Axceera (Pvt) Ltd. uses a small number of vendors to host, operate, secure, support, and bill for Sprint Track. This page is the authoritative list of those sub-processors, maintained as required by Article 28 of the GDPR and referenced by our Privacy Policy and Data Processing Agreement.
Change notice
We give customers at least 30 days' notice before adding or replacing a sub-processor. Notice is given through the service, by email to workspace administrators, or on this page. To be notified of changes, email hello@sprintrack.com and ask to be added to the sub-processor notification list.
Upcoming changes
These changes take effect on November 15, 2026, at least 30 days after this notice was first published on October 16, 2026. Each applies only to workspaces that choose the corresponding optional feature.
| Sub-processor | Change | Data processed |
|---|---|---|
| Google LLC (Google Workspace APIs) | Added for the optional Google Workspace plugin: reading calendar events and Google Meet transcripts, and posting Google Chat messages a person approved. Off unless an administrator connects it. | Calendar events, meeting transcripts, and the messages posted |
| Microsoft Corporation (Microsoft Graph) | Added for the optional Microsoft 365 plugin: reading Outlook calendar events and Teams meeting transcripts, and posting Teams chat messages a person approved. Off unless an administrator connects it. | Calendar events, meeting transcripts, and the messages posted |
| Google LLC (Gemini API), Anthropic, PBC, OpenAI, L.L.C. | Extended to AI teammates that run on the workspace's own API key for that provider. Applies only where a workspace saves its own key. | The instructions, workspace content, and tool results an AI teammate works with |
Current sub-processors
| Sub-processor | Purpose | Processing location | Data processed | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Application hosting, database, object storage, vector search, job queues, CDN, and DDoS protection. Sprint Track runs entirely on this platform. | Global edge network | All customer workspace and application data, uploaded files, and service request logs | Standard Contractual Clauses; UK IDTA |
| Paddle.com Market Ltd. | Payment processing and Merchant of Record for paid plans and AI balance purchases | United States / European Union | Billing contact details, payment data, transaction and subscription records | Standard Contractual Clauses; UK IDTA |
| Sendinblue SAS (Brevo) | Transactional email delivery (verification codes, invitations, mentions, and security alerts), and our own product and launch email to the waitlist and account holder contact lists | European Union | Email address and name; for waitlist sign-ups, also company and team size; message subject and body | Within the EEA; UK IDTA for UK transfers |
| Google LLC (Gemini API) | AI feature inference, document summarisation, and embedding generation. Applies only to workspaces on the AI package. Choosing the AI package enables AI processing for that workspace. | United States | Prompts, grounding context, uploaded documents and audio sources, and text submitted for embedding | Standard Contractual Clauses; UK IDTA |
| Google LLC (OAuth) | "Sign in with Google" authentication, where a user chooses it | United States | Email address, name, profile image, and the authentication assertion | Standard Contractual Clauses; UK IDTA |
| GitHub, Inc. | Repository and issue integration. Enabled per workspace; off unless an administrator connects it. | United States | Repository and issue data for connected repositories only | Standard Contractual Clauses; UK IDTA |
| OpenAI, L.L.C. | Delivery of the Sprint Track app inside ChatGPT. Applies only where a user connects Sprint Track to ChatGPT. Data flows to OpenAI as a result of that user's own request. | United States | Workspace, project, and issue data returned in response to the connected user's requests | Standard Contractual Clauses; UK IDTA |
| Anthropic, PBC | Delivery of the Sprint Track connector for Claude, including Claude on the web, desktop, and mobile, and Claude Code. Applies only where a user connects Sprint Track to Claude. Data flows to Anthropic as a result of that user's own request. | United States | Workspace, project, and issue data returned in response to the connected user's requests | Standard Contractual Clauses; UK IDTA |
Notes on scope
Always active. Cloudflare and Brevo process data for every customer. Paddle processes data for every paying customer.
Optional. Google Gemini, GitHub, OpenAI, and Anthropic process data only where a workspace has chosen that capability. Google's Gemini API processes data only for workspaces on the AI package: choosing that package enables AI processing for the workspace, and a workspace on any other package sends no content to Google's Gemini API. GitHub, OpenAI, and Anthropic are off by default and process data only where a workspace administrator or user has explicitly connected them. A workspace that never connects GitHub sends nothing to GitHub.
Not a sub-processor. The Sprint Track command-line tool and coding runner execute on the member's own machine, and an AI teammate that runs there uses that member's own Claude Code, Codex, or Gemini CLI under the member's own agreement with its provider. Provider credentials supplied to it stay on that machine and are never transmitted to Sprint Track or to any sub-processor.
In-app guides are not a sub-processor. The app's in-app guides run on PlayStep, a product Axceera builds and operates itself on Cloudflare, listed above. They record which guides and steps a person sees and finishes, under a one-way hash of the account identifier, and keep those events for 90 days. The Privacy Policy describes them in full.
No analytics vendor. Sprint Track uses no third-party analytics, measurement, attribution, advertising, or session-replay vendor.
Onward transfers and credentials
Where a customer connects a third-party service, the credentials for that connection are stored under envelope encryption. Each credential is encrypted with its own key, wrapped by a versioned root key, and cryptographically bound to the workspace, purpose, provider, and owning record, so a stored credential cannot be replayed into a different scope.
Contact
Questions about this list, or requests for the data processing terms we hold with any sub-processor:
Axceera (Private) Limited 157/3 Kadawatha Road, Nadimala, Dehiwala Sri Lanka
Email: hello@sprintrack.com