Privacy / Subprocessors

Who we share data with

Ophie relies on a small set of vetted service providers to deliver voice sessions, store memories, and keep the service safe. This page lists every one of them, what they receive, and where they process it.

Last updated September 1, 2026

Data-processing agreements

Most providers below are bound by a written DPA covering security, breach notification, and subprocessor flow-downs. Where a provider does not offer one, or where ours is not yet executed, the provider's card says so.

Model training

Ophie does not train models on your data. Provider protections vary: some are contractually barred, while others require an opt-out or do not state a rule. Those differences and unresolved controls are flagged below.

30-day notice

We give at least 30 days' advance notice before adding a new subprocessor that handles consumer health data.

Active providers receive data under our current configuration. Failover only providers receive data solely when the primary provider errors out. Not currently used providers are integrated and listed for completeness, but no data reaches them under the running configuration. Providers marked Health data can receive consumer health data and are also named in our Consumer Health Data Privacy Notice. Runtime selection and the active-recipient list were last reconciled on 2026-09-01. Vendor legal-page review dates vary; contract and evidence status is tracked separately and remains subject to final legal review.

Providers whose default is to train on inputs

These providers use what we send for model improvement unless we opt out. We disclose them rather than describe our stack as uniformly no-training: AssemblyAI, Inc.; Deepgram, Inc.; Cartesia AI, Inc.; Together Computer, Inc. (Together AI); Voyage AI Innovations, Inc. (a MongoDB, Inc. company); PostHog, Inc..

Supabase, Inc.

DataActiveHealth dataTraining not addressed

Managed Postgres database, authentication, file storage, and auth-flow email (account confirmation, password reset)

Data: Account identity; sessions; transcripts (Memory mode); memories; topics; emotional snapshots; consent records. Sensitive columns are envelope-encrypted at the application layer before storage.
Region: United States
Residency: Supabase's DPA permits processing anywhere it or its subprocessors maintain facilities; its SCC annex lists a Singapore registered office and its privacy policy names the United States and Singapore.
Agreement: Not click-through — must be requested from the dashboard's legal-documents page and signed via PandaDoc
Links: Privacy DPA / Terms

LiveKit Incorporated

InfrastructureActiveHealth dataNo training (contractual)

Real-time WebRTC voice transport and LiveKit Cloud hosting of our voice agent runtime

Data: Voice audio stream (transient); session and room identifiers; conversation content processed in memory by our agent while it runs on LiveKit Cloud
Region: United States
Training: DPA: inference data “is not logged or retained … and is not used for training, fine-tuning, or model improvement.” Strongest language in the stack.
Residency: Reserves transfer outside the US for users accessing from abroad; observability data is stored in the US regardless of the selected region.
Links: Privacy DPA / Terms

Speechify, Inc.

AI / MLActiveHealth dataTraining not addressed

Primary text-to-speech voice synthesis (the Simba 3.2 streaming model) — speaks Ophie's replies aloud

Data: AI response text plus prosody markup we generate. Speechify receives no voice audio and none of your messages.
Region: United States
Training: Neither the AI Voice API supplemental terms nor the privacy policy addresses whether API inputs are used to train models. The API terms permit Speechify to retain submitted material to generate output, with no stated retention period or zero-retention option. The only explicit no-training commitment on their pages is scoped to Google Workspace data, which we do not send.
Residency: Privacy policy states information “will be transferred to, processed, and stored in the United States,” with standard contractual clauses used for EEA, UK, and Swiss transfers.
Agreement: NO PUBLIC DPA EXISTS (their /dpa path returns 404 and none is referenced in their terms) — one would have to be requested commercially. Breach notice is discretionary (“we may attempt to notify you”), with no stated SLA. Obtain written training, retention, and breach-notice terms before prd.
Links: Privacy

AssemblyAI, Inc.

