Sub-processors
The complete list of third parties that receive personal data from OmniOS OÜ. Each one in §§ 1 to 3 processes it on our behalf and is bound by a written agreement under Article 28 GDPR to act only on our instructions. The two sections after those are not processing appointments and say so: § 3b lists the market-data sources, which receive nothing about you, and § 3c the single advertising vendor, which does not act on our instructions. If a company is not on this page, it does not get your data.
- In force from
- Version
- 1.8
- Issued by
- OmniOS OÜ
Version 1.8, 17 October 2026: Stripe now processes only the records of subscriptions that predate the withdrawal of paid plans; no new payment is taken. Version 1.7 corrected the analytics inventory and distinguished optional Google Analytics from aggregate server-request measurement.
1Infrastructure
| Provider | Purpose | Personal data received | Location & transfer basis |
|---|---|---|---|
| OVH SAS (France) | Service hosting, compute, storage and recovery. | All service data at rest, including account records, billing metadata and logs. OVH does not access it in the ordinary course. | European Economic Area. |
| Cloudflare, Inc. (United States) and Cloudflare Germany GmbH | Website delivery, DNS and network security. | IP address, user agent, requested URL, timestamp, TLS metadata. No account or billing content. | Global edge network. SCCs under Cloudflare's data processing addendum. |
2Product services
| Provider | Purpose | Personal data received | Location & transfer basis |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | Payment records, refunds and the billing portal for the subscriptions that predate 17 October 2026, when paid plans were withdrawn. No new payment is taken. | Name, email, billing address, country, card details (which went to Stripe directly and never reached us), subscription and payment history. | Ireland, with onward transfer within the Stripe group under SCCs. Stripe is a controller in its own right for fraud prevention and its regulatory obligations. |
| Google Ireland Limited | Google sign-in and optional app analytics, each with a separate choice. | Basic Google identity information when you choose Google sign-in; pseudonymous usage measurements when you separately enable optional Google Analytics. No account or payment details are sent to Analytics. | Ireland and processing within the Google group, under the applicable Google service and data processing terms. See the privacy and cookie policies for the separate purposes and choices. |
| OpenAI (OpenAI Ireland Limited for EEA customers; OpenAI, L.L.C.) | The language model behind the Vi AI assistant and behind news summarisation. | The text of your Vi AI prompts and the assistant's replies. No account identifier, no email, no billing data. | United States. SCCs under OpenAI's data processing addendum. Under its API terms, API content is not used to train its models and is retained for a limited abuse-monitoring window only. |
| Telegram (Telegram FZ-LLC) | Delivery of the alerts you configure, only if you connect a Telegram account. | Your Telegram chat identifier and the text of the alerts you asked for. | Outside the EEA. Transfer is necessary to perform the contract you asked for (Art. 49(1)(b) GDPR) — you chose the delivery platform. |
3Transactional email
Account email — sign-in links, password resets, billing receipts, security notices and the change notifications these documents require — is delivered over authenticated SMTP. The delivery provider is named in the row below and is bound by an Art. 28 processing agreement.
| Provider | Purpose | Personal data received | Location & transfer basis |
|---|---|---|---|
| SMTP delivery provider — to be confirmed before launch | Sending transactional email. | Recipient email address, message subject and body, delivery outcome. | To be recorded here once the provider is fixed. Choose an EU-established provider so this row needs no transfer mechanism. |
3bData sources, which are not processors
These are where the market data comes from. They process nothing on our behalf and receive nothing about you: our systems read their public endpoints, and the request carries our infrastructure's address, never yours. They are listed so the boundary is visible.
| Source | What we read | What they receive about you |
|---|---|---|
| Cryptocurrency exchanges (24+ venues) | Public trades, order books, tickers and funding data. | Nothing. |
| Public blockchains, including Polygon via public RPC providers | On-chain transactions and balances. | Nothing. |
| Polymarket public data, Gamma and CLOB APIs | Public markets, prices, order books, trades, resolutions and the public leaderboard, including the profile names participants chose. | Nothing. We do not hold an account on your behalf and never send them your identity. |
If you follow a link from the Service to one of these venues, you are dealing with them directly under their terms, and what they collect from that point is described in their policies, not ours.
3cAdvertising measurement, which is not a processing agreement
We measure whether the advertisements that bring people to Vultax actually work. That measurement is now a single server-to-server event per newsletter subscription — the browser pixel described in earlier versions of the cookie policy has been removed, so nothing of OpenAI's runs on the visitor's device. It remains the one entry on this page that is not an appointment under Article 28: OpenAI's published Ad Tools terms state that each side acts as an independent controller of what passes through the measurement tools, so it is listed separately rather than folded in above.
| Provider | Purpose | Personal data received | Location & transfer basis |
|---|---|---|---|
| OpenAI — ChatGPT Ads Conversions API (server-side only) | Measuring newsletter subscriptions where server-side advertising measurement is configured. This is separate from optional browser analytics. | A one-way SHA-256 hash of the newsletter email address, request IP address, browser user agent, the page address without its query or fragment, and an event reference used to prevent duplicates. No advertising cookie or ad-click reference is included. The email address itself and payment details are not sent. | Treated as a transfer outside the EEA. Not an Article 28 appointment: under OpenAI's published Ad Tools terms each side acts as an independent controller of this data, so OpenAI does not act on our instructions and is not a sub-processor of ours. The contracting entity and the transfer clauses appear here once the signed terms are on file. |
4Measurement limits and tools we do not use
- No ad exchanges, retargeting or audience uploads. Server-side subscription measurement is described separately in § 3c.
- Detailed browser analytics is optional on both sites. Our own measurement operates only after an explicit saved choice. Google Analytics is currently configured in the app. Aggregate request counts are derived from existing server traffic without an analytics cookie or browser beacon. There is no Google advertising measurement on either site.
- No session-replay or heatmap tools. We do not record your screen or your mouse.
- No data brokers. We buy no personal data and enrich no profile.
- No customer-data platform or marketing automation suite holding a copy of the user base.
5Changes to this list
This page is the authoritative list. Before we add a sub-processor that will handle customer personal data, we publish it here at least 30 days in advance and, for customers with a signed data processing agreement, email the notification address on the agreement.
A business customer may object to a new sub-processor on reasonable data-protection grounds within those 30 days by writing to [email protected]. If we cannot offer a workaround, you may terminate the affected subscription and we will refund the unused part of what you have paid.
Where a change is forced on us with less notice — a provider withdrawing a service, or a security incident requiring an immediate move — we make the change and publish it here as soon as we can, with the reason.