Subprocessors
Every company that may process your information so Omega Ex can work, and what each one receives.
Contents
These are the companies that may process your information so Omega Ex can work. We do not send your content to anyone not on this page.
Omega Ex runs mainly on your own device. Most of what you do stays there. What leaves is listed below.
AI providers
To answer you, the app sends your request to one of these. Which one depends on the task and on your settings, shown live in the app under Settings, Privacy.
| Provider | What it receives | When | Location |
|---|---|---|---|
| Anthropic, PBC (Claude) | Your messages, the memory block, attached files, meeting transcripts for note writing, and content from an account you connect, such as mail, calendar events, files or tasks, when a request uses it | The primary assistant. Always in use | United States |
| Google LLC (Gemini) | Your messages, research queries and pages fetched for them, transcripts for summarising, text submitted for search indexing, and content from an account you connect when a request uses it, within the limits below | Default for quick actions, research, summaries, and image generation | United States |
| OpenAI, L.L.C. | Your messages and the memory block | If you select an OpenAI model, or connect your own key | United States |
| Perplexity AI, Inc. | The content of that request only. Never your stored memory | Only if you select it | United States |
| xAI Corp. (Grok) | The content of that request only. Never your stored memory | Only if you select it | United States |
| Mistral AI SAS | The content of that request only. Never your stored memory | Only if you select it | France |
If you connect your own provider key, requests on that key run on your account with that provider, under your agreement with them, and are billed to you.
Gemini is an AI service, separate from the Google account connection in Section 2 and browser speech recognition in Section 3. Connecting an account does not by itself send its contents to an AI provider. Omega Ex marks content it reads from an account you connect during a chat, and sends marked content to an AI model only on Claude on Omega Ex's own account, or on Gemini on Omega Ex's own key under terms that prohibit training on it, never on a provider key you added yourself. Chat history, once Omega Ex trims it to fit, which in a spoken conversation can happen within a few turns, or reloads it from storage (which can happen at any point), and summaries and tasks built from that content, carry no mark, so they can reach whichever provider and key a request uses, including a key you added yourself. Memory built from that content reaches only the providers that receive the memory block, including a key you added for one of them. While the hosted Google pilot's connection is active, and afterwards until pilot data has been deleted, keep no provider key other than an Anthropic key on the account, on the hosted service or in the desktop app. On the hosted service (the web app, and a desktop app connected to it), replies built from marked content, which Omega Ex marks too, are not spoken in the cloned voice or the avatar. Instead, the desktop app on a Mac says them in a voice built into the Mac, and otherwise they are shown as text (the web app does not speak replies). Omega Ex marks a reply only while the mail or calendar content it read is still in the chat history it works from, and earlier replies that repeat that content do not pass the mark on, so once Omega Ex trims a chat's history to fit, which in a spoken conversation can happen within a few turns, or reloads it from storage, which can happen at any point, a later reply built from those earlier replies may not carry it. On a desktop install running its own backend, replies built from connected-account content are held back from the avatar, subject to the same trim and reload gap, but the app's own speaker, which speaks replies in Conversation Mode and in Companion Mode (the on-screen helper), never checks the mark, so they can still be spoken in the cloned voice. The Limited Use commitment applies to Google content and anything derived from it. Google appears in four places on this page, two of them in Section 2, for four separate reasons, and none of them implies the others.
Connected accounts
When you connect an email, calendar or file account, Omega Ex reaches that provider directly on your instruction. The provider is not processing data on our behalf in that moment; it is your own account, answering you. We list them here anyway, because you should be able to see every company your data touches on one page.