AI / MLActiveHealth dataTrains unless opted out

Streaming speech-to-text transcription of your voice during sessions (Universal-3.5 Realtime Pro), plus batch transcription of session audio

Data: Voice audio stream (transient) and the transcripts produced from it. Batch uploads carry a configurable time-to-live; final batch transcripts auto-delete after 30 days by default.
Region: United States
Training: Their ToS grants a license to use customer data “to train AssemblyAI's artificial intelligence and machine learning models” unless the account opts out via the dashboard's Data Controls page (paid plans only). Training inputs undergo PII redaction; BAA and EU-endpoint customers are excluded automatically. Zero data retention for streaming audio and transcripts applies only while opted out — verify the account-level opt-out and zero-retention settings before prd.
Residency: We use the US endpoint, on which AssemblyAI states data stays in the US. EU endpoints exist and are unused by us. Certified under the EU–US, UK–US, and Swiss–US Data Privacy Frameworks.
Agreement: Self-serve DPA incorporated into their Terms of Service; a BAA is offered, and executing one locks the training opt-out. SOC 2 Type 2 certified.
Links: Privacy DPA / Terms

Deepgram, Inc.

AI / MLFailover onlyHealth dataTrains unless opted out

Last-resort text-to-speech fallback when the primary voice provider fails to initialize; formerly also the streaming speech-to-text provider (not selected while the AssemblyAI override is set)

Data: AI response text for fallback synthesis, and voice audio (transient) only if the legacy speech-to-text path is re-selected. We send the Model Improvement Program opt-out on every request.
Region: United States
Training: The per-request mip_opt_out flag is the only mechanism documented on Deepgram's pages. No account-level or contractual no-training term was found. Any request that omits the flag is unprotected.
Residency: Also operates EU and Australia regional endpoints; we use the US endpoint.
Agreement: DPA and any account-level Model Improvement Program opt-out must be requested — security@deepgram.com. HIPAA BAA offered on request.
Links: Privacy

Hume AI, Inc.

AI / MLNot currently usedHealth dataNo training (contractual)

Text-to-speech voice synthesis (Octave 2) — selectable alternate; not selected under the current configuration

Data: AI response text, plus optional stylistic instructions, only if selected. Octave's documented input schema accepts text only — Hume receives no voice audio and none of your messages, and we do not use Hume's expression-measurement products on user data.
Region: United States
Training: API data-usage policy: “Hume AI will not use data submitted by customers via our API to train or improve our models.” Their privacy page says the separate EVI product retains data and may use it for training — we do not use EVI, but the inconsistency is unresolved with Hume.
Residency: Hume states content is stored on its systems “in the US and around the world.”
Agreement: DPA and BAA by request — legal@hume.ai. No self-serve DPA.
Links: Privacy

Theai, Inc. (d/b/a Inworld AI)

AI / MLNot currently usedHealth dataNo training by default

Text-to-speech voice synthesis (selectable alternate; not selected under the current configuration)

Data: AI response text only, if selected
Region: United States
Training: Terms: “We will not train our generally available models on any Materials that are not publicly available,” with carve-outs for feedback and trust-and-safety review.
Residency: Terms state data may be stored or accessed in jurisdictions that “may or may not provide equivalent levels of data protection.”
Agreement: NO DPA EXISTS. Their /terms is a general ToS with no processing, retention, residency, SCC, or breach-notification terms. Obtain one or drop the integration.
Links: Privacy

Cartesia AI, Inc.

AI / MLNot currently usedHealth dataTrains unless opted out

Text-to-speech and speech-to-text (selectable alternate; not selected in production)

Data: AI response text and/or voice audio stream (transient), only if selected
Region: United States
Training: ToS: inputs, outputs and interactions “may be used by Cartesia to train, enhance, evolve and improve its … models.” Opt-out is a web form. Cartesia was our live TTS provider until 2026-07-16.
Residency: ToS frames the service as offered from US facilities; the DPA nonetheless authorizes international transfers under SCCs.
Links: Privacy DPA / Terms

OpenAI OpCo, LLC

AI / MLActiveHealth dataNo training by default

Primary inference provider for our conversational LLM (GPT-5.6) — generates the AI response. An optional batch speech-to-text path (Whisper) exists but is not enabled.

Data: Conversation context: your messages, relevant memory snippets, and system instructions
Region: United States
Training: “Data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in).” Abuse-monitoring logs kept up to 30 days; zero-data-retention available on eligible endpoints.
Residency: Regional residency is offered, with the caveat that some regions “may require temporary processing outside the selected region.”
Agreement: BAA is a separate request to baa@openai.com and covers only zero-retention endpoints.
Links: Privacy DPA / Terms

Groq, Inc.

