Legal
Last updated: August 1, 2026
Ovrtxt uses the following third-party sub-processors to deliver the Services. We maintain contractual data processing agreements with each sub-processor and conduct periodic reviews of their security posture. We will provide at least 30 days' notice of any material changes to this list.
To subscribe to subprocessor change notifications, email privacy@ovrtxt.com with the subject "Subprocessor Notifications."
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Cloud Platform | Infrastructure hosting, cloud compute, and databases | API request data, session metadata, hashed phone numbers | USA, EU (Ireland) |
| Twilio (Inbound Only) | Inbound MO-SMS reception and routing to Ovrtxt's pipeline | Sender phone number, message body (cryptographic token), timestamp | USA |
| Google Business Messaging (RCS) | RCS Rich Card delivery to supported Android and iOS devices | Recipient phone number, brand name, logo URL, session token | USA, Global CDN |
| Cloudflare | DDoS protection, WAF, global CDN for API edge | IP addresses, HTTP headers (no persistent storage of body content) | Global |
| Stripe | Payment processing and subscription billing | Customer billing name, email, payment card metadata (no PAN) | USA, EU |
| Datadog | Infrastructure monitoring, error tracking, and alerting | Anonymized API metrics, error traces (no personal data in logs) | USA |
| PagerDuty | On-call incident management and alerting | Engineer contact details (Ovrtxt staff only) | USA |
| Plausible Analytics | Privacy-preserving web analytics for the marketing site | Anonymized page views (no cookies, no cross-site tracking) | EU (Germany) |
All sub-processors are bound by data processing agreements that meet GDPR Article 28 requirements. For questions about this list, contact privacy@ovrtxt.com.