| Provider | What it reaches | When | How it is authorised |
|---|---|---|---|
| Google LLC (ordinary account identifier; dated hosted Gmail and Calendar pilot) | On an installation configured for the identity tier, an account identifier only. Not the email address on it. The pilot adds reading each connected mailbox's own address; reading and searching mail, including message text, attachments and Trash; drafting, sending, labelling and archiving mail; and reading, creating, changing or deleting calendar events. Omega Ex cannot open your Drive files through either connection | Only if you connect a Google account. The prospective pilot covers one invited client and founder tests, ending at the row-level-security migration or 7 March 2027, whichever comes first | OAuth. Ordinary connection, tier identity: openid alone. Hosted pilot, tier mail_calendar: openid, https://www.googleapis.com/auth/calendar.events and restricted https://www.googleapis.com/auth/gmail.modify. No Drive, email or profile scope. The Privacy Policy states the consent and activation gates and the Suggest-only operating rule |
| Google LLC (company sign-in) | What Omega Ex reads about you when Google returns a sign-in, including one Omega Ex then refuses: your Google account identifier, your email address and whether Google has verified it, your organization's domain, and your name. Omega Ex adds only the identifier to your account, does not store your name, and keeps no Google token from the sign-in, so signing in adds nothing to Settings, Connections. Signing in gives Omega Ex no access to your mail, calendar or Drive files | Only if you start company sign-in with Google. It completes only on an account set up in advance for company sign-in, by us or by your organization's administrator, in an organization domain we have set up | OAuth, requesting openid, email and profile, in a request separate from connecting a Google account. Omega Ex does not look at connected accounts when it decides who may sign in. The Privacy Policy describes what is kept |
| Microsoft Corporation (Outlook, Calendar, OneDrive) | Reading your mail, calendar and OneDrive files, and sending mail as you, drafting, and creating, changing or deleting mail, calendar events and files | Only if you connect a Microsoft account | OAuth, with the ten scopes named in the Privacy Policy. Sending and deleting are queued for your approval first |
| Yahoo, and other IMAP mailboxes | Reading and searching that mailbox, and sending from it | Only if you connect one | An app password you create, encrypted before storage |
The second Google row, company sign-in, is not a connected account, so the paragraph above the table does not describe it, and its second column says what Omega Ex reads about you when Google returns a sign-in.
Data from a connected Google account carries a stricter commitment than anything else on this page. Our use and transfer of information received from Google APIs through a connected account adheres to the Google API Services User Data Policy, including the Limited Use requirements. The detail is in the Privacy Policy.
The hosted Google pilot uses Testing with explicitly listed test users and requires the client's Workspace administrator to trust the client ID. Grants require reconnection after seven days. It is not a general launch or a claim that Google verification or a CASA assessment has been completed. When the hosted service is configured for mail_calendar, every hosted account sees the Google row and consent screen for that tier; only listed test users can authorize the connection. The pilot does not authorize unattended mail or calendar writes. Disconnecting stops new access but does not erase content in messages, activity rows, derived memories or synced copies. Pilot data must be deleted at offboarding or the pilot's end; the Privacy Policy explains the limits of in-app deletion.
You can disconnect any connected account at any time in Settings, Connections. That deletes the stored credential, so Omega Ex stops having access. For a connected Google account we also revoke the grant with Google itself. Microsoft does not offer a revocation API, so after disconnecting you should also remove Omega Ex Connectors at myaccount.microsoft.com/privacy. An app password can be revoked directly with your mail provider, which cuts access immediately.
Speech and voice
| Provider | What it receives | When | Location |
|---|---|---|---|
| On-device speech engine | Nothing leaves your computer | The default on a desktop build that runs its own engine. No account or key needed | Your device |
| Our own server (Whisper) | Meeting and dictation audio from a desktop build connected to our hosted workspace, transcribed with Whisper, a speech engine Omega Ex runs itself. No speech company receives it | Always, on a desktop build connected to our hosted workspace, which has no local engine | United States (us-east-2, Northern Ohio), on Amazon Web Services |
| ElevenLabs Inc. | Reply text, and the voice samples a cloned voice was built from. On the hosted service, replies built from content read from a connected account in the same chat are not sent for the cloned voice: the desktop app on a Mac says them in a voice built into the Mac, and otherwise they are shown as text (the web app does not speak replies). Omega Ex marks such replies (see the box in Section 1), but only while the mail or calendar content it read is still in the chat history it works from, and earlier replies that repeat that content do not pass the mark on, so once Omega Ex trims a chat's history to fit, which in a spoken conversation can happen within a few turns, or reloads it from storage, which can happen at any point, a later reply built from those earlier replies may not carry it, and its text would then be sent. On a desktop install running its own backend, nothing holds those replies back from the cloned voice: the app's own speaker, which speaks replies in Conversation Mode and in Companion Mode (the on-screen helper), never checks the mark, so replies built from connected-account content can still be spoken in the cloned voice and sent to ElevenLabs | Off unless you turn on the cloned voice | United States |
