Last updated: 17 August 2026
This page lists every organisation that processes personal data on our behalf when you use Omnimatch, what each one receives, and when. It is the detailed companion to the "Sharing and sub-processors" section of our Privacy Policy, and the list we point to when a customer's counsel asks. Where a provider is used only for a feature you or an agent's owner switches on, the row says so.
Where the service runs, and the providers every account touches.
| Provider | Location | What we use it for | What it receives | When | Transfer basis |
|---|---|---|---|---|---|
| Cloudflare Cloudflare, Inc. |
United States (San Francisco). Global network; compute runs at the location nearest the user and stored data is not yet pinned to a region | Hosting and everything underneath the product: Workers, D1 databases, Durable Objects (conversation history), R2 (attachments and uploaded knowledge), AI Search (document indexing), Workers AI (default model inference and small background models), AI Gateway (every model request, with logging), Browser Rendering (the live browser feature), Turnstile (bot protection), Images, and transactional email (sign-in links, verification, notifications) | All account data, all conversation content and attachments, all model requests and replies, email addresses | Every use | Provider DPA with Standard Contractual Clauses and UK Addendum. Cloudflare is also certified under the EU-US and UK Data Privacy Framework |
| Cloudflare's own GPU capacity CoreWeave, Inc. and Nebius B.V., as sub-processors of Cloudflare for Workers AI |
CoreWeave: United States. Nebius: Netherlands and England | Cloudflare runs some Workers AI inference on rented GPU capacity from these providers. We have no relationship with them; they are listed so that "the default model stays with Cloudflare" is read correctly: it stays inside Cloudflare's chain | Model requests and replies for the default and other Cloudflare-hosted models, under Cloudflare's own no-training and no-cross-customer commitments | Every use | Covered by Cloudflare's DPA and its published sub-processor list |
| Stripe Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States) |
Ireland and United States | Payment processing, subscriptions, and payouts to agent owners who charge for their agents | Email address, payment card details (entered on Stripe's own pages, never seen by us), billing history | When you use the feature | Stripe's DPA with Standard Contractual Clauses; Stripe is certified under the EU-US and UK Data Privacy Framework |
| Google (sign-in) Google Ireland Limited (for UK/EU users) / Google LLC |
Ireland and United States | Sign in with Google | Email address, name and profile picture from your Google account, when you choose to sign in that way | When you connect it | Provider DPA with Standard Contractual Clauses and UK Addendum; Google is certified under the EU-US and UK Data Privacy Framework |
The default model for every agent runs on Cloudflare Workers AI and sends nothing to a third party; that row is under Platform. The providers below receive content only for the feature or model named. An agent's model is shown on its page before you use it.
| Provider | Location | What we use it for | What it receives | When | Transfer basis |
|---|---|---|---|---|---|
| Anthropic Anthropic, PBC |
United States | Reading the pages of any PDF you attach; and Claude models where an agent's owner has selected one for that agent | PDF contents you attach; and, for agents on a Claude model, the conversation content sent to that agent | When you use the feature | Reached through Cloudflare AI Gateway. Provider DPA with Standard Contractual Clauses and UK Addendum. Anthropic's API does not train on customer content |
| OpenAI OpenAI, L.L.C. (OpenAI Ireland Ltd for UK/EU) |
United States and Ireland | Image generation from the description an agent writes (a Cloudflare-hosted model is the fallback); and GPT models where an agent's owner has selected one | The image description an agent writes; and, for agents on a GPT model, the conversation content sent to that agent | When you use the feature | Reached through Cloudflare AI Gateway. Provider DPA with Standard Contractual Clauses and UK Addendum. OpenAI's API does not train on customer content |
