Noviq Subprocessors
A subprocessor is a service provider that processes personal data on our behalf to help us run Noviq. This page is the current list referenced by our Data Processing Addendum. We update it before adding or replacing a subprocessor and notify workspace administrators of material changes at least 14 days in advance.
This page is published in Hebrew and in English. The Hebrew version is the binding version; this English text is provided for convenience.
1. Subprocessors
| Provider | Role | Location | Applies |
|---|---|---|---|
| Google LLC (Google Cloud / Firebase / Google Workspace) | Hosting, database, file storage, authentication, and serverless infrastructure for the entire Service; the mail relay every email we send passes through (invitations, notifications, feedback replies); and, for people who sign in with Google, the profile photo the browser loads from Google’s servers. | United States | Always |
| PostHog, Inc. | Product analytics (page views, feature usage). | United States | Only for users who opted in via the cookie banner |
| Functional Software, Inc. (Sentry) | Error monitoring on the website and crash reports from the mobile app, with identity fields removed before sending; session replay only for users who opted in. | United States | Always (error and crash reports); replay opt-in only |
| Slack Technologies, LLC | Delivery of workspace notifications to the Customer’s Slack workspace. | Per the Customer’s Slack region | Only if the Customer connects a Slack webhook |
| Destinations the Customer configures (outbound webhooks) | Delivery of workspace events (a published schedule, a decided request, a punch) to a web address the Customer’s own administrator entered. Carries names and the facts of the event; never free text such as a leave reason. | Wherever the Customer points it | Only if the Customer configures a webhook |
| The payroll system the Customer connects (Maskoreshet) | Delivery of a month the Customer has closed for payroll to the Customer’s own payroll account, in the Customer’s name: each employee’s ID number, names, start date, employee number, email and phone, the date of birth where the Customer records one, their hours at each rate, hourly rate and absence days. Where the Customer turns it on, each employee’s payslip comes back from that account into Noviq. | Wherever the Customer’s payroll provider keeps it | Only if the Customer’s administrator connects its payroll account and finance sends a closed month or brings payslips back |
| 650 Industries, Inc. (Expo) | Delivery of mobile push notifications (receives the device push token and the notification’s title and body, which name the shift or request concerned), and the update check the app makes on every launch, which receives the device’s network address and the app version. | United States | Only for users who install the mobile app (update checks); notifications only when enabled |
| Apple Inc. | Sign in with Apple (receives the sign-in event; may hand us a relay email address instead of yours) and delivery of push notifications to iPhones through Apple’s notification service. | United States | Only for users who sign in with Apple or enable notifications on an iPhone |
2. Change history
Material changes to the list above, most recent first. Per our DPA §6, workspace administrators are notified of a material change at least 14 days before it takes effect, and a Customer that objects on reasonable data-protection grounds may terminate and export its data.
| Announced | Change | In effect | Details |
|---|---|---|---|
| 2026-09-18 | Added: Destinations the Customer configures (outbound webhooks) | 2026-09-18 | Added to the public list: web addresses a workspace administrator enters to receive workspace events (published schedules, decided requests, punches) — names and event facts only, never free text. Customer-directed like the Slack row beside it, and available since the integrations settings shipped; listed retroactively. |
| 2026-09-18 | Added: Apple Inc. | 2026-09-18 | Added to the public list: Sign in with Apple (the sign-in event; a relay address may stand in for the real one) and push delivery to iPhones through Apple’s notification service. Both have been in use since the iOS app shipped; the 2026-09-18 legal review found them unlisted, and this entry is the retroactive disclosure. The same review widened the Google row (the mail relay every email passes through; Google-hosted profile photos) and the Expo row (the update check on every app launch). |
| 2026-08-14 | Added: 650 Industries, Inc. (Expo) | 2026-08-14 | Added to the public list: delivers mobile push notifications for the Noviq app, receiving the device push token and each notification’s title and body. The 2026-08-14 compliance review found it in use by the mobile app before it was listed; this entry is the retroactive disclosure. |
3. Data sources that are not subprocessors
The Service shows public-holiday information sourced from Hebcal and Nager.Date. These are public calendar data sources — no personal data is sent to them — so they are not subprocessors. When a workspace administrator types a work-site address, the OpenStreetMap Foundation’s Nominatim service turns it into map coordinates; it receives that address (a company location, sent from our server) and nothing about any person.
4. Questions
Questions about this list or our subprocessor agreements: support@rallyve.com.