This page explains the categories of service providers that may receive data, their functions and the regions from which processing may occur. It supplements the Privacy Policy.
1. Why this page uses categories
Self-service Customer Content may not contain personal data. Publicly disclosing OmevAI's exact inference vendors, model catalogue, routing order, volumes and economics would expose confidential service mechanics without being necessary for self-service use.
Accordingly, this public page identifies provider categories, functions, data and regions. It is not the named subprocessor annex used for Enterprise personal-data processing.
An Enterprise customer receives the legal name, relevant location and function of every potential subprocessor for its approved use case in a confidential DPA annex after manual review and NDA, and before the DPA is signed or personal-data processing is activated.
2. Public provider map
| Category | Function | Data that may be processed | Potential regions |
|---|---|---|---|
| Infrastructure hosting and database | Run APIs, dashboards, router, account systems and billing ledger | Account, authentication, usage, project, entitlement and approved Customer Content | EEA |
| Content delivery, DNS and security | TLS delivery, network protection, bot/fraud detection, object storage and log durability | IP, user agent, request metadata, security events and logged Customer Content | EEA; United States; global edge locations |
| AI inference and model services | Generate, classify, validate, evaluate and improve responses | Customer Content, request parameters and limited request/quality metadata | EEA; United States; Asia-Pacific |
| Identity and connectors | Google sign-in and customer-selected analytics/search connectors | Business identity, OAuth state/profile, selected site/property data | EEA; United States; other provider locations |
| Email and communications | Send login links, service notices, support and security messages | Business email, display name, message and delivery metadata | EEA; United States; other provider locations |
| Website analytics | Measure website and page performance after required consent | Cookie ID, IP-derived location, browser/device and page events | EEA; United States |
| Hosted forms | Collect inquiry, demo and waitlist submissions | Business contact, company/site, volume and use-case information | EEA; United States |
| Merchant of Record | Checkout, payment, invoices, indirect tax, refunds and customer portal | Identity, billing, payment, tax, order and subscription data | Estonia/EEA; payment-network and compliance locations |
| Authorised Integration Partner | At the customer's direction, present acceptance/checkout and store/use a customer-specific API key | Account/correlation IDs, acceptance, key, entitlement status and Customer Content entered through the partner UI | The partner's disclosed locations |
| Professional and legal support | Audit, insurance, legal compliance, disputes and corporate transactions | Only information reasonably necessary for the matter | Adviser/authority location |
An Authorised Integration Partner generally controls its own platform data and is not automatically an OmevAI subprocessor. Its role depends on the specific processing and contract.
3. Enterprise named subprocessor list
The confidential DPA annex includes, for every potential subprocessor relevant to the approved use case:
- legal/corporate name;
- service function;
- processing country or region;
- categories of personal data and data subjects;
- transfer mechanism where required; and
- any use-case restriction agreed for that provider.
The named list identifies potential providers authorised for routing; it does not promise that every provider handles every request and does not disclose model selection, priority, price, performance or internal quality logic.
4. Changes and objections for DPA customers
OmevAI uses general written authorisation for Enterprise subprocessors. It will give the DPA customer at least 30 days' written notice before adding or replacing a subprocessor that may process the approved personal data, unless an urgent security or legal necessity requires a shorter period.
The customer may object during that period on specific, documented data-protection grounds. The parties will attempt in good faith to address the concern. OmevAI may offer a technically and commercially reasonable alternative, restrict the affected feature, or allow termination of the affected processing. An objection does not require OmevAI to reveal confidential routing mechanics or provide a cost-free dedicated provider architecture.
5. Transfer safeguards
For restricted transfers, safeguards may include:
- an applicable adequacy decision;
- European Commission Standard Contractual Clauses;
- contractual restrictions on use, retention, disclosure and further transfer;
- encryption in transit, access controls, tenant/role restrictions and audit logging;
- data minimisation and the self-service personal-data prohibition; and
- transfer-impact and provider-risk assessments for an Enterprise use case.
Transfer mechanisms and supplementary measures must be verified for the actual provider contract before Enterprise personal-data processing is enabled.
6. Questions
Enterprise DPA and transfer questions: [email protected].