Legal
Subprocessors
Last updated: March 1, 2026
1. Introduction
Ovvoc ("we," "us," or "our") engages certain third-party service providers ("subprocessors") to assist in delivering the Service. Each subprocessor processes personal data only to the extent necessary to perform the specific function described below.
This page is maintained in accordance with Article 28 of the General Data Protection Regulation (GDPR) and is referenced in our Data Processing Agreement (DPA). We update this list whenever our subprocessors change and provide advance notice as described in Section 4 below.
2. Current Subprocessors
The following subprocessors are currently authorized to process personal data on our behalf as part of delivering the Service:
| Subprocessor | Purpose | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| GitHub, Inc. | Source code access, pull request creation, OAuth authentication | Repository contents, user profile, installation permissions | United States | Link |
| Paddle.com Market Ltd | Payment processing (Merchant of Record), billing, invoicing, tax compliance | Email, billing address, payment method (handled by Paddle), subscription data | United Kingdom | Link |
| Google LLC (Gemini API) | AI-assisted code transformations for complex breaking changes | Code snippets (minimum context), transformation instructions | United States | Link |
| Resend, Inc. | Transactional email delivery (notifications, password reset, weekly digest) | Email address, notification content | United States | Link |
| Cloudflare, Inc. | Content delivery, DDoS protection, DNS, tunnel connectivity | IP address, request metadata | United States (global edge) | Link |
3. Infrastructure Providers
The following providers supply hosting, computing, and storage infrastructure for the Service. They process data in accordance with their standard data processing agreements:
| Provider | Purpose | Data Processed | Location | Privacy Policy |
|---|---|---|---|---|
| Google Cloud Platform | Cloud computing, container execution, database hosting, object storage | All Service data (encrypted at rest and in transit) | United States | Link |
4. Change Notification
We will provide at least 30 days' advance written notice via email before engaging any new subprocessor or materially changing the scope of an existing subprocessor's data processing activities. The notice will identify the new subprocessor, describe the processing activities, and specify the effective date of the change.
Objection mechanism. If you have a legitimate objection to a new subprocessor, you may submit a written objection to [email protected] within 30 days of receiving the notification. Upon receiving your objection, we will work with you in good faith to find a mutually acceptable resolution, which may include:
- Providing an alternative configuration that avoids routing your data through the objected-to subprocessor;
- Pausing the engagement of the new subprocessor while a resolution is sought;
- If no resolution can be reached within 30 days of your objection, you may terminate your Subscription by providing written notice, and we will issue a prorated refund for any prepaid fees covering the remainder of your billing period after the effective date of termination.
5. Historical Changes
No changes since initial publication.
6. Contact
For questions about this subprocessor list or our data processing practices, please contact us at [email protected].