Authorized Subprocessors
Fruitask uses the following subprocessors (also called "data processors" or "processors") to provide our services. All subprocessors are contractually bound to comply with applicable data protection laws including the Data Privacy Act of 2012 (Philippines) and GDPR (EU).
This list is updated regularly. We notify customers of changes to our subprocessor list in advance and provide an opportunity to object before changes take effect.
Current Subprocessor List
| Subprocessor | Service Category | Processing Location | Data Type |
|---|---|---|---|
| Hostinger | Infrastructure & Hosting | Europe | Application data and Fruitask-hosted mailbox content |
| MongoDB Inc. | Database Services | EU/US (configurable) | Workspace data, user data |
| Google LLC | Analytics & Advertising | US / other regions under applicable safeguards | Anonymized usage data |
| Paddle, Inc. | Payment Processing | Europe (PCI-DSS Level 1) | Payment & billing information |
| GitHub Inc. / Google | OAuth / SSO Authentication | US | Email, basic profile (optional) |
Detailed Subprocessor Information
Hostinger
Service: VPS Infrastructure Hosting & Deployment
Location: Europe
Data Processed: Application data, workspace content and Fruitask-hosted mailbox content where Stalwart is enabled
Legal Basis: Data Processing Agreement compliant with DPA 2012 and GDPR
Website: hostinger.com
MongoDB Inc.
Service: Database Services (MongoDB Atlas)
Location: Configurable (EU, US, or other regions)
Data Processed: Workspace data, user information, application data
Legal Basis: Data Processing Agreement compliant with GDPR and DPA 2012
Website: mongodb.com
Fruitask-operated Stalwart Mail
Status: Fruitask service component, not a separate subprocessor
Service: Transactional delivery and optional hosted FruitMail mailboxes
Infrastructure: Covered by the Hostinger entry above when deployed on Fruitask's Hostinger infrastructure
Data Processed: Email addresses, message content, attachments, headers and mailbox state
Website: fruitask.com
Google LLC
Services: Google Analytics, Google AdSense (on free plans), Google OAuth
Location: US
Data Processed: Anonymized usage data, cookie identifiers, aggregated analytics
Legal Basis: Consent (analytics), legitimate interest (OAuth)
Website: google.com/analytics
Paddle, Inc.
Service: Payment Processing & Billing
Location: US (PCI-DSS Level 1 Certified)
Data Processed: Payment information, billing address, transaction history
Legal Basis: Contract & Data Processing Agreement
Compliance: PCI-DSS compliant; no credit card data stored on Fruitask servers
Website: paddle.com
GitHub Inc. & Google (OAuth)
Service: Single Sign-On (SSO) / Social Login (Optional)
Location: US
Data Processed: Email address, name, profile picture (only if you choose social login)
Legal Basis: Consent (user chooses to use social login)
Websites: github.com | google.com
Customer-Directed Mail Providers
FruitMail can connect to services selected and contracted directly by a customer. These providers are not automatically appointed by Fruitask as subprocessors; they process mailbox data under the customer's account, instructions, provider agreement and selected region.
Google Workspace / Gmail
Optional OAuth mailbox access for reading, sending and organizing email.
Microsoft 365 / Outlook
Optional Microsoft Graph mailbox access selected by the customer.
Custom IMAP / SMTP provider
The mail host configured by the customer receives credentials and message traffic necessary to operate that mailbox.
International Data Transfers
Some of our subprocessors are located outside the Philippines and EU. For these transfers, we use:
Standard Contractual Clauses (SCCs)
EU-approved contractual mechanism to ensure adequate protection for data transferred to the US and other countries.
Data Processing Agreements (DPAs)
All subprocessors have executed DPAs that comply with GDPR Article 28 and DPA 2012 requirements.
Supplementary Measures
We implement encryption and other technical measures to protect data in transit to US-based subprocessors.
Objecting to Subprocessors
If you object to our use of a particular subprocessor (for a specific data category), you can:
- Contact us at privacy@fruitask.com with your objection
- We will discuss alternative processing methods with you
- If no agreement can be reached, you may terminate your subscription without penalty
Note: We cannot remove subprocessors that are essential to service delivery (e.g., cloud hosting) unless you terminate your account. However, we can discuss alternatives for optional subprocessors.
Changes to Subprocessor List
When we add or remove a subprocessor, we will:
- Update this page immediately
- Notify customers by email at least 30 days before the change takes effect
- Provide details about the new subprocessor and data processing activities
- Allow customers to object before the change takes effect
- Permit customers to terminate without penalty if they object to the change
Questions About Subprocessors?
For detailed Data Processing Agreements with any subprocessor, questions about data transfers, or to discuss alternative processing arrangements, please contact us:
Email: privacy@fruitask.com
Response Time: Within 15 days