Sub-processors of the processing for the Evolus platform
Version 1.1, published on 1 October 2026, effective from 21 October 2026.
SHA-256 fingerprint: 983b6b2e6d4dfea5720275ffbd6933fa6d478c8a78759ec4857b47db587bb01f
Download the canonical text (.md)This is a courtesy translation. In case of discrepancy, the Italian version prevails (Article 14.6 of the Conditions).
Owner of the document: CodeDesign S.r.l., Via Nino Pesce 38, 18018 Taggia (IM), VAT No. IT01739830089
Privacy contact: privacy@codedesign.it
Version history: https://evolus.ai/en/subprocessors
This page is referred to by Annex A, Data Processing Agreement, published at https://evolus.ai/en/data-processing-agreement, and by the General Conditions of Use, published at https://evolus.ai/en/terms-of-use. It constitutes the list of authorised sub-processors pursuant to Article 28, paragraphs 2 and 4, of Regulation (EU) 2016/679.
1. What a sub-processor is, and why this page exists
When the Customer uses Evolus, CodeDesign processes personal data on behalf of the Customer: the Customer is the controller, CodeDesign is the processor. In order to provide the service CodeDesign in turn relies on suppliers, which the Regulation calls sub-processors: they are entities that process those same data on CodeDesign's instructions, for a specific function (hosting the servers, generating the replies of the language models, transcribing a recording, delivering a notification).
Every sub-processor listed on this page is bound to CodeDesign by a contract that imposes on it data protection obligations equivalent to those that CodeDesign has assumed towards the Customer. CodeDesign is answerable to the Customer for the acts of its sub-processors.
This page does not list the services that the Customer connects to the platform with its own credentials: those are recipients chosen by the Customer, not sub-processors of CodeDesign. For clarity they are nonetheless set out in section 3, with an explanation of the difference.
How changes are notified
- 1. CodeDesign sends an email to the Customer's administrators registered on the platform, to the administrative contact address indicated in the organisation's profile.
- 2. The communication indicates the sub-processor added or replaced, the function performed, the place of processing, the legal basis of any transfer and the effective date.
- 3. At least 30 days elapse between the sending of the communication and the effective date.
- 4. During the same period a notice appears in the portal, for all users with the administrator role.
- 5. The new version of the page is published at the same time as the communication, with a new version code and a new hash. Previous versions remain available in the history.
How to object
Within 30 days of the communication the Customer may object, on reasoned grounds, by writing to privacy@codedesign.it and stating the reasons connected with the protection of personal data.
Once the objection is received, CodeDesign, within 15 days, assesses the reasons and proposes to the Customer one of the following solutions: keeping the previous provider for that Customer, where technically possible; deactivating for that Customer the feature that requires the new sub-processor; adopting supplementary measures that overcome the objection. If no solution is practicable, the Customer has the right to withdraw from the service concerned, without penalties, with effect from the effective date of the change and with a pro-rata refund of the fees already paid for the unused period.
Failure to object within the 30 days counts as acceptance of the change.
Urgent replacements
If a sub-processor ceases its activity, suffers a serious security incident or breaches the contract in such a way as to make its immediate replacement necessary, CodeDesign may replace it without the 30 days' notice, notifying the Customer within 5 working days of the replacement, together with the reasons. The right to object remains exercisable in the 30 days following the communication.
2. Key to the columns
| Column | Meaning |
|---|---|
| Provider | Name of the contracting entity and country of establishment. |
| Service performed | The function, and only that function, for which the provider processes the data. |
| Data processed | The categories of personal data that may reach the provider. |
| Place of processing | Region of the processing infrastructure, where it can be determined and is binding. |
| Basis of the transfer | Only for providers outside the European Economic Area. The rule is: EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. |
| When it is active | Whether the provider is always involved, or only following the activation of a feature by the Customer. |
| Downstream providers | Only for providers that in turn route the processing to other entities. |
3. Section 1. Structural sub-processors
They are always involved, by the mere fact that the service is provided. The Customer cannot deactivate them without giving up the service.
