Sub-Processor List - Otonomi DX

Last Updated: April 27, 2026

This page lists the third-party service providers ("Sub-Processors") engaged by Solutions Otonomi Inc. to help deliver the Otonomi DX platform. We maintain this list in accordance with our Privacy Policy and our Installer Terms of Service.

We update this list whenever we add, remove, or replace a Sub-Processor. We notify our paying business customers (Installers) at least 30 days in advance of any addition or change that materially affects how we process personal information.

To subscribe to changes or request more information, contact privacy@solutions-otonomi.com.

Hosting and Backend Infrastructure

Backend infrastructure provider

Role: Hosts the backend application and primary database where End User Data, Installer accounts, project records, proposals, and uploaded documents are stored. Location of data: Montréal, Québec, Canada. Provider entity: Xano, Inc. (United States). Privacy notice: https://www.xano.com/privacy-policy

Google Cloud Platform

Role: Underlying cloud infrastructure used by our backend infrastructure provider. We do not contract directly with Google; our backend provider contracts with Google as its hosting provider. Disclosed for transparency. Location of data: Montréal, Québec, Canada region. Provider entity: Google LLC (United States). Privacy notice: https://cloud.google.com/terms/cloud-privacy-notice

Frontend and Content Delivery

Frontend application provider

Role: Hosts and serves the frontend application that users interact with in their browser. Location of data: Virginia, United States. Provider entity: WeWeb SAS (France). Privacy notice: https://www.weweb.io/privacy-policy Data Processing Agreement: https://www.weweb.io/data-processing-agreement

Amazon Web Services (CloudFront)

Role: Content Delivery Network ("CDN") that caches and delivers frontend assets (HTML, JavaScript, stylesheets, fonts, icons) close to your users for faster loading. Location of data: Primary edge location for our Canadian users is Toronto. CloudFront uses a global edge network — content may be cached at any of AWS's edge locations worldwide. Provider entity: Amazon Web Services, Inc. (United States). Privacy notice: https://aws.amazon.com/privacy/ Data Processing Addendum: https://aws.amazon.com/service-terms/ (Section 9 GDPR DPA)

Email Communications

Twilio SendGrid

Role: Sends transactional emails — form confirmations, password resets, proposal notifications, system-generated messages, and similar service emails. Data accessed: Email addresses, names, and the content of transactional emails. Location of data: United States. Provider entity: Twilio Inc. (United States). Privacy notice: https://www.twilio.com/legal/privacy

Brevo

Role: Sends marketing communications — newsletters, product updates, and other marketing emails to people who have opted in. Data accessed: Email addresses, names, opt-in status, and engagement metadata (opens, clicks). Location of data: European Union (France, Germany, Belgium). Provider entity: Sendinblue SAS (France). Privacy notice: https://www.brevo.com/legal/privacypolicy/ Data Processing Agreement: https://www.brevo.com/legal/dpa/

Payment Processing

Stripe

Role: Processes recurring subscription payments for paying business customers (Installers). Stripe never processes End User payments — End Users do not pay Solutions Otonomi. Data accessed: Installer billing name, billing address, payment card data (tokenized; we do not store full card numbers). Location of data: United States. Provider entity: Stripe, Inc. (United States). Privacy notice: https://stripe.com/privacy Data Processing Agreement: https://stripe.com/legal/dpa

Analytics

Google Analytics

Role: Provides aggregated usage analytics about how visitors use our website and platform — page views, session duration, traffic sources, and similar metrics. Data accessed: IP address, device information, browser configuration, page navigation, approximate geographic location. Location of data: United States (with regional caching). Provider entity: Google LLC (United States). Privacy notice: https://policies.google.com/privacy

Cross-Border Transfer Disclosure

Some of the Sub-Processors above are located outside Québec and Canada. In particular:

• Frontend infrastructure (frontend application provider's origin servers and AWS CloudFront origin) operates partially from the United States;
• Transactional email (Twilio SendGrid) and payment processing (Stripe) operate from the United States;
• Analytics (Google Analytics) operates from the United States;
• Marketing email (Brevo) operates from the European Union.

For each cross-border transfer, we have:

• assessed the privacy implications under Section 17 of the Act respecting the protection of personal information in the private sector (Québec);
• entered into a Data Processing Agreement (or equivalent contractual safeguards such as Standard Contractual Clauses) with each Sub-Processor;
• verified that each Sub-Processor implements appropriate technical and organizational security measures, including encryption in transit and at rest.

Personal information stored at rest — including all End User project data, Installer account data, project records, and proposals — remains in Montréal, Québec, Canada through our backend infrastructure provider (running on Google Cloud Platform northamerica-northeast1).

Changes and Notifications

We notify Installers of changes to this list at least 30 days before a new Sub-Processor begins processing personal information, or as soon as practical for emergency replacements. Installers may object to a new Sub-Processor on data protection grounds; please see Section 9.5 of our Installer Terms of Service for the procedure.

End Users are informed of cross-border transfers and Sub-Processor categories through our Privacy Policy.

Questions

For questions about any Sub-Processor or our data protection practices:

Théo Germain, Privacy Officer Solutions Otonomi Inc. 218 avenue Redfern, app. 17 Westmount (Québec) H3Z 2G3 Canada

Email: privacy@solutions-otonomi.com

This Sub-Processor list was last updated on April 27, 2026.

‍