A sub-processor is a company we engage that may process personal data on our behalf while we provide Odexy. This page lists all of them, together with the other third parties that receive personal data when you use the Service, so that you can see where your data goes. It forms part of our Data Processing Agreement.
Much of the Service runs on software we operate ourselves on our own servers — the database, file storage, email delivery, voice and video calls, document editing and search — so those functions do not involve a separate company.
Sub-processors
| Sub-processor | Purpose | Personal data it receives | Location |
|---|---|---|---|
| Contabo GmbH | Hosting: the servers that run the Service and store its data | All data held in the Service | European Union |
| Anthropic, PBC | AI features: answering, summarizing, drafting and acting | The content of each AI request and the records needed to answer it | United States |
| Google LLC (Gemini API) | AI features, including transcription | The content of each AI request and the records needed to answer it | United States |
| OpenAI, L.L.C. | AI features, including transcription | The content of each AI request and the records needed to answer it | United States |
| Voyage AI, Inc. | AI search: turning text into search vectors | Text from messages, email, files and tasks being indexed | United States |
| Stripe, Inc. / Paddle.com Market Ltd / Razorpay Software Pvt. Ltd. | Taking payment for Odexy subscriptions. Only the provider you pay through receives your data. | Billing name, email, address, tax ID and payment details | United States / United Kingdom / India |
| Cloudflare, Inc. (Turnstile), hCaptcha (Intuition Machines, Inc.), Google LLC (reCAPTCHA) or CaptchaFox GmbH | Telling people from bots on sign-up, sign-in and public forms. At most one is active. | IP address and browser signals during the check | United States / Germany |
Each AI task is routed to one model provider; content is sent only for that task. We use these providers through their commercial APIs, whose terms do not permit them to train models on the content we send. They may keep it for a limited period to detect abuse.
Services that run in your browser
These are loaded by your browser, so they see your IP address and browser details rather than data from our servers.
| Service | Purpose | What it receives |
|---|---|---|
| Google Fonts (Google LLC) | Fonts in the application | IP address and browser details |
| Push services of your browser or device (Google, Apple, Mozilla, Microsoft) | Delivering notifications you have turned on | A device address and an encrypted notification |
| Your browser’s speech service (for example Google or Apple) | Dictation and live captions, when you use them | Your voice while the feature is on |
| Plausible Analytics (Plausible Insights OÜ, Estonia) | Aggregate website traffic statistics, where enabled on our website | Page views, without cookies or personal identifiers |
| Google Analytics (Google LLC, United States) | Measuring our website and sign-up pages: which pages are read, where sign-ups come from and, if you allow advertising cookies, which of our ads led to them. Cookies only after you accept them in the cookie banner. Never inside the Service | IP address, browser and device details, pages viewed and sign-up steps completed; with your consent, an analytics cookie identifier. Never your name, email address or what you type |
Other services that receive minimal data
| Service | Purpose | What it receives |
|---|---|---|
| Have I Been Pwned | Warning you if a new password has appeared in a known breach, where enabled | The first five characters of a one-way hash of the password — never the password itself |
| Mozilla (Thunderbird autoconfiguration database) | Finding the mail server settings when you connect a mailbox by IMAP | The domain of your email address |
| Google (favicon service) | Showing a website’s icon next to a link added to a task | The domain of the link |
| MyMemory or LibreTranslate | Machine translation of interface text | The text being translated |
Services you or your organization choose
When you connect a service, it receives what the connection needs and is governed by your own agreement with it; it is not our sub-processor. These include: sign-in providers (Google, Microsoft, Apple, GitHub, LinkedIn, Facebook, Discord) and your organization’s single sign-on provider; mailbox providers (Google, Microsoft and IMAP or JMAP servers); your own AI provider account, where your organization brings one; your own email delivery provider or storage bucket; payment gateways your organization uses to collect payments from its own customers; maps embedded in your pages; and webhooks and automations that send data to addresses you choose.
Changes to this list
We give at least 30 days’ notice before adding or replacing a sub-processor, by updating this page and announcing the change in our changelog. To receive notice by email, write to support@odexy.app.
You may object to a new sub-processor on reasonable data protection grounds during the notice period. We will discuss it with you and look for an alternative; if we cannot resolve it, you may end the affected part of the Service and we will refund any fees you prepaid for the period after it ends, as set out in the Data Processing Agreement.
Corrections
Earlier versions of this page listed Cloudflare (content delivery and storage), Amazon Web Services, Postmark, Mailgun, Sentry and Inngest. None of them processed personal data for us; they were listed in error and have been removed. Earlier versions also omitted Contabo, Voyage AI, Paddle, Razorpay and the CAPTCHA providers above other than Cloudflare Turnstile.
Contact
Questions about this list: support@odexy.app. Legal notices: support@odexy.app.