Version 2026-10-31-v1
Subprocessor Register
Last updated: 31 October 2026
This page lists providers that process data for us and platform operators that handle information when you use HisaBooks: what each one does, what data it handles, and where. Platform operators acting under their own terms are identified below. Read it with the Privacy Policy, the Security Overview, and any data-processing terms you have with us.
1. What a subprocessor is
A subprocessor is a third-party provider engaged by HISABOOKS PRIVATE LIMITED to process Customer Data or personal data so HisaBooks can provide the Service. Some providers process data as independent controllers for their own legal, security, fraud, billing, store, or platform purposes. Those roles are noted where relevant.
2. Current register
| Provider | What they do | Data handled | Location |
|---|---|---|---|
| Hostinger International Ltd. | Hosts the web app, the app connection, the database, uploaded files, logs and backups; provides DNS, the content delivery network, and our email. | Workspace data, account data, uploaded files, logs, backups, emails we send and receive, and security information. | Indonesia (Jakarta data centre); backups are stored in Singapore. Website content is also delivered through Hostinger's network in other countries. |
| Stripe Payments Singapore Pte. Ltd. | Checkout, subscriptions, payment status, invoices, saved payment methods, fraud prevention, disputes, and refunds. | Billing contact, payment status, subscription and invoice references. Full card numbers and security codes go to Stripe only; we never see them. | Singapore, with processing by the Stripe group in the United States and other countries. Stripe also acts on its own account for some payment, fraud, and legal purposes. |
| Cloudflare, Inc. (Turnstile) | Checks that a person, not an automated program, is signing up on the Start Free page. | IP address, browser information, and the result of the check. | Cloudflare's global network. |
| 650 Industries, Inc. (Expo) | Delivers phone app notifications to people who allow them. | Notification token, notification text, and app and device routing details. | United States. |
| Google LLC (Google Play) | Distributes the Android app and, once switched on, delivers its notifications. | Install, device, and store information, and notification routing, under Google's policies. | United States and other countries. |
| Microsoft (Microsoft Store) | When the Windows app is obtained through Microsoft Store, Microsoft distributes and updates its package under its own store and privacy terms. It does not process Customer workspace data as a HisaBooks subprocessor for this activity. | Store account, installation, device, and diagnostic information handled by Microsoft. HisaBooks does not send Customer workspace records to Microsoft for Store distribution. | Microsoft's applicable service locations, which may vary by account and region. |
| Google LLC (Google sign-in) | Lets people who choose Continue with Google sign in with their Google account and confirms their email address. | Google account identifier, verified email address, and name. | United States and other countries. |
| Professional advisers | Legal, accounting, tax, and security advice, when we need it. | Only the account, billing, or support details a specific matter needs. | Singapore, or where the adviser is based. Always under a duty of confidentiality. |
3. Customer-selected recipients and integrations
When a Customer or authorised user sends an invoice, exports a report, shares a public link, downloads a PDF, prints a document, imports data, or connects a company mailbox or another integration, that recipient or integration is chosen by the Customer. Customer-selected recipients are not subprocessors engaged by HISABOOKS PRIVATE LIMITED for all customers, but they may process data at the Customer's direction.
4. Provider changes
We may add or replace providers to run, secure, support, or improve the Service. We update this page before a planned change, or as soon as we can after an urgent one. If you have a signed data-processing agreement with us, it may give you more notice.
Customers may raise a good-faith data-protection objection to a material provider change. HISABOOKS PRIVATE LIMITED will review the concern and decide whether it can be addressed through information, safeguards, alternative configuration, suspension of the affected feature, cancellation of the affected service, or another commercially reasonable path.
We will not add a provider for behavioural advertising, session replay, analytics, or AI processing of your data without first updating the Privacy Policy and Cookie Notice, telling customers, and asking for consent where the law requires it.
5. Contact
Send subprocessor questions or objections to dpo@hisabooks.com. Include your company code and the provider or processing activity you are asking about.