01About this list
To deliver, secure, and support its Products, EvlarSoft LLC relies on a small, carefully chosen set of third-party providers (“subprocessors”) that may process personal data on our behalf. This page identifies the categories of subprocessors we use and what each one handles. It applies across all of our Products — the Verve family, DigestYourFinances, and our applications.
We keep this list deliberately short. We conduct diligence appropriate to the risk before engaging a subprocessor, and we bind each one by written contract to data-protection obligations no less protective than those in our Data Processing Addendum. We remain responsible to our customers for the performance of our subprocessors.
02Current subprocessors
The following categories of subprocessors are currently engaged. Specific providers within each category may change as we improve reliability, security, and performance.
| Provider role | Purpose | Data handled | Region |
|---|---|---|---|
| Cloud hosting & compute | Runs the backend, APIs, databases, and application infrastructure | Account data, request content, usage logs | United States |
| Edge network & CDN | Delivers and caches static content, routes and gates traffic, mitigates attacks | IP addresses, request metadata | Global edge |
| Cloudflare (EvlarSoft Link, EvlarSoft One) | For every app that offers EvlarSoft Link: Workers run the handshake server that introduces a phone to a PC, D1 keeps anonymous daily usage totals, R2 serves the phone pages, and Turnstile runs the bot check on them. Workers and Pages also host the EvlarSoft One API (api.evlarsoft.com) and account pages (my.evlarsoft.com), relaying account and backup requests, with Turnstile running the bot check on email sign-up and R2 storing profile photos. Workers answer the apps' data requests and receive their usage counts, error reports and feedback (telemetry.evlarsoft.com, stored in D1), and Pages serves in-app banners (cdn.evlarsoft.com) | Link: devices' network addresses in connection-setup messages, request metadata, daily counts per app with nothing identifying; never content. One: account and backup data passes through and is not stored, except short-lived one-time sign-in codes and uploaded photos. Apps: IP addresses and installation keys for short-lived rate-limit counters, request parameters, aggregate usage counts, error reports, feedback text and an optional reply email | Global edge |
| Google Firebase (EvlarSoft One) | Firebase Authentication handles sign-in, and Realtime Database stores EvlarSoft One accounts | Account profile, apps and services signed in to, PC sessions and recent sign-in activity with approximate location, settings backups, music studio profiles, published and saved crosshairs | United States |
| Microsoft (Microsoft Store) | Sells our Windows apps, add-ons and subscriptions, handles payment and refunds, and tells our servers which products an installation owns | Store ownership status and an anonymous Microsoft Store account ID; we never receive payment details | United States |
| Google (EvlarSoft Link) | A public STUN server that tells a device its own internet address, so a phone and a PC can connect directly | The device's IP address; never content | Global |
| Payment processor | Processes subscription and usage-based billing | Billing contact, limited payment details | United States |
| Twilio SendGrid (email) | Sends account, verification, security and service messages, and news emails to those who opt in | Name, email address | United States |
| Product analytics & error monitoring | Measures usage and captures diagnostics to improve reliability and performance | Usage events, device/browser data, error traces | United States |
| Google Analytics (evlarsoft.com) | Counts visits and page views on evlarsoft.com. Loads only with analytics consent, or by default outside the EEA, UK, and Switzerland until you opt out | Pages viewed, referrer, device/browser data, approximate location from IP address, a pseudonymous cookie ID | United States |
| Microsoft Clarity (evlarsoft.com) | Records how pages on evlarsoft.com are used (clicks, scrolling, heatmaps and session replays) so we can fix confusing pages. Same consent rules as Google Analytics; form inputs are masked | Interactions with the page, device/browser data, approximate location from IP address, a pseudonymous cookie ID | United States |
| Customer support tooling | Manages and responds to support and contact requests | Name, email, contents of your request | United States |
03Safeguards and international transfers
Each subprocessor is engaged under a written agreement that requires it to implement appropriate technical and organizational security measures, to process personal data only for the purpose of providing its service to us, and to protect personal data consistent with Applicable Data Protection Law. Where a subprocessor processes personal data in a country that requires a transfer safeguard, we rely on an appropriate mechanism such as the Standard Contractual Clauses or an equivalent protection, as described in our Privacy Policy and Data Processing Addendum.
04Changes and notice
We update this page when we add, remove, or replace a subprocessor. Customers with a signed DPA who have subscribed to notifications will receive advance notice of material changes and may object on reasonable, data-protection-related grounds in accordance with the DPA. To subscribe to subprocessor notifications or to raise an objection, please contact EvlarSoft. The effective date above reflects the current version of this list.
Questions about this document, or about which EvlarSoft entity you're dealing with?
Contact EvlarSoft →