| Provider (name and country) | Service performed | Data processed | Place of processing | Basis of the transfer | When it is active | Downstream providers |
|---|---|---|---|---|---|---|
| Microsoft Ireland Operations Limited, Ireland, an entity of the Microsoft Corporation group, United States | Cloud infrastructure: application servers, database, file storage, key vault, image registry, application monitoring; user identity; optical character recognition of documents; translation of the summaries of telephone calls; sending of the platform emails and management of the support mailbox | All the platform data: registry data, encrypted credentials, conversations, documents, attachments, audio recordings, application logs, recipients and content of the email notifications | European Union. Azure West Europe (Netherlands) for the backend, database, storage and identity. Azure France Central for the translation of the summaries of telephone calls. Optical character recognition of documents in a European Union region. Assistance and support may take place outside the Union according to the provider's terms | European Union: not applicable. For the support components outside the Union: EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. DPF certification: being verified as at the date of publication | Always | None |
| Hetzner Online GmbH, Germany | Application server of the digital employees and of the connected services (orchestrator, local databases, meetings stack, connectors gateway); object storage for the backups | Conversations, memory of the digital employees, transcripts, meeting recordings, messages, contacts, email drafts, audit logs; encrypted backups of the entire set | European Union. Processing in Nuremberg (Germany). Backups in Helsinki (Finland) | Not applicable: processing entirely within the European Economic Area | Always | None |
| OpenRouter, Inc., United States | Routing of all the calls to the language models of the platform, of the digital employees and of the mobile app towards the downstream model providers | System prompts, the complete history of the conversation, the memory dossier of the digital employee, attachments and images sent in chat, the results of the tools, the outcome of the safety guards. Correlatable metadata: identifier of the digital employee, session identifier, source address | European endpoint, available to Customers on the Enterprise Plan; for the other plans the global endpoint applies, with processing in the United States. Routing solely to zero-retention endpoints is likewise reserved to the Enterprise Plan. See section 7 | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. DPF certification: being verified as at the date of publication. Data processing agreement already in force on the CodeDesign account | Always | Yes. See table 1.bis |
| ElevenLabs, United States | Voice synthesis, voice agents of the switchboard, diarisation and transcription of meetings | Full audio of the telephone calls and of the meetings, transcripts, caller's number, text to be spoken | European region, available to Customers on the Enterprise Plan; for the other plans the global region applies (United States). For the shared platform voice subscriptions the region is in any event global | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. DPF certification: being verified as at the date of publication | Always, for the voice and meeting features | For the voice agents of the switchboard the provider uses a Google language model selected and managed by it |
| Deepgram, Inc., United States | Default voice transcription, pre-recorded and real time; voice synthesis on the WhatsApp channel | Audio of the voice messages, of the voice notes of end customers and of the dictation in the portal; the resulting transcripts; text to be spoken | United States. The provider is reached on the global endpoint, no region selection is available in the service | Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. DPF certification: being verified as at the date of publication | Always, unless the Customer chooses an alternative transcription provider (section 2) | None |
| 650 Industries, Inc. (Expo service), United States | Delivery of the push notifications to the Evolus mobile apps | Device token, title, body and payload of the notification | United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. DPF certification: being verified as at the date of publication | Always, for users who install the mobile app | Apple and Google, as the final transport |
| Apple Inc., United States; for the European Economic Area Apple Distribution International Ltd, Ireland | Transport of the push notifications to iOS devices | Device token, title and body of the notification | United States and European Union, according to the provider's infrastructure | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. DPF certification: being verified as at the date of publication | Always, for iOS users | None |
| Google LLC, United States; for the European Economic Area Google Ireland Limited, Ireland | Transport of the push notifications to Android devices | Token and identifiers of the device, title and body of the notification | United States and European Union, according to the provider's infrastructure | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. DPF certification: being verified as at the date of publication | Always, for Android users | None |
| Internet Security Research Group (Let's Encrypt service), United States | Issuance and renewal of the TLS certificates of the platform domains | No personal data of the Customer. The provider receives exclusively the domain names for which the certificate is issued, which are public by construction | United States | No transfer of personal data of the Customer arises. The entry is listed for the completeness of the inventory, not because the provider receives personal data | Always | None |
Table 1.bis. Model providers downstream of OpenRouter
OpenRouter does not generate the replies: it routes them to model providers. The CodeDesign account is configured for exclusive routing towards the providers listed below: no call can reach a different provider. The list is taken from the account panel on 1 October 2026, can be changed without a software release and is therefore taken again and updated with each version of this page.