| LiveAvatar (api.liveavatar.com, successor to HeyGen's streaming avatar) | The key and avatar identifier for the avatar, to start a streaming session, and the audio of each spoken reply, made in the cloned voice and sent so the avatar can move its mouth to it. It returns the avatar's video. Your device's IP address, when the avatar window joins the session. Reply text is not sent to it. On the hosted service, replies built from content read from a connected account are held back from the avatar and are not spoken in the cloned voice (the desktop app on a Mac says them in a voice built into the Mac, and otherwise they are shown as text). Omega Ex marks such replies (see the box in Section 1), but only while the mail or calendar content it read is still in the chat history it works from, and earlier replies that repeat that content do not pass the mark on, so once Omega Ex trims a chat's history to fit, which in a spoken conversation can happen within a few turns, or reloads it from storage, which can happen at any point, a later reply built from those earlier replies may not carry the mark that holds it back. On a desktop install running its own backend, replies built from connected-account content are also held back from the avatar, subject to the same trim and reload gap, but the app's own speaker, which speaks replies in Conversation Mode and in Companion Mode (the on-screen helper), never checks the mark, so they can still be spoken in the cloned voice instead (see the ElevenLabs row) | Only where an avatar has been set up for the installation, whenever you hold a spoken conversation there (Conversation Mode then uses the avatar). It is a client-specific beta, not part of the base product | Not yet confirmed |
| Google LLC (browser speech) | Audio captured by the hold-to-speak button on notes, when you use Omega Ex in a web browser | Whenever you hold that button in Google Chrome or Microsoft Edge. Those browsers implement speech recognition by sending the audio to Google. There is no Omega Ex setting for this | United States |
A speech provider Omega Ex no longer uses. Until 1 October 2026, Omega Ex used Deepgram, Inc. for speech. Deepgram received dictation, conversation and meeting audio sent to it for transcription, and the text of spoken replies and recording disclosures that it turned into speech when a cloned voice was not used. From 1 October 2026, Omega Ex sends none of your audio or text to Deepgram. Audio and text sent to Deepgram before that date remain subject to Deepgram's own terms.
Infrastructure
| Provider | What it receives | When | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Your synced workspace: projects and files, chats and messages, meetings with transcripts, notes, tasks, contacts, memories, dictation history, and the log of actions the assistant took, held in a database file on an encrypted volume. Connected mail and calendar results can be included. An account you connect on the hosted workspace, Google or Microsoft, stores its credential there, encrypted. Credentials on your devices are not synced. It also processes the audio a desktop build connected to the hosted workspace sends to be transcribed on our own server | Hosted workspace only. Not used when the app runs locally | United States (us-east-2, Northern Ohio) |
| Amazon Web Services, Inc. (content delivery) | A request for the current version when the app checks for updates, and the download itself. This reveals your IP address, as any download does | On update checks, from updates.omegaex.ai | United States (us-east-2, Northern Ohio), served from content delivery edge locations |
What is deliberately not here
We publish these absences because they are as much a part of the picture as the presences. In the Omega Ex application there is:
- No analytics or product tracking. No Google Analytics, PostHog, Mixpanel, Amplitude, or Segment.
- No advertising or retargeting, and no advertising identifiers.
- No crash reporting service. Diagnostics stay on your device unless you press the button to send them.
- No session replay, heatmaps, or in-app recording.
- No data brokers, and no sale or sharing of personal information.
Training
Omega Ex, Inc. does not use your content to train, fine-tune, or evaluate any AI model. That is true of us without qualification.
Data from a connected Google account is stricter still. Under the Limited Use requirements of the Google API Services User Data Policy, information received from Google APIs through a connected account must not be used to develop, improve, or train any generalised or general-purpose AI or machine learning model, by us or by anyone we send it to. Marked content from a connected Google account follows the provider limits in Section 1, under terms that prohibit training on it. Unmarked history and derived material can reach a provider key you added yourself, under your agreement with that provider; Omega Ex cannot guarantee whether it trains on that material. The Limited Use obligations still apply.
Google's no-training terms on Omega Ex's own key. The Gemini API key Omega Ex runs on is a paid, billed key under a Google Cloud project, which places it under the Google Cloud Data Processing Addendum rather than the free AI Studio terms. Google does not train on prompts or responses sent through it. The running service carries an explicit declaration of that tier, so the software reports the no-training position rather than reporting that it cannot say. A Gemini key you add yourself follows your agreement with Google; these own-account terms do not guarantee how Google uses content sent on your key.
For the other providers above, whether a provider may use content sent to it depends on the account and service tier in use with that provider, and those terms are set by the provider. We are in the process of confirming and documenting the position for each, and we will state it per provider rather than making a blanket claim we cannot yet stand behind for all of them.
Anthropic's standard API retention. Under its published retention policy, API inputs and outputs are deleted within 30 days, subject to agreed terms, services with longer retention, safety enforcement and legal requirements. Content flagged as a Usage Policy violation may be retained for up to two years, and safety classification scores for up to seven years. We do not claim that zero data retention is enabled for Omega Ex's Anthropic organization.
Changes
We update this page when a provider is added, removed, or changed. Material changes are announced by email to account holders at least 30 days before they take effect, so you have time to object or to close your account.
Questions: [email protected], or 385-505-6179