Oretta subprocessors (English)
Last updated 29 October 2026
This is the list of providers that process personal data when Oretta runs. Studios authorise them in section 5 of the data processing agreement; how we process data is described in the privacy policy. We tell studio admins by email at least 30 days before a new or replaced provider starts processing studio data, on the terms in section 5 of the data processing agreement.
Sub-processors of studio data
| Subprocessor | Purpose | Data | Where |
|---|---|---|---|
| Vercel | Hosting the app and site, scheduled jobs, protecting the signup form from bots (Vercel BotID) | All traffic to the app: IP addresses, headers, request and response bodies; function logs. On the signup page also technical browser signals from Vercel BotID | Application functions in Dublin (Ireland); on an outage Vercel may fail them over to another region. The content network and logs are global |
| Supabase | Database and sign-in | Accounts (email, name, role; the password only as a hash), time entries, projects, clients, rates, person costs, studio settings | Ireland (eu-west-1) |
| Supabase (email sending) | Invitation emails and links to set or reset a password | Email address and link | Supabase's built-in sign-in email sender |
| Cloudflare (R2) | Backups; we keep the 8 newest weekly copies | A weekly database dump, encrypted before it leaves the machine where it is made. Cloudflare only stores encrypted data | Cloudflare R2 storage |
| GitHub (Actions) | Running the weekly backup | GitHub stores no studio data. The backup job runs on a GitHub machine: the database dump passes through its memory and is encrypted before it reaches disk or storage | GitHub machines with no pinned region, so possibly outside the EEA |
| Slack (only when a studio admin connects it) | Daily budget report to a chosen channel | Project and client names, hours used and budget, hours in the last 7 days. No rates | Slack, under the studio's own contract with Slack; the location depends on the studio's workspace |
If another provider starts sending email, we will list it here before it processes any data.
Our own processors
Here HEHE.studio is the controller, not the studio.
| Processor | Purpose | Data | Where |
|---|---|---|---|
| DataFast (JustShipIt Pte. Ltd., Singapore) | Visit statistics for the public pages | Public-page visitors only (home, blog, changelog, sign-in, signup, legal pages), never studio data: page address, referrer, browser and operating system, screen size, language, time zone and the IP address, from which DataFast derives the country and a pseudonymous visitor ID. No cookies. Kept 24 months | According to DataFast's data processing agreement, its infrastructure is mostly outside the EU, including in the United States (DataFast DPA) |
Not Oretta's processors
- Anthropic. Oretta sends nothing to Anthropic. Data reaches Claude only when a user connects their own Claude account to Oretta with a personal token; Anthropic is then the user's provider, not Oretta's.
- Clockify. Only for a one-off move of data from Clockify into Oretta: we then read the data from the studio's Clockify account with an API key for that account. Clockify is the studio's provider, not ours.
The Chrome extension connects only to oretta.app and to an address the user explicitly allows in its settings. It has no analytics. The Trello card button is off by default; once turned on, and only on click, it reads the open card's title, board name and link. Only the title reaches Oretta, as the entry description; the board name and link stay in the browser. Nothing is sent to Trello.