| Provider | Company and country | What it is used for | Country with an adequacy decision | Basis of the transfer |
|---|---|---|---|---|
| Amazon Bedrock | Amazon Web Services, Inc., United States | Models from several publishers on AWS infrastructure | No, United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication |
| Anthropic | Anthropic PBC, United States | Claude family of models | No, United States | Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider |
| Azure | Microsoft Corporation, United States | Models from several publishers on Azure infrastructure, with European endpoints as well | Depends on the endpoint served | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication |
| Fireworks | Fireworks AI, Inc., United States | Inference of open models | No, United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication |
| Google Vertex | Google LLC, United States | Gemini, Veo and Imagen families | No, United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication |
| NextBit | Nextbit256 S.L., Valencia, Spain | Inference of open models | Spain: yes, Member State of the European Union | No transfer to third countries: the processing remains within the European Economic Area |
| NVIDIA | NVIDIA Corporation, United States | Inference of open models | No, United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication |
| OpenAI | OpenAI Global LLC, United States | GPT and Whisper families, voice synthesis | No, United States | Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider |
| Parasail | Parasail, Inc., United States | Inference of open models on distributed GPUs | No, United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication |
| Perplexity | Perplexity AI, Inc., United States | Sonar models with web search | No, United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication |
| Recraft | Recraft AI Limited, United Kingdom | Generation of images and vector graphics | United Kingdom: yes, adequacy decision | United Kingdom: adequacy decision pursuant to Article 45 of the Regulation |
| Together | Together Computer, Inc. (Together AI), United States | Inference of open models | No, United States | Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider. As at the date of publication the company is not listed in the register of the EU-US Data Privacy Framework |
Transparency warning. The platform software specifies the model requested, not the provider that serves it: the choice of the provider, within the list above, is made by OpenRouter on each individual call. For some features of the mobile app automatic routing is set, in which OpenRouter chooses both the model and the provider. Consequently it is not possible to declare in advance a fixed provider for each feature: it is possible to declare, and CodeDesign does declare, the closed set of permitted providers.
The restriction of the model providers for one's own organisation is available to Customers on the Enterprise Plan: the platform binds the calls of the individual Customer to a list of providers approved by it, and that constraint prevails over any other setting. For the other plans the list published on this page applies. The request must be sent to privacy@codedesign.it.
4. Section 2. Optional sub-processors, active only upon activation by the Customer
They are involved only if the Customer activates the corresponding feature, but they operate with CodeDesign's credentials and contract: for this reason they are sub-processors of CodeDesign to all intents and purposes, and not recipients chosen by the Customer.
