Sub-processors

Last Updated: 2026-05-28 · Version 1

This page lists the third party service providers (sub-processors) that Lazarus Co Pty Ltd (ABN 53 697 874 258; ACN 697 874 258), the operator of Ganttastic, engages to deliver the Service. It is published in line with our Privacy Policy and Annex B of our Data Processing Agreement so the same canonical list serves consumers, enterprise customers and regulators.

Each sub-processor is engaged under a written contract that limits processing to our documented instructions and requires appropriate security. Where personal data is transferred outside Australia we rely on Australian Privacy Principle 8 and, where applicable to European Economic Area or United Kingdom data subjects, on the Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum incorporated through each sub-processor's data-processing terms.

Current sub-processors

Ganttastic sub-processors as of 2026-05-28
Sub-processor	Purpose	Region	Data categories	Contractual terms
Google Cloud Platform Firestore (Google LLC)	Primary application data storage at rest, including account, profile and project content.	Sydney, Australia (australia-southeast1)	Account and profile data Project content Task and schedule data	Google Cloud Data Processing Addendum. Encryption at rest and in transit.
Google Cloud Platform App Hosting (Google LLC)	Stateless application compute that serves requests; reads from and writes to the Sydney database region.	Singapore (asia-southeast1)	Request data in transit	Google Cloud Data Processing Addendum.
Google Gemini API (Google LLC)	AI assisted project plan generation and AI chat assistant; processes the content you submit for that request to generate the response.	Google global infrastructure (may be processed outside Australia)	Content submitted to AI features	Google Cloud Data Processing Addendum and Gemini API terms applicable to paid use of the Gemini API.
Google reCAPTCHA (Google LLC)	Bot and fraud prevention on sign up (strictly necessary security control).	Google global infrastructure	IP address Interaction signals	Google Terms of Service.
Stripe (Stripe, Inc.)	Subscription payment processing for self service paid plans.	Stripe global infrastructure	Billing contact Payment method token Card last four digits	Stripe Data Processing Agreement. PCI DSS Level 1.
Sentry (Functional Software, Inc.)	Error, crash and performance telemetry to keep the Service reliable.	Germany, European Union (de ingest region)	Diagnostic and crash telemetry Incidental personal data in error context	Sentry Data Processing Addendum and Standard Contractual Clauses. Personal information minimization enabled.
Resend (Resend, Inc.)	Outbound transactional and lifecycle email delivery (verification, password reset, welcome, and trial reminder messages).	Tokyo, Japan (ap-northeast-1 region)	Recipient email address Message metadata	Resend Data Processing Addendum and Standard Contractual Clauses.

Change notifications

Additions or replacements are announced by updating this page, which is the canonical record of our current sub-processors. Enterprise customers are additionally notified by email to their administrative or billing contact. Customers may object on reasonable data-protection grounds within thirty days of the published notice in accordance with section 8 of our Data Processing Agreement.

Version history

Version 1 (2026-05-28): Initial published sub-processor list. Google Cloud (Sydney + Singapore), Google Gemini, Google reCAPTCHA, Stripe, Sentry (EU/Germany) and Resend (Tokyo, Japan). Mirrors DPA Annex B.

Contact

Questions about this list, or requests to be notified of changes before they take effect, should be sent to admin@ganttastic.com.