AI / MLActiveHealth dataNo training (contractual)

First automatic failover leg for the conversational LLM when the primary provider fails (an open-weight Qwen model); also inference for our crisis-detection safety classifier (the open-weight GPT-OSS-Safeguard 20B model), background reasoning models, and RAG summarization

Data: Short windows of conversation content for safety classification, background reasoning, and memory summarization; the full conversation context when conversational-LLM failover engages
Region: United States
Training: “By default, Groq does not retain customer data for inference requests.” Abuse-investigation logs, when created, are kept up to 30 days; a zero-data-retention setting disables even those.
Residency: Retained abuse logs are stored in US Google Cloud buckets, but the DPA reserves processing “in the United States and other countries.”
Links: Privacy DPA / Terms

DeepInfra, Inc.

AI / MLNot currently usedHealth dataNo training (contractual)

Former primary inference provider for the conversational LLM (an open-weight Tencent Hy3 model); the integration and credentials remain but no production code path selects it

Data: Conversation context: your messages, relevant memory snippets, and system instructions — only if re-enabled
Region: United States
Training: “We will not store, sell, or train using this data unless we have your explicit consent.” API data is held in memory for the duration of inference and not written to disk; inputs and outputs may be retained briefly for debugging. The carve-out for third-party sharing applies only to Google and Anthropic models, which we do not use here.
Residency: Delaware corporation headquartered in Palo Alto, California. The privacy policy does not commit to a processing region.
Agreement: No public DPA document. SOC 2 and ISO 27001 attestations are published via the trust center (trust.deepinfra.com); a DPA must be requested at policy@deepinfra.com. Request one before relying on any re-enabled path — this was the primary recipient of conversation content until 2026-08.
Links: Privacy

SILICONFLOW TECHNOLOGY PTE. LTD.

AI / MLNot currently usedHealth dataTraining not addressed

Former last-resort failover inference provider for the conversational LLM; the integration and credentials remain but no production code path selects it

Data: The same conversation context as the primary provider, only if re-enabled
Region: Singapore
Training: The published privacy policy does not address whether inputs or outputs are used to train or improve models. Marketing pages claim a zero-retention posture, but the policy itself says only that data is kept “as long as it is necessary to fulfil the purpose for which it was collected.” Absent a written commitment, we cannot represent that this provider does not train on our data.
Residency: Singapore-registered entity. The privacy policy names no processing region and reserves sharing “whether within or outside Singapore,” so a transfer outside the US should be assumed if this leg is ever re-enabled.
Agreement: No public DPA and no DPA request channel — only contact@siliconflow.com. Obtain written training, retention, and residency terms before this leg is relied on for anything but emergency continuity.
Links: Privacy

Weights and Biases, LLC (W&B Inference)

AI / MLNot currently usedHealth dataTraining not addressed

Former primary inference provider for the conversational LLM (an open-weight Qwen 3 model); the integration and credentials remain but no production code path selects it

Data: Conversation context: your messages, relevant memory snippets, and system instructions — only if re-enabled
Region: United States
Training: The DPA has no training clause. W&B's separate AI Terms grant the right to use customer data to “develop and improve the AI Features, subject to any Customer configured settings” — not a no-training commitment. No W&B document names the Inference product or its endpoint, so DPA coverage of it is unconfirmed.
Residency: The CoreWeave privacy policy that now governs states the company “operates globally and may transfer personal data to countries that may not provide the same level of data protection.”
Agreement: DPA counterparty is Weights and Biases, LLC; the privacy policy is published by CoreWeave, Inc. Confirm in writing which entity contracts for Inference and that the DPA covers the inference endpoint on our plan.
Links: Privacy DPA / Terms

Together Computer, Inc. (Together AI)

AI / MLActiveHealth dataTrains unless opted out

Inference for voice-session subconscious intuition and Guardian reasoning loops

Data: Short windows of conversation and memory context used by those background cognition loops
Region: North America
Training: Terms require the account to enable Zero Data Retention; only after enablement are inputs and outputs not stored, retained, used for training, or used for product improvement. Account-level ZDR activation is not evidenced in this repository.
Residency: Docs describe hosting in “North America” data centers; the privacy policy reserves processing wherever the parties are located. The exact production endpoint region is not evidenced.
Agreement: No public DPA was found, the checked DPA URL returns 404, and current Terms prohibit transmitting medical information or sensitive personal data. This is an active production compliance blocker, not approval for health-data processing.
Links: Privacy

