Sub-processors

The companies that handle personal data for us so Evelyst can run, what each one receives, and where.

Last updated 10 October 2026

Read only the left column for the gist. The full text on the right is the part that counts.

1 · What this page is

This is the list of outside companies that handle personal data for us, and by accepting our DPA you allow us to use them.

1.1 This page lists the third parties ("Sub-processors") that process personal data on behalf of Evelyst Software Publishing, a sole proprietorship registered with the Department of Trade and Industry (Business Name No. 8503538) ("Evelyst", "we", "us"), to provide the Service.

1.2 Where Evelyst processes Customer Personal Data as the Customer's processor, the Data Processing Addendum (/dpa) gives Evelyst the Customer's general authorisation to engage the Sub-processors on this list. This page is the sub-processor list referred to in the DPA.

1.3 Before a Sub-processor processes Customer Personal Data, Evelyst puts in place written terms with it that impose the same data protection obligations as the DPA sets out, as they apply to the service that Sub-processor provides. The terms for each Sub-processor are linked in the table in section 2.

1.4 The same Sub-processors also process personal data that Evelyst handles for its own purposes, such as account owner details and messages sent to us or through the website. The Privacy Policy (/privacy) explains that processing.

1.5 Each section starts with a plain sentence to help you read it. Where a plain sentence and the full text differ, the full text applies.

1.6 "Service" has the meaning given in our Terms of Service (/terms section 2.2). "Customer Data" means the data the Customer puts into the Service, and "Customer Personal Data" means the personal data within it, as the DPA (/dpa) defines them.

2 · The list

Six companies handle personal data for us; the table shows what each one receives and where, and some of them are outside Singapore.

2.1 Evelyst currently uses the following Sub-processors.

Name	Purpose	Data	Location	Their terms or DPA
Supabase	Database, authentication, file storage and Edge Functions for the Analyst and Evelyst POS	All account, Analyst and POS data: account and staff profiles, sign-in records, sales, expenses, imports, notes, chat history, orders and menus	Singapore (database and storage); Edge Functions in the Supabase region nearest to the visitor	Supabase DPA
Railway	Runs the Analyst's app server (app.evelyst.com) and its hourly job, which prepares the Monday review and watch alerts	Analyst data while a request is handled, including uploaded files and photos held in memory for that request only; server logs	Singapore	Railway DPA
OpenAI	AI language and vision models used by the Analyst to answer questions, write summaries and read imports, receipts and notebook pages	Questions and chat history, notes, typed text, pasted text other than tables, uploaded photos, and figures computed from your data. In text, names of staff we know about are replaced with their role; this doesn't apply to photos and can miss a name typed in an unusual way	United States	OpenAI DPA
Resend	Transactional and product email: the Monday review, watch alerts, contact-form notifications to Evelyst, the monthly waitlist email, and replies sent from our addresses	Recipient email address and email content	United States	Resend DPA
Cloudflare	DNS; hosting of evelyst.com and pos.evelyst.com; Web Analytics (no cookies); Turnstile on website forms; routing of email sent to our addresses	IP address and request metadata; form-challenge signals; the content of email sent to our addresses	Global network	Cloudflare DPA
Google	Email inbox (Gmail) for messages sent to our addresses and for our notifications of contact-form messages	The content and attachments of emails you send us, which can include Customer Data	United States	No data processing terms: the mailbox is provided under Google's own Terms of Service and Privacy Policy

2.2 Evelyst's database, which holds Customer Data, is in Singapore. Some Sub-processors process Customer Data, and may keep copies for a limited time, in other countries, as the table shows. The DPA (/dpa) sets out how these transfers are handled.

2.3 Cloudflare provides only DNS for app.evelyst.com. Traffic to the Analyst app goes to Railway directly and isn't routed through Cloudflare's network.

2.4 Under OpenAI's Services Agreement, OpenAI does not use content sent through its API to develop or improve its models unless the customer agrees. That commitment is OpenAI's, under its terms, not a setting Evelyst controls.

3 · Not a sub-processor, listed for clarity

Paddle sells you the subscription and takes the payment as its own business, so it isn't on the list, and when you pay, we never see your full card number.

3.1 Paddle is the Merchant of Record for Evelyst subscriptions. It handles payment, invoices and tax, and issues refunds.

3.2 Paddle is an independent controller of the payment and billing data it collects, not a Sub-processor of Evelyst. Its handling of that data is governed by Paddle's privacy notice.

3.3 Evelyst doesn't receive or store your payment card number. Paddle shares with Evelyst your plan, subscription status and transaction references, so that Evelyst can provide your account.

4 · Changes to this list

Before a new sub-processor starts handling Customer Data, we email account owners at least 30 days ahead, and you can object under the DPA.

4.1 Before Evelyst engages a new Sub-processor to process Customer Personal Data, Evelyst will update this page and email each account owner at the address on the account at least 30 days before the new Sub-processor starts processing.

4.2 The Customer may object to a new Sub-processor on reasonable data-protection grounds within that notice period. The DPA (/dpa) sets out how an objection is made and what happens next.

4.3 Evelyst may remove a Sub-processor, or correct details on this page that don't change what data a Sub-processor receives or where it processes it, by updating this page without advance notice.

4.4 Notices go to account owners. Anyone else can check this page at any time; the date below shows when it last changed.

5 · Last updated

This list last changed on the date below.

5.1 Last updated: 10 October 2026.