| Provider (name and country) | Service performed | Data processed | Place of processing | Basis of the transfer | When it is active | Downstream providers |
|---|---|---|---|---|---|---|
| AssemblyAI, Inc., United States | Voice transcription, pre-recorded and real time | Audio of the recordings and of the voice notes, the resulting transcripts | United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication | Only if the Customer chooses AssemblyAI as the transcription provider | None |
| OpenAI Ireland Limited, Ireland, for customers in the European Economic Area; OpenAI Global LLC group, United States | Voice transcription; direct processing on the provider's interfaces for specific platform features | Audio and transcripts; content of the requests and of the replies | Contracting entity in Ireland; technical processing also in the United States | Ireland: not applicable. For the intra-group transfer to the United States: Standard Contractual Clauses (Decision 2021/914, module 3) incorporated into the agreement with the provider | Only if the Customer chooses OpenAI as the transcription provider, or for the platform features that use the direct interface | None |
| Microsoft Ireland Operations Limited, Ireland, and Microsoft Corporation, United States | Web search engine of the agents (Bing Search) | The query formulated by the agent, which may contain the Customer's data | European Union and United States, according to the provider's infrastructure | European Union: not applicable. Outside the Union: EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication | Only if the agent is configured with the Bing engine | None |
| Google LLC, United States, and Google Ireland Limited, Ireland | Web search engine of the agents (Google Custom Search) | The query formulated by the agent | United States and European Union | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication | Only if the agent is configured with the Google engine | None |
| Perplexity AI, Inc., United States | Web search engine of the agents | The query formulated by the agent | United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication | Only if the agent is configured with the Perplexity engine | None |
| Exa Labs, United States | Web search engine, selectable among the engines of the mobile app | The query formulated by the agent | United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication | Only if selected as the search engine, or as a result of the automatic selection of the engine | None |
| Parallel Web Systems, Inc., United States | Web search engine, selectable among the engines of the mobile app | The query formulated by the agent | United States | EU-US Data Privacy Framework where the entity is certified in the official register, otherwise Standard Contractual Clauses. DPF certification: being verified as at the date of publication | Only if selected as the search engine, or as a result of the automatic selection of the engine | None |
| ElevenLabs, United States | Transcription and diarisation of the meetings with the platform key, when the Customer does not have a dedicated voice subscription | Full audio recording of the meeting, transcript with attribution of the contributions to the participants | Global region (United States), because the key is the shared platform key | As in section 1 | Only if the Customer activates the meetings feature | None |
Vector storage of the documents. The document search indexes are kept on the platform database, in the European Union. No third-party vector storage provider is used.
Document storage of the Customer. If the Customer configures its own storage connection for the documents, that storage is not a sub-processor of CodeDesign: it is infrastructure of the Customer, or of a provider chosen by the Customer, and falls under section 3.
5. Section 3. Third-party services activated by the Customer, which are not sub-processors of CodeDesign
These services do not process data on behalf of CodeDesign. They are reached because the Customer has asked for it, with the Customer's credentials or on the Customer's explicit instruction, in order to bring into the platform the data that are already on those systems, or to take data out towards those systems.
Under the Regulation they are recipients chosen by the controller, which is the Customer. The contractual and data protection relationship with these providers is the Customer's, not CodeDesign's. CodeDesign provides the technical connection and is answerable for the security of that connection, not for the processing that the provider carries out.
5.1 Productivity integrations
| Service | Provider | Credential used | Data that leave the platform, or that enter it |
|---|---|---|---|
| Microsoft 365 and Microsoft Graph: mail, calendar, Teams, files on OneDrive and SharePoint | Microsoft | OAuth authorisation granted by the administrator of the Customer's tenant, with delegated permissions for each individual user | Body of the emails and attachments, calendar events and participants, Teams messages, files. On the broader profiles also transcripts and recordings of Teams meetings, the organisation's address book, the presence of users |
| Google Workspace: Gmail, Calendar, Drive, Docs, Sheets, Chat, Contacts | OAuth authorisation granted by the Customer. Two of the scopes requested are classified as restricted by Google and require the approval of the Customer's Workspace administrator | Complete emails in MIME format and attachments, events and participants, files | |
| WhatsApp Business | Meta Platforms | The Customer's number and token, obtained through the embedded sign-up procedure. The credentials are encrypted at rest | Messages, media content, telephone numbers of the Customer's end customers |
| Mailboxes on IMAP and SMTP servers | The mail provider chosen by the Customer | Credentials provided by the Customer, encrypted at rest | Complete emails of the connected mailbox |
| Mail configured directly on the mobile app | The mail provider chosen by the user | Credentials entered by the user on the device | None: the mail does not pass through the Evolus servers. The app opens a direct encrypted connection between the phone and the mail server |
| Webhook endpoints indicated by the Customer | The Customer's system, or a provider chosen by it | The Customer's configuration | Depends on the webhook. For the switchboard: the complete transcript of the telephone call and the caller's number, on every call. The requests are cryptographically signed |
5.2 Catalogue connectors (MCP protocol)
A connector becomes operational only if the Customer installs it, and in most cases only if the Customer provides its own credential.
Group A. Connectors always available, which do not use the Customer's credentials.
| Connector | Provider reached | Data sent out |
|---|---|---|
| Time and date | None: local computation | None |
| Reading of web pages | Any website chosen by the model during processing | The address of the page requested. The set of reachable websites cannot be listed in advance |
| Sequential reasoning | None: local processing | None |
| Shopify documentation | Shopify Inc. | Search terms in the documentation |
| Wikipedia | Wikimedia Foundation | Search terms |
| YouTube | Google LLC | Address or identifier of the video |
Group B. Connectors that the Customer activates by providing its own credential. The connector is executed in a temporary process and the credential is not retained.
Notion Labs · Firecrawl · Tavily · Exa Labs · Perplexity AI · Brave Software · Apify · Supabase · Airtable · Browserbase · ElevenLabs · Salesforce (Heroku) · MongoDB · Discord, with channel messages and their authors · Twilio, with telephone numbers and the text of the SMS messages · Resend, with email addresses and the body of the messages · the Customer's PostgreSQL database.
Group C. Connectors that connect the Customer directly to the provider, without passing through the Evolus infrastructure.
GitHub · GitLab · Google Maps · Stripe · Context7 · Linear · Atlassian · Sentry · Figma · Asana · Zapier · PayPal · Intercom, with support conversations and end users · Canva · DeepWiki · PostHog · Cloudflare · Vercel · Square · monday.com · Webflow.
Group D. Productivity connectors. Microsoft 365 and Google Workspace are also published in the catalogue as connectors, with the same scopes and the same authorisations described in point 5.1.
Warning on the content transmitted to the connectors. What reaches the provider of a connector is the text that the model composes in order to invoke the tool. The platform forwards that text without rewriting it. Before installing a connector, the Customer assesses which data may end up in the arguments of the tools and checks that it has an adequate contractual relationship with that provider.
5.3 Websites reached by the web page reading tool
The agents and the digital employees have a tool that opens a web page and reads its content. The set of websites reached cannot be determined in advance: it depends on the task assigned and on the links that the model decides to open. What goes out towards those websites is the address requested and the normal metadata of a web request. The feature is protected by a control that prevents internal network addresses from being reached.
6. Section 4. Providers that process data with CodeDesign as controller
These providers do not process the Customer's data on behalf of the Customer. They process data on behalf of CodeDesign, for CodeDesign's own purposes: administration, invoicing, showcase website, distribution of the apps. They are listed for transparency. The processing is described in the notice published at https://evolus.ai/en/privacy-policy; the processing of the data of visitors to the showcase website is described in the website privacy notice, published at https://evolus.ai/en/website-privacy.
| Provider | Function | Data processed | Reference |
|---|---|---|---|
| Stripe Payments Europe, Limited, Ireland; Stripe, Inc. group, United States | Payment processing and subscription management. The browser of the administrator user is redirected to the provider | Billing data, the customer identifier with the provider, the outcome of the payments. The card data do not pass through the Evolus platform | Privacy notice, section dedicated to payments |
| Fulcro, internal management system of CodeDesign S.r.l. | Issuance of the invoices and administrative management of the relationship | Company name, VAT number, address, billing data, contracts | Processing internal to CodeDesign. It is not a third-party provider |
| Google Ireland Limited, Ireland, and Google LLC, United States | Visit statistics (Google Analytics) and ad measurement (Google Ads) on the showcase website evolus.ai, only with the visitor's consent | Identifiers stored in cookies, pages visited and events, device data | Privacy notice and cookie policy of the showcase website |
| Apple Inc., United States, and Google LLC, United States, as operators of the stores | Distribution of the Evolus mobile apps | Data of the user's store account, processed by the store as an independent controller | Notices of the stores |
The platform portal does not use statistical analytics tools or other third-party measurement tools.
