Legal
Subprocessors
Effective Date: October 16, 2026 · Last Updated: October 26, 2026
These are the service providers that process personal data on EVA's behalf. When you send a message, it goes to the provider of the AI model you chose.
AI model providers
Only the provider of the model you pick receives your message. Models from DeepSeek, Meta, Qwen, GLM, Moonshot and MiniMax are reached through OpenRouter and may be processed outside the United States.
| Provider | Purpose | Data processed | Location | Transfer mechanism (EU/UK) |
|---|---|---|---|---|
| OpenAI | Answers for OpenAI models (GPT), including web search and image generation | Prompts, image prompts, attached files, chat history sent as context | United States | Standard Contractual Clauses (provider DPA) |
| Anthropic | Answers for Anthropic models (Claude), including web search | Prompts, attached files, chat history sent as context | United States | Standard Contractual Clauses (provider DPA) |
| Google (Gemini API) | Answers for Google models (Gemini), including web search and image generation | Prompts, image prompts, attached files, chat history sent as context | United States | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| xAI | Answers for xAI models (Grok), including web search and image generation | Prompts, image prompts, attached files, chat history sent as context | United States | Standard Contractual Clauses (provider DPA) |
| Mistral AI | Answers for Mistral models | Prompts, attached files, chat history sent as context | European Union (France) | Not required for EU users; Standard Contractual Clauses for onward transfers |
| Perplexity | Answers for Perplexity models (Sonar), including web search | Prompts, chat history sent as context | United States | Standard Contractual Clauses (provider DPA) |
| OpenRouter | Routes requests to DeepSeek, Meta (Llama), Qwen, GLM (Z.ai), Moonshot (Kimi) and MiniMax models, which are served by OpenRouter's upstream providers, including web search | Prompts, attached files, chat history sent as context | United States; upstream providers may process data in other countries, including China for some models | Standard Contractual Clauses (provider DPA) |
Infrastructure and operations
| Provider | Purpose | Data processed | Location | Transfer mechanism (EU/UK) |
|---|---|---|---|---|
| Google Cloud | Application hosting (Cloud Run) and file storage (Cloud Storage) | All service data, uploaded files, generated images | United States (us-central1) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Firebase (Google) | Sign-in and web hosting | Email address, sign-in identifiers | United States | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Supabase | Database hosting | Account, chat history, billing and usage records | United States (us-east-1) | Standard Contractual Clauses (provider DPA) |
| Stripe | Payments and subscriptions | Name, email, billing address, payment details | United States | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Amazon SES (AWS) | Transactional email | Email address, email content | United States (us-east-1) | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Sender.net | Newsletter for account holders (unsubscribe anytime) | Email address | European Union (Lithuania) | Not required for EU users |
| Cloudflare | Bot protection (Turnstile) | IP address, browser and device signals | Global network | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| PostHog | Product analytics and session recordings | Usage events, account ID; recordings only with consent, chat content excluded | United States | Standard Contractual Clauses (provider DPA) |
| Google Analytics | Traffic and conversion measurement, only with consent | Usage and conversion events, device identifiers | United States | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Sentry | Error monitoring | Error reports with message content and emails removed | United States | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |