Om Concepts uses the vendors below to operate this site and its related services. This list is part of our privacy notice and is kept current. Email alex@omconcepts.net to subscribe to material changes.
Current sub-processors
| Processor | Purpose | Data shared | Country | Security |
|---|---|---|---|---|
| Notion | CRM and lead storage | Contact form submissions, UTM parameters, guide requests, lead receipts, and visitor-approved consultation briefs and contact details | United States | SOC 2 Type II, ISO 27001 |
| Resend | Transactional email delivery | Recipient email, message subject, message body, delivery metadata | United States | SOC 2 Type II |
| Vercel | Hosting, edge functions, server logs, and always-on cookieless Web Analytics | IP address, user agent, request paths, and cookieless aggregate visit measurements | United States | SOC 2 Type II, ISO 27001 |
| OpenAI | Concierge chat, optional website voice and consultations | Chat messages and public page context; microphone audio and the current voice-session transcript when the visitor starts voice; consultation draft and conversation context for delegated Responses processing under OpenAI API retention terms | United States | SOC 2 Type II |
| Upstash | Rate limits, usage budgets, private voice transcript storage, voice session recovery and consultation delivery recovery | Hashed IP identifiers and request counters; Om and OpenAI voice session identifiers, receipt identifiers, model name, hashes of agent instructions, timestamps, reserved and measured duration, session status, and closure reason; voice captions with visitor agreement for up to seven days from call start; approved consultation payloads pending delivery for up to seven days and non-content deduplication metadata for 30 days | United States | SOC 2 Type II |
| Google (Google Analytics 4) | Aggregate traffic analytics after opt-in on production omconcepts.net | UTM parameters, page interactions, and device category. Google Signals and Google Ads personalization are disabled, advertising consent stays denied, and event and user data retention is 14 months. GA4 uses IP addresses transiently for geolocation and does not log or store them | United States | ISO 27001, SOC 2 Type II |
| Metricool | Cookieless website visit analytics after opt-in on production omconcepts.net | IP-derived country, viewed page URL, visit timestamp, and browser request metadata | Spain / European Union | Privacy and security information |
Upstash stores voice usage and security records so we can enforce limits and close interrupted sessions. Closed voice records expire seven days after closure or safe cancellation is recorded. Unresolved records have no automatic expiration and remain while we verify closure or safe cancellation. This ledger does not contain audio recordings or full voice transcripts.
With the visitor's agreement before starting voice, Om separately stores voice captions in Upstash for private review by Alex. These text transcripts expire no later than seven days from call start, even if the usage record is unresolved. They are not copied to Notion or inquiry notification emails. Om does not save audio recordings.
OpenAI API data is not used to train its models by default. Its abuse-monitoring retention rules still apply. Om disables recording for website voice sessions. Keep confidential details out of chat and voice. See OpenAI's data controls.
Additional categories we may use
The named table above lists vendors that hold data from every visitor or lead who interacts with this site. The categories below cover vendors we engage on a per-project basis, typically scoped to a specific client engagement. Any category addition that becomes an always-on dependency of the site is promoted to the named table above and announced per the change policy. We do not sell your personal information to any third party.
- AI and language-model providers engaged on a per-project basis for client work and internal workflows. Includes providers such as Anthropic, Google, and Perplexity. For this per-project work, data is shared only when a specific engagement requires it, personal details are minimized before transmission, and we store audit records with personal details stripped. The live concierge chat is always on and runs on OpenAI, so OpenAI has its own row in the named table above.
- Customer communication and SMS providers for lead follow-up, appointment reminders, and two-way messaging.
- Payment processors for any paid engagement, invoice, or checkout flow.
- Accounting and bookkeeping integrations for invoicing and client receivables.
- CRM and marketing automation providers for lead intake, nurture, and customer records beyond the current CRM of record.
- Scheduling and calendar providers for bookings and availability.
- Automation and workflow platforms that route data between the systems above.
- Voice, video, and transcription platforms for conferencing and meeting-transcription during discovery calls and client work, with participant notice before recording.
- Tag management and analytics beyond what is listed, loaded only when analytics consent allows.
International transfers
Most named sub-processors operate in the United States. Metricool operates from Spain in the European Union. Categorical providers engaged on a per-project basis are selected from vendors that process data in the United States unless a client engagement specifies otherwise. For data originating in the EU, UK, or Switzerland, we rely on Standard Contractual Clauses and equivalent safeguards that our sub-processors provide in their own data processing terms.
Changes to this list
We update this page when we add or remove a sub-processor. If a change materially expands how your data is shared, we will notify affected contacts at least 30 days before the change takes effect.
Contact
Questions about this list go to alex@omconcepts.net.