Sub-processors
Effective November 9, 2026
Velocinator LLC ("Evolve") uses the third parties below to provide Evolve Cloud. Under our Data Processing Agreement (/legal/dpa), these Sub-processors may process personal data that Evolve handles for its customers. This page forms Annex III of the DPA.
#1. What our Sub-processors can receive
Evolve Cloud never receives visitor-level data from our customers' websites. Visitor identifiers, cookies, events, exposures, page views, and visitors' IP addresses and user agents stay in each customer's own database. No Sub-processor receives them from Evolve.
The personal data Evolve holds, and that Sub-processors may process, is limited to:
- Account data about dashboard users: name, email address, sign-in sessions (IP address and user agent), memberships and roles, invitations, feedback, and audit and change records.
- Request metadata: the IP addresses of customers' servers that call our API, held in short-lived hosting request logs.
The full field-by-field list of what customers' applications send to Evolve is at https://app.evolveab.com/privacy.
#2. Current Sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge configuration storage (Global Config), request logs, and routing of AI model requests (AI Gateway) | All Service data in transit; configuration bundles; request logs, including IP addresses; AI model inputs and outputs in transit | United States |
| Neon (Databricks, Inc.) | Managed Postgres database for Evolve Cloud | All data stored by Evolve Cloud, including account data | United States |
| Upstash, Inc. | Scheduling of background jobs (QStash) | Job-scheduling messages | United States |
| Resend | Transactional email: sign-in links and invitations | Recipient email address and message content | United States |
| GitHub, Inc. | Sign-in with GitHub, only for users who choose it | Public profile information and email address of the user signing in | United States |
| Anthropic, PBC | AI model inference for variant suggestions and brand profiles, accessed through Vercel AI Gateway | Public page text, region schemas, public control copy and aggregate statistics | United States |
| Google LLC | AI model inference for variant suggestions and automated judging, accessed through Vercel AI Gateway | Public page text, region schemas, public control copy and aggregate statistics | United States |
Evolve Cloud is hosted in the United States. Transfers from the EEA, the UK and Switzerland are covered by the Standard Contractual Clauses and the UK and Swiss measures described in Section 12 of the DPA.
AI providers do not receive dashboard users' account details or any visitor data. Evolve does not use customer data to train AI models and does not authorise its AI providers to do so.
#3. Changes to this list
Advance notice. We give at least 30 days' notice before we add or replace a Sub-processor. We do this in two ways:
- We update this page, including its effective date.
- We email the Admins of every customer organisation, and everyone who has subscribed to updates.
Subscribing. To receive notices by email without being an Admin, for example on behalf of your procurement or privacy team, email legal@evolveab.com with the subject "Sub-processor updates" and your organisation's name.
Objecting. You may object to a new Sub-processor on reasonable data protection grounds by emailing legal@evolveab.com within the 30-day notice period. We will work with you in good faith to address the concern. If we cannot, you may terminate the affected services before the change takes effect and receive a refund of prepaid fees for the unused period, as set out in Section 6 of the DPA.
Urgent replacement. If we must replace a Sub-processor urgently for security or continuity reasons, we will notify you as soon as practicable, and the same objection right applies from that notice.
#4. Contact
Questions about our Sub-processors go to legal@evolveab.com.