Effective 11 August 2026
Subprocessors
What this page is
A subprocessor is a company that processes data on our behalf so that Oda can work. This is the current list, referenced by our Privacy Policy. We keep it here rather than inside the policy so that changing a provider updates this page instead of reopening the policy.
We do not sell your data to anyone on this list, and none of them may use your data for their own purposes.
Infrastructure
Where Oda runs and where your workspace data is stored.
| Provider | What it does | Where |
|---|---|---|
| Google Cloud Platform | Application hosting, primary database, secret storage | European Union (Belgium) |
| Cloudflare | Website hosting, object storage for generated sites and assets, DNS | Global edge network |
AI model providers
These receive the parts of your business context and instructions needed to draft your work. Two of them, DeepSeek and Moonshot AI, are based in China; the rest are in the United States and the EU. If that matters for your business, tell us — it is a reasonable thing to ask about and we would rather have the conversation than have you discover it here.
| Provider | What it does | Where |
|---|---|---|
| Anthropic | Conversational agent and drafting | United States |
| DeepSeek | Background task execution | China |
| OpenAI | Model calls for selected tasks | United States |
| Google (Gemini) | Model calls for selected tasks | United States, EU |
| Moonshot AI | Image and screenshot analysis | China |
Content, media, and research
| Provider | What it does | Where |
|---|---|---|
| Recraft | Logo and brand image generation | United States |
| Replicate | Hosted model inference for images | United States |
| fal | Video generation | United States |
| Pexels | Stock photo search (receives a search term, no personal data) | United States |
| AssemblyAI | Transcription of voice notes you record | United States |
| Serper | Web search queries for research tasks | United States |
Email, payments, and monitoring
| Provider | What it does | Where |
|---|---|---|
| Resend | Sending and receiving email on your instruction | United States |
| Stripe | Subscription and credit payments (card details never reach Oda) | United States, EU |
| Sentry | Error reports and crash diagnostics | United States |
| Langfuse | Agent execution traces for debugging | European Union |
Used only for specific features
These receive data only if you use the feature they support — for example, GitHub only holds a repository if Oda builds you a website.
| Provider | What it does | Where |
|---|---|---|
| GitHub | Source repositories for websites Oda builds you | United States |
| TiDB (PingCAP) | Database for web apps Oda builds you | United States, EU |
| Namecheap | Domain registration when you buy a domain | United States |
Platforms you connect yourself
Nothing reaches these unless you connect the account, and then only for actions you have approved. Disconnecting an integration in Oda stops the flow and deletes the stored token.
| Provider | What it does | Where |
|---|---|---|
| Meta | Instagram publishing and, if used, Meta Ads | United States, EU |
| Sign-in and, if connected, Calendar | United States, EU | |
| Account connection | United States, EU |
International transfers
Oda's application and primary database run in the European Union. Several providers above process data outside the European Economic Area. Where that happens we rely on the safeguards permitted under Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.
Changes
We update this page when we add or remove a provider. If you need advance notice of changes for your own compliance obligations, email amine@oda.do and we will add you to the notification list.