| Google (models and grounding) Google LLC / Google Ireland Limited |
United States and Ireland | Gemini models where an agent's owner has selected one; and Gemini with Google Search grounding behind the "what's on" lookups (events near a place) | For agents on a Gemini model, the conversation content sent to that agent; for what's-on lookups, the query the agent writes | When an agent's owner selects it | Reached through Cloudflare AI Gateway. Provider DPA with Standard Contractual Clauses and UK Addendum |
| xAI xAI Corp. |
United States | Voice conversations (speech recognition and spoken replies); and Grok models where an agent's owner has selected one | Your voice audio and the transcript of a voice call; and, for agents on a Grok model, the conversation content sent to that agent | When you use the feature | Reached through Cloudflare AI Gateway. Provider DPA with Standard Contractual Clauses and UK Addendum |
| Alibaba Cloud Alibaba Cloud (Singapore) Private Ltd. (Alibaba Group) |
Singapore; parent company in China | Video generation from the description an agent writes | The video description an agent writes. No conversation history | When you use the feature | Reached through Cloudflare AI Gateway on Cloudflare's credentials. Not on Cloudflare's published sub-processor list, so disclosed here directly. Standard Contractual Clauses via Cloudflare's provider terms |
| ElevenLabs ElevenLabs, Inc. |
United States (New York) | Music generation from the description an agent writes | The music description an agent writes. No conversation history | When you use the feature | Reached through Cloudflare AI Gateway. Provider DPA with Standard Contractual Clauses and UK Addendum. Not on Cloudflare's published sub-processor list, so disclosed here directly |
| DeepSeek Hangzhou DeepSeek Artificial Intelligence Co., Ltd. |
China | DeepSeek models, only where an agent's owner has selected one for that agent | For agents on a DeepSeek model, the conversation content sent to that agent | When an agent's owner selects it | Reached through Cloudflare AI Gateway. Not on Cloudflare's published sub-processor list, so disclosed here directly. No adequacy decision covers China; an agent owner selecting this model should tell their users. Not used by any official Omnimatch agent |
| Mistral AI Mistral AI SAS |
France | Mistral models, only where an agent's owner has selected one for that agent | For agents on a Mistral model, the conversation content sent to that agent | When an agent's owner selects it | Within the EU. Reached through Cloudflare AI Gateway |
Search and data providers an agent can call while answering. They receive the query the agent writes, not your account details.
| Provider | Location | What we use it for | What it receives | When | Transfer basis |
|---|---|---|---|---|---|
| Exa Exa Laboratories, Inc. |
United States | Web search, research search, and page reading when an agent looks something up | The search query or URL the agent writes. Not your account details | Every use | Provider DPA with Standard Contractual Clauses and UK Addendum |
| Google Maps Platform Google LLC / Google Ireland Limited |
United States and Ireland | Place search, routes, geocoding, and 3D flyover tiles for the map and route elements | The place names, addresses, or coordinates an agent looks up. Not your account details | When you use the feature | Provider DPA with Standard Contractual Clauses and UK Addendum |
| GIPHY Giphy, Inc. (a Shutterstock company) |
United States | GIF search for the memes lookup | The search query the agent writes | When you use the feature | Provider DPA with Standard Contractual Clauses and UK Addendum |
| Semantic Scholar Allen Institute for AI |
United States | Academic paper search behind the research lookups | The search query the agent writes | When you use the feature | Provider terms (non-profit research service) |
| Homedata Homedata Ltd |
United Kingdom | Live UK property listings behind the property lookups | The area or property query the agent writes | When you use the feature | Within the UK |
These process data only where a person or an agent owner has chosen to connect them. For most of them the person doing the connecting already has their own relationship with the provider.