Voyage AI Innovations, Inc. (a MongoDB, Inc. company)

AI / MLActiveHealth dataTrains unless opted out

Text-embedding and reranking models used for memory retrieval

Data: Short text snippets from your memories and transcripts, transiently, to compute embeddings
Region: United States
Training: Privacy policy: “unless you ‘opt out’ … you grant Voyage AI a worldwide, irrevocable, perpetual … license to use … the Customer Content … to train, improve, and otherwise further develop the Service.” The MongoDB DPA does not supersede or reference Voyage's own DPA.
Links: Privacy DPA / Terms

Pinecone Systems, Inc.

DataNot currently usedHealth dataTraining not addressed

Former managed vector database retained as a disabled rollback integration while Supabase pgvector is active

Data: Embedding vectors and operational tags only, if re-enabled; no plaintext conversation content and no directly identifying metadata
Region: United States
Residency: A cloud designation “does not preclude Pinecone from using other Cloud Providers or Cloud Provider regions.”
Agreement: Auto-incorporated into the master subscription agreement on signup. BAA requires separate execution.
Links: Privacy DPA / Terms

Amazon Web Services, Inc. (AWS Key Management Service)

SecurityActiveHealth dataNo training (contractual)

Key management for our application-layer envelope encryption

Data: Wrapped (encrypted) data-encryption keys and encryption-context identifiers only. AWS never receives conversation content or transcripts.
Region: United States
Residency: Our key is a single region-pinned CMK. The AWS DPA holds data in the selected region except as necessary to provide the service or to comply with a binding legal order.
Agreement: Incorporated into the AWS Service Terms and applies automatically — nothing to sign.
Links: Privacy DPA / Terms

Render Services, Inc.

InfrastructureActiveHealth dataTraining not addressed

Backend API hosting

Data: Service traffic, including conversation content in transit under TLS; operational logs exclude conversation content
Region: United States
Agreement: Render's legal pages are JavaScript-rendered and could not be read programmatically — these terms were not verified from a direct page read. Confirm manually.
Links: Privacy DPA / Terms

Netlify, Inc.

InfrastructureActiveHealth dataTraining not addressed

Frontend application hosting and CDN

Data: Service traffic in transit under TLS; operational logs exclude conversation content
Region: United States
Residency: Privacy policy reserves processing “outside your country or jurisdiction, including in places that are not subject to an adequacy decision.”
Agreement: “Our DPA is incorporated by reference in Netlify's terms and conditions” — nothing to sign.
Links: Privacy DPA / Terms

Functional Software, Inc. (d/b/a Sentry)

SecurityActiveHealth dataTraining not addressed

Error monitoring and performance telemetry (backend and client apps)

Data: Stack traces and request metadata, with personal information and conversation content scrubbed before transmission
Region: United States
Residency: DPA permits processing “in the United States and any other country in which we or our Subprocessors maintain data processing operations”; their subprocessor list includes Austrian, Canadian and Dutch entities.
Agreement: Must be entered into via Sentry's documented DPA process — not automatic on signup.
Links: Privacy DPA / Terms

PostHog, Inc.

AnalyticsActiveHealth dataTrains unless opted out

Product analytics — only if you opt in; the default is off

Data: Salted-hash user identifier and feature-usage events. No conversation content; IP capture disabled.
Region: United States
Training: Their DPA bars third parties from training on customer data, but their privacy policy reserves PostHog's own use of customer content for “development, testing, training, evaluation, and improvement” in aggregated or de-identified form, with an opt-out in service settings.
Residency: PostHog reserves transfer outside the selected region and does not affirmatively state on its legal pages that Cloud US data stays in the US.
Agreement: Must be generated and countersigned at app.posthog.com/legal — not click-through.
Links: Privacy DPA / Terms

Stripe, Inc.

