Obsedia Email Subprocessors and Platform Providers
Version 1.1 · Last updated: 22 October 2026 · Effective from first publication
Genius Nutrition SRL, trading as OBSEDIA, uses the following core providers for Obsedia Email. The DPA governs subprocessor appointment and responsibility. A provider's processing is limited to the feature used and the information necessary for that service.
1. Core subprocessors
| Provider | Function and information involved | Processing location and terms |
|---|---|---|
| Railway Corporation | Application and worker hosting; PostgreSQL hosting and recovery services; S3-compatible media storage; operational infrastructure. May process the service data stored in those systems, including merchant/customer records, creative assets and technical records. | Application and database deployment currently use a European region. Storage, management, support and the provider's own subprocessors may involve other locations, including the United States. This is not an exclusive EEA-residency commitment. Railway DPA and security information. |
| Amazon Web Services, through the contracting AWS entity applicable to our account | Amazon SES email submission/delivery and sender-domain verification; Amazon SNS delivery, bounce and complaint feedback. Information includes message content, recipient/sender addresses, message references, timestamps, DNS verification data and delivery outcomes. | SES is configured in eu-west-1, Ireland. Email delivery necessarily involves recipient systems in their own locations; AWS administration, support and applicable subprocessors are governed by its terms. AWS GDPR information and DPA and AWS subprocessors. |
| OpenAI, through the contracting OpenAI entity applicable to our account | Requested text/design assistance, image generation/editing and necessary safety processing. Information may include the merchant's brief, relevant conversation and email draft, selected product facts and image references. The service is not designed to provide a full campaign recipient list to the creative assistant. | Processing may take place outside the EEA, including the United States, unless a specific regional arrangement is verified and agreed. No zero-retention or EEA-only processing commitment is made here. OpenAI DPA and API data controls. |
| Sentry, through the contracting entity applicable to our account | Operational alert delivery and worker availability monitoring. The application sends allowlisted issue codes, aggregate counts, timestamps, environment and release identifiers. This integration is configured without automatic tracing, session replay, chat/prompt content, recipient lists, request bodies, authentication headers or raw exception payloads. | Processing and support locations depend on the configured project region and applicable provider arrangements; this notice does not promise exclusively EEA processing. Sentry DPA and security information. |
The legal contracting entity for AWS or OpenAI depends on the applicable customer agreement and account. OBSEDIA must maintain that exact entity in its processing register and provide the applicable contractual information on a reasonable request. References to a provider's group do not remove our responsibility for lawful appointment and transfer safeguards.
Railway-compatible object storage is currently used for application media; the use of an AWS-compatible SDK does not mean those media are hosted in Amazon S3. No downstream provider's certification is represented as an independent certification of OBSEDIA.
2. Shopify and recipients' independent services
Shopify supplies the merchant platform, installation/authentication, authorised commerce APIs, billing and privacy events. Its role depends on its own terms and relationship with the merchant; it is not described here as solely a subprocessor appointed by OBSEDIA. See Shopify privacy information.
The merchant's own apps, websites, DNS provider and chosen third-party services remain under the merchant's separate arrangements. Recipients' mailbox services and operators of merchant-selected links process information through email delivery and interaction. They are not all subprocessors under OBSEDIA's control merely because an email reaches or links to them.
The www.obsedia.ai marketing website can have separate hosting, cookie and analytics arrangements. This list concerns Obsedia Email application processing; website technologies require their own accurate notices and any required consent.
3. Instructions, minimisation and training
Subprocessors may access information only to perform the contracted service or as otherwise lawfully required. We do not appoint them to sell a merchant's customer data, create unrelated advertising audiences or train general-purpose models on that customer data. Provider security/abuse records and temporary processing storage remain subject to the applicable contractual and legal controls.
Do not place confidential or unnecessary personal data in prompts or public email images. A provider list does not authorise a merchant to submit restricted information that the service does not support.
4. Changes and objections
We provide the notice and objection process stated in the DPA before a new or replacement subprocessor begins the relevant processing. Merchants may request change notifications by contacting privacy@obsedia.ai with their store domain and an authorised contact. An update must identify the provider, purpose and relevant locations sufficiently for a data-protection assessment.
Reasonable data-protection objections are considered under the DPA, including appropriate alternatives or ending the affected service if a lawful solution cannot be found. The process is not a unilateral right to require us to operate without an essential provider, and it does not override mandatory data-protection rights.
For the applicable agreement, safeguards or current processing information, contact privacy@obsedia.ai.