Cavatim subprocessors for hosting, payments, email, analytics, AI, and integrations

Controller and operator

James Boyce trading as Cavatim operates Cavatim from the United Kingdom. Postal address is supplied on invoices, privacy-rights correspondence, and verified legal requests.

Processor and transfer questions can be sent to support@cavatim.com.

Current processors and providers

• Hosting and infrastructure: Cavatim production infrastructure on operator-managed servers and cloud/VPS services, used for the web app, API, database, backups, logs, and deployment.
• Stripe: payment processing, subscription administration, invoices, tax support, checkout, billing portal, and refund workflows.
• Email transport: configured transactional or mailbox providers for signup, MFA, password reset, billing, export, deletion, suspicious-login, support, and newsletter messages.
• OpenAI: optional AI-assisted planning, reflection, summarisation, task prediction, and agent workflows when those features are used.
• Google: optional Google Calendar, Google sign-in, Gmail/mailbox, or related OAuth features chosen by the user.
• Microsoft: optional Outlook Calendar, Microsoft sign-in, Outlook/mailbox, or related OAuth features chosen by the user.
• GitHub: source control, CI/CD, security scanning, issue/PR operations, and deployment automation for the Cavatim codebase.
• Anonymous marketing analytics: Cavatim-operated telemetry endpoints for consented public-page analytics and product lifecycle metrics.

Data categories

• Account identifiers, authentication events, billing identifiers, support messages, technical logs, and product telemetry.
• Planner, goal, recurring-task, reflection, workflow, settings, import/export, and backup data needed to provide the service.
• Calendar, mailbox, or identity-provider data only when the user connects the relevant provider.
• AI prompts, outputs, and planner context only when AI-assisted features are used.

Subprocessor changes

Cavatim reviews subprocessors before use for purpose, data categories, region, DPA or equivalent terms, and security fit. Material changes should be reflected on this page and in the privacy notice before broad commercial use.