Last Updated: 2026-05-07
Version: 1.0
A "subprocessor" is a third party that processes personal data on our behalf to help us run Omnilys. We disclose them here as required by GDPR, the CCPA/CPRA service-provider framework, and our Data Processing Agreement.
If you have signed a DPA with us, we will give you 30 days' notice before adding a new subprocessor that processes Customer Data.
| Name | Purpose | What they receive | Region | Transfer mechanism (if you are EU/UK/CH) |
|---|---|---|---|---|
| Anthropic, PBC | Claude AI Model — runs inference on your data summary to produce findings | Data summary and question (Free Tier and Pro non-BYOK only) | USA | Anthropic DPA + Standard Contractual Clauses |
| OpenAI, LLC | GPT-4o AI Model — runs inference on your data summary; text-embedding-3-small for clustering; Claude-Haiku-equivalent calls | Data summary, question, finding text (Free Tier and Pro non-BYOK only) | USA | OpenAI DPA + Standard Contractual Clauses; OpenAI is certified under the EU-U.S. Data Privacy Framework |
| Google LLC | Gemini AI Model — runs inference; Google Sheets API for Sheets connector | Data summary and question (Free / non-BYOK); Sheets URL contents on connector use | Global (multi-region) | Google's standard DPA + SCCs; Data Privacy Framework certified |
| xAI Corp. | Grok AI Model — runs inference on your data summary | Data summary and question (Free Tier and Pro non-BYOK only) | USA | xAI Customer Terms + SCCs |
| Railway Corp. | Hosting — runs the Omnilys application servers and stores the SQLite databases | All data persisted by the Service (account info, analysis results, configuration); Customer Data only while in temporary processing | USA (us-west2 / Oregon) | Railway DPA + SCCs |
| Stripe, Inc. | Subscription billing, customer portal, dispute management | Billing email, plan info, charge events. No Customer Data. | USA, with global processors | Stripe DPA + SCCs; Data Privacy Framework certified |
| Functional Software, Inc. (Sentry) | Error and crash monitoring | Stack traces, request paths, masked user identifiers. Configured to scrub Customer Data. | USA | Sentry DPA + SCCs |
| Google LLC (Gmail SMTP) | Email delivery for verification, password reset, scheduled-report emails | Recipient address; email body (which may include analysis findings on scheduled reports) | Global | Google DPA + SCCs |
| Namecheap, Inc. | DNS for omnilys.com | Domain configuration only. No Customer Data. | USA | Namecheap Terms |
These are destinations you configure in Settings. Data sent to them is sent by your instruction, not as part of our service to you. You are responsible for the relationship with them.
Contact: privacy@omnilys.com
[LAWYER REVIEW] Confirm each named provider's current legal name and current SCC/DPF status before publishing. AI-provider terms change often; recheck quarterly.