About This Page
This page lists the third parties Omnymous, LLC engages to process personal data on behalf of our customers ("Sub-processors"), as required by Article 28 of the GDPR and by our Data Processing Addendum.
Every Sub-processor listed here is engaged under a written contract that: limits it to processing on our documented instructions; imposes confidentiality and security obligations no less protective than those we owe our customers; prohibits use of the data for its own purposes; and, where relevant, incorporates Standard Contractual Clauses or another valid transfer mechanism. We remain responsible to our customers for our Sub-processors' performance.
Notice of changes. We give 30 days' notice before adding or replacing a Sub-processor. Subscribe to notifications at privacy@omnymous.com with the subject line "Subprocessor notifications" and the email address to notify. Customers may object on reasonable, documented data protection grounds under Section 8.4 of the DPA. Where a change is required urgently for security, availability, or legal reasons, we may make it immediately and give notice as soon as practicable.
1. Core Infrastructure
These providers underpin the Platform. They process all categories of customer data, encrypted in transit and at rest.
| Sub-processor | Function | Data processed | Primary location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, managed database, object storage, content delivery, transactional email delivery (SES), secrets management | All Platform data, including customer account data and end-consumer data | United States (us-east-1) |
| Redis / managed cache and queue infrastructure (operated by us on AWS) | Caching, session state, background job queues | Session identifiers, job payloads that may transit personal data | United States (us-east-1) |
2. Payments
| Sub-processor | Function | Data processed | Primary location |
|---|---|---|---|
| Stripe, Inc. | Subscription billing, payment processing, invoicing, tax calculation | Billing contact details, subscription and transaction data, payment method tokens. Card numbers are collected by Stripe directly and never reach our systems. | United States |
3. Advertising Operations
| Sub-processor | Function | Data processed | Primary location |
|---|---|---|---|
| Zernio | Advertising operations backend: authentication to advertising platforms, campaign, ad set and ad management, performance retrieval, and relay of conversion events to advertising platforms | Advertising account identifiers and credentials, campaign structures, performance data, and conversion events including one-way hashed end-consumer email addresses and phone numbers | United States |
Independent controllers. Where a customer instructs us to transmit data to an advertising platform — Meta Platforms, Inc., Google LLC, or TikTok — that platform processes the data as an independent controller under its own terms, not as our Sub-processor. The customer is responsible for having a lawful basis for those transmissions.
4. Commerce Platform
| Sub-processor | Function | Data processed | Primary location |
|---|---|---|---|
| Shopify Inc. | Source commerce platform. We access it under the permissions the merchant grants, and deploy a web pixel extension to the merchant's storefront | Products, orders, refunds, customer records, storefront events. Shopify is the merchant's own platform and its own processor for that data; we are listed here because data flows through Shopify infrastructure at the merchant's direction | Canada / global |
5. AI Observability
| Sub-processor | Function | Data processed | Primary location |
|---|---|---|---|
| Helicone, Inc. (where enabled) | Observability gateway for AI requests: latency, token usage, cost, and error tracking | Prompt and response content, model and usage metadata, organization and store identifiers. Contractually prohibited from using content for its own purposes or model training | United States |
6. Research and Retrieval
Used only when a customer invokes research or voice-of-customer features. Queries are derived from the customer's request.
| Sub-processor | Function | Data processed | Primary location |
|---|---|---|---|
| Tavily (where configured) | Web search and content retrieval for research features | Search queries derived from the customer's request | United States |
| Serper (where configured) | Web search results for research features | Search queries derived from the customer's request | European Union |
| Reddit, Inc. (where configured) | Retrieval of publicly available discussions for voice-of-customer analysis | Search queries; publicly available posts and comments are retrieved, which include their authors' usernames and content | United States |
7. Operations and Support
| Sub-processor | Function | Data processed | Primary location |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error monitoring and performance diagnostics | Diagnostic and error data, which may include user and organization identifiers, request context, and incidental personal data present in error payloads | United States |
| Google LLC | Sign in with Google (authentication) | Authentication assertions, Google account identifier, basic profile data — only for users who choose this sign-in method | United States |
8. Our Own Websites
Used on our marketing website only. These do not process customer or end-consumer data.
| Provider | Function | Data processed | Primary location |
|---|---|---|---|
| Google LLC (Google Analytics 4) | Website analytics for omnymous.com | Visitor usage data, pseudonymous identifiers, approximate location from IP | United States |
9. Partners
| Party | Function | Data processed | Primary location |
|---|---|---|---|
| TrustMyRevenue | Referral partnership. Issues single-use promotional codes to merchants it has verified | The fact that a code was issued and redeemed, and the associated account. No customer workspace data or end-consumer data is shared. | — |
TrustMyRevenue is an independent third party and an independent controller for the data it collects from you directly. It is not our Sub-processor.
10. AI Model Providers — Not Our Sub-processors
Omnymous does not resell AI inference. Every generation runs on the customer's own API key, against the customer's own account, under the customer's own agreement with the provider, billed directly to the customer. We transmit the request as a technical conduit at the customer's direction.
Accordingly, the providers below are the customer's own processors, not ours. Their data handling — including retention, abuse monitoring, and whether content is used for model training — is governed by the customer's agreement with them. Customers should review those agreements and configure their provider accounts accordingly. We list them here for transparency only.
| Provider | Engaged by | Data processed |
|---|---|---|
| OpenAI, L.L.C. | Customer | Prompts, context, and generated outputs for requests the customer initiates |
| Anthropic PBC | Customer | Prompts, context, and generated outputs for requests the customer initiates |
| Google LLC (Gemini) | Customer | Prompts, context, and generated outputs for requests the customer initiates |
11. Affiliates and Personnel
Omnymous personnel and contractors may access personal data where necessary to operate, support, and secure the Platform. Access is role-based, least-privilege, logged, and subject to written confidentiality obligations. Contractors engaged to process personal data are bound by terms no less protective than our DPA.
Questions
Sub-processor questions, notification subscriptions, and objections: privacy@omnymous.com
Omnymous, LLC 1111b South Governors Ave, STE 94887 Dover, DE 19904 United States
Document Version: 1.0 Classification: Public