Privacy & data protection

Sub-processors

These are the companies that process customer data on our behalf — one affiliate and the third parties we engage. The list is complete: if a company is not named here, it does not touch data you entrust to us.

Affiliate

Affiliated operating company (Brazil)

Purpose: platform operations — administration of the servers, the mail transfer agents and customer support — performed for Akamind Inc. under an intra-group arrangement. This company is an affiliate under common ownership with Akamind Inc. and is the contracting entity for oveyon.com.br.

Data reached: everything the platform stores, in the course of operating it.

Location: Brazil.

Infrastructure

OVHcloud

Purpose: hosting. Dedicated bare-metal servers we administer ourselves — the database, the mail servers and the message archive run on them.

Data reached: everything stored by the platform, including message content during its retention period.

Location: Brazil and the United States.

Note: OVHcloud provides the machines and the network. We install and operate the software; there is no managed platform in between.

Cloudflare

Purpose: authoritative DNS for our domains, and HTTP proxy for the panel and public site.

Data reached: connection metadata (IP address, requested URL, user agent) for web traffic. Email content does not pass through Cloudflare.

Location: global edge network.

Google LLC

Purpose: audience measurement on the public website (Google Analytics 4). Not used in the portal, the dashboard or email delivery.

Data reached: pseudonymous website usage data — pages viewed, clicks, device and browser, truncated IP address. No message content, no customer account data.

Location: United States (Google's global infrastructure), under standard contractual clauses.

Email delivery

Most email leaves through our own IP addresses. Two relays are used on specific routes — when a destination refuses our ranges, or as a fallback during an incident. When a message is routed this way, the relay sees it in full.

MailChannels

Purpose: outbound email relay on routes where direct delivery is refused or degraded.

Data reached: the full message (headers, body and attachments) for messages routed through it.

Location: Canada and the United States.

SMTP2GO

Purpose: outbound email relay, used as a secondary route.

Data reached: the full message for messages routed through it.

Location: United States and other regions of their network.

What is not on this list

We do not use analytics, advertising or profiling services. We do not send customer data to a large-language-model provider — no part of the platform submits your messages to an AI service.

When a customer connects Slack, their bot token is stored encrypted by us and used to call the Slack API on their instruction. Slack is the customer's own provider in that relationship, not a sub-processor we engaged.

Changes

We update this page when a sub-processor is added or removed, and the date above changes with it. Customers with a signed data processing agreement are notified in advance, by email, at the address on file.

Questions or objections: privacy@oveyon.com.