GDPR Article 28(1) requires us to maintain a list of sub-processors and give Customers the opportunity to object to new ones. This page fulfils that obligation. Last updated: September 2026. Changes posted here at least 14 days before taking effect.
Overview
OptimReach engages the following sub-processors to deliver its platform. All sub-processors are bound by data processing agreements that provide data protection standards no less protective than those in our DPA.
For sub-processor change notifications or objections, contact privacy@optimreach.in.
Core Platform Sub-processors
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Meta Platforms, Inc. | WhatsApp Business Cloud API - message sending, receiving, template management, webhook delivery | USA | SCCs / Meta DPA |
| Cloudflare, Inc. | R2 object storage (media files, documents), CDN, DDoS protection | USA (data stored in chosen region) | SCCs |
| Self-hosted PostgreSQL 14 on BigRock VPS | PostgreSQL database hosting - all platform data | Mumbai, India | SCCs or adequacy decision |
| OpenAI, Inc. | AI text generation and customer profile summaries (only when AI feature is enabled by Customer) | USA | SCCs / OpenAI DPA |
| Google LLC (Gemini) | AI text generation - alternative AI provider (only when configured by Customer) | USA | SCCs / Google DPA |
| No third-party provider | Transactional email - verification, password reset, staff invitations, notifications | Not applicable | Not applicable |
| Paddle | Payment processing for OptimReach subscriptions | Mumbai, India | SCCs |
How to Object to a New Sub-processor
You have the right to object to a new sub-processor within 14 days of being notified. To object, email privacy@optimreach.in with the subject line "Sub-processor Objection". If your objection cannot be accommodated, you may terminate your subscription per the Terms of Service.
What "Sub-processor" Does NOT Include
- Infrastructure tools that do not access Customer Personal Data (e.g., monitoring tools that only see aggregate metrics)
- Your own third-party integrations configured within OptimReach (e.g., your CRM, your Zapier account) - you are the Controller for those connections and responsible for their compliance