Om Concepts uses the vendors below to operate this site and its related services. This list is part of our privacy notice and is kept current. Email alex@omconcepts.net to subscribe to material changes.
Current sub-processors
| Processor | Purpose | Data shared | Country | Security |
|---|---|---|---|---|
| Notion | CRM and lead storage | Contact form submissions, UTM parameters, guide requests, lead receipts | United States | SOC 2 Type II, ISO 27001 |
| Resend | Transactional email delivery | Recipient email, message subject, message body, delivery metadata | United States | SOC 2 Type II |
| Vercel | Hosting, edge functions, and server logs | IP address, user agent, request paths | United States | SOC 2 Type II, ISO 27001 |
| OpenAI | Live concierge chat | Chat messages, the page the visitor was on, and a hashed IP identifier | United States | SOC 2 Type II |
| Upstash | Rate-limit and budget counters | Hashed IP keys and request counters, short lived | United States | SOC 2 Type II |
| Google (Google Analytics 4) | Aggregate traffic analytics (loaded only when enabled) | UTM parameters, page interactions, device category. GA4 uses IP addresses transiently for geolocation and does not log or store them | United States | ISO 27001, SOC 2 Type II |
| Metricool | Website visit analytics (loaded only when analytics is enabled) | IP-derived country, viewed page URL, visit timestamp, and browser request metadata | Spain / European Union | Privacy and security information |
| Fireflies | Optional voice-agent calls and transcription | Name, email, call audio, transcript, summary, and call metadata when a visitor starts the voice agent | United States | SOC 2 Type II |
A note on the concierge chat: OpenAI may retain conversation content and use it to improve its models under its own terms. The chat interface tells visitors to keep confidential details out of chat, and the same advice applies here.
Additional categories we may use
The named table above lists vendors that hold data from every visitor or lead who interacts with this site. The categories below cover vendors we engage on a per-project basis, typically scoped to a specific client engagement. Any category addition that becomes an always-on dependency of the site is promoted to the named table above and announced per the change policy. We do not sell your personal information to any third party.
- AI and language-model providers engaged on a per-project basis for client work and internal workflows. Includes providers such as Anthropic, Google, and Perplexity. For this per-project work, data is shared only when a specific engagement requires it, personal details are minimized before transmission, and we store audit records with personal details stripped. The live concierge chat is always on and runs on OpenAI, so OpenAI has its own row in the named table above.
- Customer communication and SMS providers for lead follow-up, appointment reminders, and two-way messaging.
- Payment processors for any paid engagement, invoice, or checkout flow.
- Accounting and bookkeeping integrations for invoicing and client receivables.
- CRM and marketing automation providers for lead intake, nurture, and customer records beyond the current CRM of record.
- Scheduling and calendar providers for bookings and availability.
- Automation and workflow platforms that route data between the systems above.
- Voice, video, and transcription platforms for conferencing and meeting-transcription during discovery calls and client work, with participant notice before recording.
- Tag management and analytics beyond what is listed, loaded only when analytics consent allows.
International transfers
Most named sub-processors operate in the United States. Metricool operates from Spain in the European Union. Categorical providers engaged on a per-project basis are selected from vendors that process data in the United States unless a client engagement specifies otherwise. For data originating in the EU, UK, or Switzerland, we rely on Standard Contractual Clauses and equivalent safeguards that our sub-processors provide in their own data processing terms.
Changes to this list
We update this page when we add or remove a sub-processor. If a change materially expands how your data is shared, we will notify affected contacts at least 30 days before the change takes effect.
Contact
Questions about this list go to alex@omconcepts.net.