Dieses Dokument ist in englischer Sprache maßgeblich.
Current subprocessors
| Provider | Purpose | Data categories | Location | Retention |
|---|---|---|---|---|
| VercelOutside Australia | Application hosting, edge delivery and serverless compute for the web platform, plus Vercel Web Analytics and Speed Insights (cookieless traffic and Core Web Vitals measurement). | Account identifiers, request metadata, content in transit. Analytics collects page paths and performance timings only — and is not loaded on the simulation runner, public runs, embeds, certificates or certificate verification, where the path itself can carry an access token or verification code. | Serverless compute pinned to Sydney (syd1); global edge network for delivery. | Platform and analytics aggregates retained per Vercel's product defaults; no simulation content is stored by Vercel. |
| Supabase | Managed Postgres database, authentication and row-level-security enforcement. | Account and profile data, organisation/team data, simulation content, transcripts, scores and usage records. | Australia — Sydney (ap-southeast-2). | Held for the life of the customer account, subject to the retention policy; backups are retained per the project's backup configuration. |
| Microsoft Azure | Azure OpenAI for AI persona responses and feedback; Azure Speech for speech-to-text and text-to-speech; Azure Document Intelligence for knowledge-document extraction. | Conversation prompts and responses, transient audio and transcript text for processing, and uploaded knowledge documents. | Australia East, Standard Regional deployment. | Up to 30 days: Azure OpenAI retains prompts and completions for abuse monitoring, subject to possible review by authorised Microsoft personnel. Evolve does not have Modified Abuse Monitoring, which is the only way to disable this. Data is not used to train Microsoft or OpenAI models. |
| ElevenLabsOutside Australia | Text-to-speech for premium character voices, where a simulation is configured to use one. The default Azure voices do not use this provider. | The character's spoken dialogue text, and the synthesised audio returned. Learner speech is NOT sent to ElevenLabs — speech-to-text is Azure. | Outside Australia — no Australian region is offered. | Per ElevenLabs' retention terms for synthesis requests. |
| StripeOutside Australia | Subscription billing, payment processing and the hosted customer billing portal. | Billing contact details, subscription and invoice data. Card data is handled directly by Stripe. | United States / global. | Retained by Stripe as the payment processor of record, per its own terms. |
| ResendOutside Australia | Transactional email delivery, including team invitations and account notifications. | Recipient email addresses and invitation/notification content. | United States. | Delivery logs retained per Resend's product defaults. |
| SentryOutside Australia | Application error monitoring and diagnostics, with a privacy scrubber applied before data is sent. | Error events, stack traces and scrubbed diagnostic metadata, plus an opaque account identifier for grouping. Configured to exclude message content, transcripts and credentials. | European Union (Germany). | Error events retained per the configured Sentry plan retention. |
| PostHogOutside Australia | Product analytics for the public website and the signed-in application: aggregate usage, conversion and feature-adoption measurement. Loaded only where the visitor has consented to analytics. | Page paths, event names, coarse device and referrer metadata, and an opaque account identifier. Automatic interaction capture is disabled, so no page content, transcript or scorecard data is collected as event data. Session replay and heatmaps are limited to the PUBLIC MARKETING WEBSITE and are never active on the signed-in application, the simulation runner or embedded simulations; form inputs are masked in all recordings. | European Union (PostHog EU Cloud). | Event and replay data retained per the configured PostHog plan retention. |
| Google (Analytics / Tag Manager)Outside Australia | Website traffic measurement and campaign attribution for the PUBLIC MARKETING WEBSITE only, via a Google Tag Manager container forwarding to Google Analytics 4. Loaded only where the visitor has consented to analytics. | Page paths, referrer and campaign parameters, and coarse device and approximate location metadata from public marketing pages. | United States / global. | Retained per the Google Analytics property's configured data-retention setting. |
Changes to this list
We may add or replace subprocessors as the platform evolves. Where required by a customer agreement, we will provide a way to be notified of material changes. To request notification or ask about a specific provider, contact privacy@evolvesimulations.com.
Dieses Dokument ist ein produktreifer Entwurf, der der Transparenz dient. Es ist keine Rechtsberatung und sollte vor Verwendung von qualifiziertem Rechtsbeistand geprüft werden. Wenn etwas unklar ist, kontaktieren Sie uns.