Named, with where they run.
Region is stated at country level. Any recipient outside the EU relies on appropriate safeguards — Standard Contractual Clauses (SCCs) and/or adequacy. You can request a copy of the safeguards for any transfer at [email protected].
Omega uses a small number of vetted subprocessors to run the service. AI model providers process the prompts and code you submit so a model can generate a response; a payment & tax provider handles billing; an authentication provider handles sign-in; and cloud hosting runs the platform. Transactional email, logging & monitoring, backup storage, a CDN/DNS/security layer, product analytics (server-side, EU region, cookieless), and optional source hosting & code review round out operations.
Data residency. Primary data residency is in the EU (Germany). Some processors — AI model providers, authentication, email, and the CDN — operate in the US or globally under appropriate safeguards (SCCs and/or adequacy).
Not yet active. Two entries above — product analytics and logging & monitoring — are wired into our infrastructure but are not currently switched on in production, so no personal data flows to them today. We list them for transparency and will update their transfer basis, and notify you per our advance-notice commitment below, before either one starts processing data.
Your code & prompts. We do not train our own models on your code or prompts, and we rely on provider terms that the providers do not train on them. For ordinary interactive chat we do not store the text of your prompts or the model’s responses — only usage metadata. See /privacy for the full detail.
Advance notice of changes
We give at least 30 days’ advance notice before adding or replacing a subprocessor that processes personal data, so you have time to review the change and object before it takes effect. This page — and the date it was last reviewed — is the canonical record of the current roster.
Right to object
If you object to a specific subprocessor you have options: switch to a different model, configure your own provider API key (bring-your-own-key), or point Omega at a model running locally on your machine — in which case that content is not sent to Omega or any third party. If none of those resolve your concern, you may cancel and request deletion of your data. We cannot remove strictly-necessary subprocessors (payments, authentication, hosting) and continue to provide the service. To object or to request a copy of the transfer safeguards, contact [email protected].
The processor terms that authorise these subprocessors live in the Data Processing Addendum. For how we handle your data overall, see Privacy, and for the agreement that governs your use of Omega, see Terms.