice before engaging a new subprocessor that will process student data
- If a School objects to a new subprocessor, the School may terminate its agreement and request data deletion at no cost within 30 days of the notice
- GDPR users: Notifications are provided in accordance with Article 28(2) of the GDPR
Contact
Questions about subprocessors: privacy@time.graphics
School-specific inquiries: schools@time.graphics