6.1 Two technical contacts worth knowing
| Recipient | When it happens | What it receives | Why it is not a sub-processor |
|---|---|---|---|
| OpenStreetMap Foundation, United Kingdom | When a map appears in a chat reply, the user's browser requests the map images directly from the service | IP address and browser identifier of the user who views the map. No content of the conversation | The request starts from the user's browser, not from the Evolus servers, and the service does not process data on behalf of CodeDesign. It is nonetheless a recipient of data and for this reason it is declared |
| Mozilla Foundation, United States, mail parameter lookup service | When the user configures a mailbox on the mobile app, the app looks up the parameters of the server | Only the domain of the email address, for example "esempio.it". Never the full address, never the password. No cookies | The service receives a piece of data that does not identify the user. Declared for completeness |
In the WhatsApp channel connection flow the portal loads the sign-up component of Meta Platforms, which installs its own cookies in the browser of the administrator who carries out the connection.
7. Regional routing and data residency
| Processing category | Where the data reside | Status |
|---|---|---|
| Platform: database, files, attachments, user identity, monitoring | European Union. Microsoft Azure, West Europe region | In force |
| Document search indexes (vector storage) | European Union. Platform database | In force |
| Optical character recognition of documents | European Union. Azure Document Intelligence in a European Union region | In force |
| Translation of the summaries of telephone calls | European Union. Microsoft Azure, France Central region | In force |
| Digital employees: containers, memory, conversations, transcripts, meetings | European Union. Hetzner, Nuremberg, Germany | In force |
| Backups | European Union. Hetzner, Helsinki, Finland. Encrypted before leaving the source infrastructure | In force |
| Monitoring and application logs | European Union. Observability infrastructure managed by CodeDesign | In force |
| Language models | European routing, on the European Union endpoint of the routing provider: available to Customers on the Enterprise Plan. For the other plans global routing applies, with processing in the United States and at the providers in table 1.bis | In force |
| Language models, zero-retention endpoints | Routing solely to zero-retention endpoints: available to Customers on the Enterprise Plan. For the other plans the providers on the list published on this page apply, under the retention conditions indicated in section 8 | In force |
| Restriction of the model providers for an individual Customer | Available to Customers on the Enterprise Plan. For the other plans the list published on this page applies | In force |
| Voice: synthesis, voice agents, diarisation of meetings | European region: available to Customers on the Enterprise Plan. For the other plans the global region applies (United States). For the shared platform voice subscriptions the global region is in any event mandatory | In force |
| Voice transcription | United States, with the default provider. No region selection available at the provider | In force |
What "European routing" means. The calls to the language models are directed to the European endpoint of the routing provider and can be served only by the model providers that have European infrastructure. Providers without a European endpoint, including those based in countries without an adequacy decision, remain outside the perimeter by construction.
What "zero retention" means. Zero-retention endpoints are those at which the model provider does not retain the content of the request beyond the time necessary to produce the reply.
How they are activated. The four features reserved to the Enterprise Plan (European routing, zero-retention endpoints, restriction of the model providers, European region of the voice) are activated, upon written request to privacy@codedesign.it, for the Customers that hold such a Plan and whose accepted commercial proposal provides for them, pursuant to Article 2.3 of the General Conditions of Use. The plans are described in the price list published at https://evolus.ai/en/pricing.
8. Commitments on the use of data for the training of models
CodeDesign's commitment. CodeDesign contractually undertakes to select model providers and voice service providers whose terms exclude the use of the Customer's content for the training of their own models, and to activate, where the provider makes them available, the settings that exclude training and prevent the retention of the data, including the parameters to be transmitted with each individual request where the provider offers that method. If a provider does not offer this guarantee, CodeDesign does not use it for the processing of the Customer's content, or uses it only after informing the Customer.
