Trust
Subprocessors
In short
- We use a small set of third parties to run EvoViral; each processes personal data only on our instructions, under a written agreement.
- The table lists every provider, what it does, the data categories involved, and the safeguard relied on for transfers.
- The connected social platforms are not our subprocessors; they are independent services you connect under their own terms.
- The Privacy Policy §4 is the controlling description; where the two differ, the Privacy Policy applies.
A plain-language summary for orientation only. It does not change the terms — the full text below governs.
Who we use
EvoViral, operated by R7AD, a sole proprietorship in Markham, Ontario, Canada, uses a small set of third parties to run the service. Each one processes personal data only on our instructions, under a written agreement, and only for the purpose listed below. This list is maintained alongside §4 of our Privacy Policy, which is the controlling description; where the two differ, the Privacy Policy applies.
The subprocessor list
| Vendor | Purpose | Data categories | Safeguard / transfer |
|---|---|---|---|
| Supabase | Database, file storage and authentication for the app and workspaces. | Account details, automation content, conversation metadata, workspace records. | Data Processing Addendum and cross-border transfer mechanism. |
| Stripe | Subscription billing, invoices and payment processing. | Billing details, plan and payment status, receipts. Card numbers go directly to Stripe. | Stripe DPA; PCI-DSS as a payment processor. |
| Zernio | Social-platform API engine: connects accounts, sends replies and DMs, reports status. | Connected-account identifiers and tokens, inbound comments and messages, delivery status. | Data processing terms with our infrastructure partner. |
| Resend | Sending sign-in, confirmation and service emails. | Email address and the contents of the service email. | Data Processing Addendum and transfer mechanism. |
| Netlify | Application hosting and standard server logs. | IP address, request paths, delivery events from hosting. | Data Processing Addendum and transfer mechanism. |
| Google Fonts (build time) | Inter is fetched at build time and self-hosted; no visitor data is sent at runtime. | None from visitors. The font files are requested while the site is built. | No runtime processing of visitor data. |
| Have I Been Pwned (Pwned Passwords) | Checks a new password against known breaches using k-anonymity. | First five characters of the password SHA-1 hash only; the password is never sent. | k-anonymity range query; no personal data transmitted. |
| Google / Apple sign-in (optional) | Only if you choose social sign-in; confirms your email address to us. | Email address and sign-in identity from the provider. | Provider terms apply to that sign-in; processor terms on our side. |
Notes and change control
The connected social platforms themselves (Instagram, Facebook, TikTok, Threads, LinkedIn, YouTube and WhatsApp) are not our subprocessors: they are independent services you connect, and your relationship with each is governed by that platform’s own terms.
We will update this page before adding a new subprocessor that handles personal data, and — for enterprise customers — give notice so it can be reviewed or objected to.
See also our Privacy Policy, our Data Processing Agreement and our Security page.