PaymentsNot currently usedHealth dataTraining not addressed

Payment processing and subscription billing (not enabled during beta)

Data: Name; billing email; postal code; last four card digits; transaction metadata. No conversation content. Because subscribing to Ophie reveals that you seek mental-wellness support, we treat this relationship as consumer health data.
Region: United States
Residency: Stripe transfers personal data “on a global basis,” naming the United States and India.
Agreement: Forms part of the Stripe Services Agreement — nothing separate to sign.
Links: Privacy DPA / Terms

Plus Five Five, Inc. (d/b/a Resend)

CommunicationsActiveHealth dataTraining not addressed

Transactional email delivery (verification codes, receipts, policy notices)

Data: Email address and transactional message body only; never conversation content. Treated as consumer health data on the same “fact of use” basis as billing: receiving Ophie email reveals that you use a mental-wellness service.
Region: United States
Residency: Primary processing is in the US; the DPA reserves transfers outside the EEA, UK and Switzerland. All 22 listed sub-processors are US-based, including AWS for sending infrastructure.
Agreement: Binding on acceptance of the terms — nothing separate to sign.
Links: Privacy DPA / Terms

Kloudend, Inc. (ipapi.co)

InfrastructureActiveTraining not addressed

Coarse IP-based geolocation used at signup to enforce regional eligibility rules

Data: IP address
Region: United States
Residency: Henderson, Nevada. Their DPA reserves processing “in the United States and other regions in the world”; server logs are kept under a year.
Links: Privacy DPA / Terms

650 Industries, Inc. (Expo push service)

CommunicationsActiveTraining not addressed

Delivery of mobile push notifications, abstracting Apple Push Notification service and Firebase Cloud Messaging

Data: Push device token. Expo states notification content is never stored and is handled only for as long as it takes to send.
Region: United States
Residency: Reserves storage on servers outside the user's jurisdiction.
Agreement: Baseline processor terms are built into the standard ToS; an enterprise MSA/DPA requires contacting Expo.
Links: Privacy DPA / Terms

Apple Inc. (Sign in with Apple)

SecurityActiveTraining not addressed

Optional third-party authentication (mobile app only; not yet enabled on web)

Data: Authentication identifier, and the name and email or private relay address the user chooses to share
Region: United States
Agreement: No DPA and no processor language found in the Apple Developer Program License Agreement or the Sign in with Apple legal pages. Apple most likely acts in its own right rather than as our processor — counsel should confirm before we describe it either way.
Links: Privacy

Google LLC (Google Sign-In)

SecurityActiveTraining not addressed

Optional third-party authentication (mobile app only; not yet enabled on web)

Data: Authentication identifier / token
Region: United States
Agreement: Google's Cloud processor terms enumerate the services they cover and Google Sign-In is not among them, so those terms are the wrong instrument here. Treat Google as acting in its own right for the user's Google Account until counsel confirms otherwise.
Links: Privacy

Doppler Technologies, Inc.

SecurityActiveTraining not addressed

Secrets management (internal infrastructure only)

Data: No user data
Region: United States
Residency: Reserves storage in any country where it operates or engages vendors.
Agreement: Executing the agreement is deemed acceptance of the addendum — nothing separate to sign.
Links: Privacy DPA / Terms

Tango Card, Inc. (Blackhawk Network)

PaymentsNot currently usedTraining not addressed

Gift-card fulfillment for waitlist referral rewards (no API key configured in production; rewards are issued manually)

Data: Recipient name; email address; reward amount
Region: United States
Agreement: A business DPA exists and is incorporated by reference into an underlying commercial agreement. Blackhawk's pages block automated retrieval, so these terms were not read directly — confirm before relying on them.
Links: Privacy

International transfers

We select United States endpoints where providers offer them and the selection is evidenced. Together AI describes its hosting only as North America, and its exact production endpoint region is not evidenced. Several providers' agreements also reserve the right to process in other countries where they or their subprocessors operate; those limitations are noted under "Residency" above. EU, EEA, and UK access to the service is region-gated. If we ever change this, we will update this page and provide advance notice to affected users where required by law.

Stay informed of changes

To request advance notice when we add or change a subprocessor that handles consumer health data, email us with the subject line "Subprocessor notifications."

support@ophie.app