| Provider | Location | What we use it for | What it receives | When | Transfer basis |
|---|---|---|---|---|---|
| Recall.ai Recall.ai, Inc. |
United States; our account is in Recall's EU region, so recordings and transcripts are processed in Frankfurt (AWS eu-central-1) | The meeting notetaker bot that joins video calls, records, and transcribes them | Meeting audio, video, transcripts, and participant names for the meetings you send the bot to | When you use the feature | Processing pinned to the EU region. Provider DPA with Standard Contractual Clauses and UK Addendum for anything the US entity touches |
| Google Chat Google LLC / Google Ireland Limited |
United States and Ireland | Talking to an agent from Google Chat, where a workspace admin has installed it | The messages exchanged in that channel and the Google identity of the sender | When you connect it | Provider DPA with Standard Contractual Clauses and UK Addendum |
| Microsoft Teams Microsoft Ireland Operations Limited / Microsoft Corporation |
Ireland and United States | Talking to an agent from Teams, via the Bot Framework | The messages exchanged in that channel and the Teams identity of the sender | When you connect it | Provider DPA with Standard Contractual Clauses and UK Addendum |
| Telegram Telegram FZ-LLC |
United Arab Emirates (Dubai) | Talking to an agent from Telegram | The messages exchanged in that channel and the Telegram identity of the sender | When you connect it | You choose to use Telegram; its own terms govern its handling |
| Discord (channel) Discord Inc. |
United States | Talking to an agent from a Discord server | The messages exchanged in that channel and the Discord identity of the sender | When you connect it | Provider DPA with Standard Contractual Clauses and UK Addendum |
| WhatsApp Meta Platforms Ireland Limited / WhatsApp LLC |
Ireland and United States | Talking to an agent from WhatsApp, through the WhatsApp Business Cloud API | The messages exchanged in that channel and the phone number of the sender | When you connect it | Provider DPA with Standard Contractual Clauses and UK Addendum; Meta is certified under the EU-US and UK Data Privacy Framework |
| Apps you connect The vendor of each app (Notion, Linear, Jira, Attio, Airtable, monday.com, Intercom, Canva, Zapier and others in the catalogue) |
Varies by vendor | Where you link your own account so an agent can work inside it | What the agent reads and writes on your behalf in that app, under your own account with that vendor | When you connect it | Your own agreement with that vendor. We hold an access token for your account, encrypted at rest |
| Tools an agent owner adds The vendor of each tool, on the agent owner's own key |
Varies by vendor | Agent owners can add tools from our catalogue or write their own that call an outside service with a key they hold (applicant-tracking systems, data providers, and so on) | Whatever the owner's tool sends. The owner is the controller for that flow and is responsible for telling their users | When an agent's owner selects it | The owner's own agreement with that vendor |
Tools our team uses to run the service, which see a small amount of personal data in doing so.
| Provider | Location | What we use it for | What it receives | When | Transfer basis |
|---|---|---|---|---|---|
| Discord (our team alerts) Discord Inc. |
United States | Alerts to our own team's private Discord: a new sign-up, a new paid subscription, negative feedback left in a conversation, and an agent flagged for review | Name and email address of the person concerned, the agent involved, and for feedback a short excerpt of what was said | Our team's operations | Provider DPA with Standard Contractual Clauses and UK Addendum |
The web app itself loads a few things from third parties. They see your IP address and standard request headers, as any website you visit does, but they receive no account data or conversation content from us.
| Service | What it serves | When |
|---|---|---|
| Google Fonts (Google LLC) | Serves the two typefaces the web app uses | Every page load of the web app |
| OpenFreeMap | Map tiles for the map element | When an agent draws a map |
| Google Maps tiles (Google LLC) | Basemap and 3D tiles for the route and flyover elements | When an agent draws a route or flyover |
| YouTube (Google LLC) and Spotify | Embedded players in the music queue and for video links an agent shares | When you play an embedded track or video |
| Cloudflare Turnstile | Bot check on sign-in | When you sign in |
| Your browser's push service (Apple, Google, or Mozilla) | Delivers web push notifications you have opted into | Only if you turn notifications on; the notification body is encrypted to your browser |
@cf/ model ids). Cloudflare licenses the weights and runs the inference; nothing
reaches them.We add a row before a new provider starts receiving personal data, and remove one when it stops. Customers who need notice of changes can ask us at privacy@omnimatch.work to be told when this page changes. The date at the top moves with every change.