EvoRadar — Sub-processors
Last Updated: May 2, 20261. About this list
When you use EvoRadar, Kisum GmbH (the controller, see Impressum) engages a small number of third-party service providers to deliver, secure, bill for, and analyze the service. Under Art. 28 GDPR, these are sub-processors — they process personal data only on our documented written instructions.
This page is the canonical list. The Privacy Policy at /datenschutz § 5 contains the same information embedded in the broader privacy disclosure; this page exists so users and their compliance counsel can audit the current sub-processor list at a single stable URL.
We will provide advance written notice of any change to this list (addition, removal, or material change of role) before the change takes effect, by updating this page and emailing registered users where the change materially affects them.
2. Current sub-processors
Each sub-processor below is engaged under appropriate data-protection terms (typically the provider's own Data Processing Agreement). For international transfers outside the EEA we rely on the European Commission's Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914, Module 2 (controller-to-processor) — together with supplementary technical and organisational safeguards as required by Chapter V GDPR.
A separate Transfer Impact Assessment (TIA) per EDPB Recommendations 01/2020 is documented internally for each US transfer (docs/compliance/tia-{provider}.md). Note that none of our US sub-processors are currently self-certified under the EU-U.S. Data Privacy Framework (DPF), so SCCs are the sole transfer tool — not a DPF-as-primary, SCCs-as-fallback configuration.
| # | Sub-processor | Purpose | Region | Transfer mechanism |
| 1 | Supabase Inc. | User authentication (Magic Link, Google OAuth) and database hosting for accounts and activity | USA | SCCs 2021/914 Module 2 (no DPF) |
| 2 | Anthropic PBC | AI-powered idea generation and Dice deep analysis (Claude language model). Inputs are not used for model training under commercial API terms; up to 30-day retention for trust & safety. No personal identifiers (email, name) are included in API payloads — pseudonymization at source. | USA | SCCs 2021/914 Module 2 (no DPF) |
| 3 | LemonSqueezy LLC | Payment processing, subscription management, invoicing. Card details are handled directly by LemonSqueezy and are not stored by us. | USA | SCCs 2021/914 Module 2 (no DPF) |
| 4 | Hetzner Online GmbH | Server hosting and storage | Germany (EU) | N/A — within EEA |
| 5 | Resend Inc. (EU instance) | Transactional email delivery (Magic Link, purchase confirmations, evaluation results, §312k cancellation flow) | EU instance | N/A — EU instance |
| 6 | Google Ireland Limited | Optional OAuth sign-in. When you choose Google sign-in, Google provides us with your email, name, and profile picture. | Ireland (EU) | N/A — within EEA |
| 7 | PostHog Inc. (EU instance) | Anonymous product analytics (pageview / page-leave events only, autocapture disabled, no session recording). EU-hosted at eu.i.posthog.com. Active only after you opt in via the cookie banner. | EU instance | N/A — EU instance |
3. Service providers that are NOT sub-processors
The following providers are involved in operating EvoRadar but do not process personal data on our behalf and are therefore not sub-processors in the GDPR sense:
- GitHub Inc. — source-code hosting; no production user data
- Cloudflare (where applicable) — DNS and edge caching of public assets only
4. Sub-processor changes — notification policy
Per Art. 28(2) GDPR we will:
- Add a new sub-processor only after assessing data-protection adequacy and putting an appropriate transfer mechanism in place
- Update this page to reflect the change before the new sub-processor begins processing data
- Email registered users where the change materially affects how their data is processed (e.g. a new analytics provider, a payment-provider switch)
If you object to a new sub-processor and we cannot reasonably accommodate the objection, you may cancel your subscription via /kuendigung (or close your account by emailing info@evoradar.ai); access continues until the end of the current billing period.
5. Contact
For questions about this list:
Kisum GmbH — info@evoradar.aiLast updated 2026-05-02. Version aligned with Privacy Policy § 5 (effective 2026-04-27).