Subprocessors
Every vendor that processes personal data for Oat, what it does, what it receives and where. Services you connect yourself are listed separately.
Last updated 30 September 2026
In short
- Oat's database, files and functions run in Singapore.
- Sign-in, email, analytics and the AI model providers run mainly in the United States.
- Model providers receive only what each task needs, never credentials.
- We tell workspace Owners before adding a new vendor.
Oat is a product of Airmeet Inc. AI Labs. It is provided by Airmeet Inc., a Delaware corporation.
1. Hosting, data and sign-in
| Vendor | What it does for Oat | What it receives | Where |
|---|---|---|---|
| Vercel | Hosts the website and app, runs every request and background job (Vercel Workflows), keeps request logs | Requests and responses, job inputs and results, technical logs | Singapore (functions); United States (the Workflows queue) |
| Vercel Sandbox | Isolated computers that load and render web pages when Oat clones a site or renders images | The pages being rebuilt, screenshots, generated files | Singapore for site cloning; United States, with Singapore and Mumbai as fallback, for other jobs |
| Neon | Postgres database and the private file storage bucket | All workspace records and files, accounts, messages, requests | Singapore |
| Clerk | Sign-in, sessions and user records | User ID, name, email address if added, sign-in method, session data, IP address and browser | United States |
| Railway (being retired) | The old background worker, finishing jobs it already held | The job in hand and the connection it needs | Vendor-hosted; removed once retired |
2. AI models
| Vendor | What it does for Oat | What it receives | Where |
|---|---|---|---|
| Vercel AI Gateway | Routes every model call to the configured provider | The prompt and the answer for the call in hand. Never credentials | Vercel's network |
| Anthropic | Claude models: writing drafts, site building and checks | Brief, relevant archive extracts, voice rules, research, draft, pages being rebuilt | United States |
| OpenAI | GPT models: Studio and WhatsApp conversations, realtime voice, transcription of voice notes and speech, images | Messages, transcripts and audio, the context the turn needs | United States |
| Gemini models: filling forms from speech | The transcript and the form's fields | United States | |
| TypeSafe AI | Checks drafts against your brief, voice rules and evidence | The draft and what it is checked against (zero data retention requested) | Vendor-hosted |
The model for each task is configurable, and the Desk shows the model that prepared each draft. How providers retain data is set out in the privacy notice.
3. Research and the public web
| Vendor | What it does for Oat | What it receives | Where |
|---|---|---|---|
| Exa | Web and news search; finds your public LinkedIn posts | Search queries built from your topics and asks, your name and public profile address | Vendor-hosted |
| Parallel | Web search and cited research summaries | Research questions | Vendor-hosted |
| Firecrawl | Reads pages that need a browser to render | The web address to read | Vendor-hosted |
| Tavily | Web research for drafts | Search queries derived from the topic | Vendor-hosted |
| Context.dev | Public brand details for a domain: logos, colours, style guide | A domain or organisation name | Vendor-hosted |
4. Messaging, email and social
| Vendor | What it does for Oat | What it receives | Where |
|---|---|---|---|
| Zernio | Connects social accounts for reading and publishing, and carries Oat's WhatsApp Business messages | Account names and IDs, tokens, posts and metrics, approved posts, WhatsApp messages, voice notes and phone numbers | Vendor-hosted |
| Meta (WhatsApp) | Delivers WhatsApp messages, through Zernio | Messages between you and Oat, your phone number | Meta's global infrastructure |
| Resend | Sends notification emails, access and contact request alerts, and creators' newsletters; reports delivery, opens, clicks, bounces and complaints | Recipient addresses and the emails sent | United States |
5. Product analytics
| Vendor | What it does for Oat | What it receives | Where |
|---|---|---|---|
| PostHog (US cloud) | Product analytics, session recordings, error tracking, server logs and AI call analytics for Oat's own pages and servers, through withoat.com/ox. Never on the sites Oat hosts for you | Pages visited and clicks, recordings of Oat's screens with typed text masked (passwords, one-time codes and connection credentials are never recorded), errors, server logs with secrets, emails and phone numbers removed, AI prompts and answers with secrets removed and long text cut, and, once you are signed in, your user ID, name and email | United States |
6. Only when you connect them
These receive data only after a member of your workspace connects them, and only what that connection needs. They act under their own terms, not as our subprocessors. Disconnecting stops the flow.
| Service | Connection | What it receives |
|---|---|---|
| Instagram, Facebook, Threads, LinkedIn, X, TikTok, YouTube, Bluesky and other networks | Through Zernio | Your sign-in for the grant; the posts and media you approve |
| Google Analytics, Search Console and YouTube (read-only) | Your sign-in for the grant; Oat reads reports and your videos | |
| Wispr Flow | Meetings and dictations (read-only) | Your sign-in for the grant; Oat reads what you choose to import |
| WordPress, GitHub or a deploy hook | Publishing to your own site | The approved piece, or a build trigger |
7. Airmeet group
Airmeet Inc. provides Oat. Its Indian group company, Airmeet Networks Private Limited (WeWork Salarpuria Magnificia, Tin Factory, 78, Old Madras Road, Doorvani Nagar, Bengaluru 560016, Karnataka, India), may access personal data where needed to build, run and support Oat, under the privacy notice.
8. Changes
When a vendor is added or removed, this page and its date change. Workspace Owners are told by email before a new vendor from the first five tables receives their data. Questions or objections: dpo@airmeet.com.