Sub-processors

Last Updated: 2026-05-28 · Version 1

This page lists the third-party service providers (sub-processors) that Lazarus Co Pty Ltd (ABN 53 697 874 258; ACN 697 874 258), the operator of Ganttastic, engages to deliver the Service. It is published in line with our Privacy Policy and Annex B of our Data Processing Agreement so the same canonical list serves consumers, enterprise customers and regulators.

Each sub-processor is engaged under a written contract that limits processing to our documented instructions and requires appropriate security. Where personal data is transferred outside Australia we rely on Australian Privacy Principle 8 and, where applicable to European Economic Area or United Kingdom data subjects, on the Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum incorporated through each sub-processor's data-processing terms.

Current sub-processors

Ganttastic sub-processors as of 2026-05-28
Sub-processorPurposeRegionData categoriesContractual terms
Google Cloud Platform — Firestore (Google LLC)Primary application data storage at rest, including account, profile and project content.Sydney, Australia (australia-southeast1)
  • Account and profile data
  • Project content
  • Task and schedule data
Google Cloud Data Processing Addendum. Encryption at rest and in transit.
Google Cloud Platform — App Hosting (Google LLC)Stateless application compute that serves requests; reads from and writes to the Sydney database region.Singapore (asia-southeast1)
  • Request data in transit
Google Cloud Data Processing Addendum.
Google Gemini API (Google LLC)AI-assisted project plan generation and AI chat assistant; processes the content you submit for that request to generate the response.Google global infrastructure (may be processed outside Australia)
  • Content submitted to AI features
Google Cloud Data Processing Addendum and Gemini API terms applicable to paid use of the Gemini API.
Google reCAPTCHA (Google LLC)Bot and fraud prevention on sign-up (strictly necessary security control).Google global infrastructure
  • IP address
  • Interaction signals
Google Terms of Service.
Stripe (Stripe, Inc.)Subscription payment processing for self-service paid plans.Stripe global infrastructure
  • Billing contact
  • Payment method token
  • Card last four digits
Stripe Data Processing Agreement. PCI-DSS Level 1.
Sentry (Functional Software, Inc.)Error, crash and performance telemetry to keep the Service reliable.Germany, European Union (de ingest region)
  • Diagnostic and crash telemetry
  • Incidental personal data in error context
Sentry Data Processing Addendum and Standard Contractual Clauses. Personal information minimisation enabled.
Resend (Resend, Inc.)Outbound transactional and lifecycle email delivery (verification, password reset, welcome, trial-ending and trial-ended messages).Tokyo, Japan (ap-northeast-1 region)
  • Recipient email address
  • Message metadata
Resend Data Processing Addendum and Standard Contractual Clauses.

Change notifications

Enterprise customers are notified of additions or replacements by email to their billing or administrative contact, or by an update to this page. Customers may object on reasonable data-protection grounds within thirty days of notice in accordance with section 8 of our Data Processing Agreement.

Version history

  • Version 1 (2026-05-28) — Initial published sub-processor list. Google Cloud (Sydney + Singapore), Google Gemini, Google reCAPTCHA, Stripe, Sentry (EU/Germany) and Resend (Tokyo, Japan). Mirrors DPA Annex B.

Contact

Questions about this list, or requests to be notified of changes before they take effect, should be sent to admin@ganttastic.com.