The status provider by provider. The table sets out what results from the providers' public documentation and from the configuration of CodeDesign's accounts.
| Provider | Use for training | Retention of the data | Status of the setting on the CodeDesign account |
|---|---|---|---|
| Microsoft (Azure) | The provider's terms exclude the use of customer data to train foundation models | According to the terms of the service | Covered by the provider's data protection addendum, being verified as at the date of publication |
| Hetzner | Not applicable: the provider does not process content, it supplies infrastructure | Not applicable | Not applicable |
| OpenRouter | The provider offers privacy settings at account level and a per-request parameter that disables the collection of the data by the downstream providers. Zero-retention endpoints are also available | Depends on the configuration | Account setting being verified as at the date of publication. Routing solely to zero-retention endpoints is available to Customers on the Enterprise Plan; for the other plans the retention conditions of the individual downstream providers apply |
| Anthropic (provider downstream of OpenRouter) | The provider's commercial terms exclude training on customer content | Default retention of 30 days for commercial customers. Zero retention available on request, not automatic | Zero retention being verified as at the date of publication |
| OpenAI | The provider does not use the data sent through the programming interface to train its own models, unless there is an explicit opt-in | Default retention of up to 30 days for abuse monitoring. Zero retention available upon approval, not automatic | Zero retention being verified as at the date of publication. For a specific platform feature retention on the provider's side is already disabled |
| Google (Vertex) | The terms for the paid services exclude the use of customer data for training | According to the terms of the service | Covered by the provider's data processing and security terms, being verified as at the date of publication |
| ElevenLabs | Being verified as at the date of publication against the terms signed | The provider offers a zero-retention mode, optional, to be enabled separately | Zero-retention mode being verified as at the date of publication |
| Deepgram | The provider operates a model improvement programme. The exclusion is obtained with a parameter on each individual call, or with a processing agreement that limits the processing to the provision of the service alone | For the requests excluded from the programme, retention limited to the processing time | Opt-out parameter being verified as at the date of publication |
| AssemblyAI | Exclusion from training available | Zero retention available for the real-time product, if training is opted out of. The metadata for logging and billing remain | Being verified as at the date of publication |
| Perplexity, Exa Labs, Parallel Web Systems | Being verified as at the date of publication against the terms signed | Being verified as at the date of publication | Being verified as at the date of publication |
| Providers downstream of OpenRouter | The commitments are those of the respective provider, applied through the routing provider | Depends on the provider | Governed by the setting at account level and, for Customers on the Enterprise Plan, by European routing and by routing solely to zero-retention endpoints |
Transparency on this point. The exclusion from training is today guaranteed by the contractual terms of the providers and by the settings of the accounts of CodeDesign, not by a technical control applied to each individual call by the platform software. CodeDesign is introducing the corresponding application parameters where the provider makes them available. This page will be updated when that introduction is complete.
9. Version history
| Version | Date of publication | Effective from | What has changed | SHA-256 hash |
|---|---|---|---|---|
| 1.0 | 21 September 2026 | 21 October 2026 | First publication of the complete list of sub-processors | 066786194ed18693b119c727e8df5dc24c593393a1194008de628708d960bb62 |
| 1.1 | 1 October 2026 | 21 October 2026 | Section 4, CodeDesign's providers for the showcase website: iubenda removed, Google entry updated (statistics and ads only with the visitor's consent), reference to the website privacy notice. List of providers downstream of OpenRouter re-checked | 983b6b2e6d4dfea5720275ffbd6933fa6d478c8a78759ec4857b47db587bb01f |
Each version remains available in the history published at https://evolus.ai/en/subprocessors. The SHA-256 hash allows the Customer to verify that the document consulted is identical to the one published.
10. Communication texts
The texts that follow are the templates that CodeDesign uses to communicate a change to the list. The fields in italics are filled in each time with the data of the individual change.
10.1 Email notifying a change of the sub-processors
Subject: Evolus: change to the list of sub-processors, effective from effective date
Body:
Dear Customer,
as provided for by the Data Processing Agreement accepted together with the General Conditions of Use of CodeDesign S.r.l., we inform you that the list of sub-processors of the processing for the Evolus platform will be changed.
What changes
According to the case at hand:
- The sub-processor name of the provider, country of establishment, is added, and will perform the following function: function. The data it will process are: categories of data. The processing will take place in place of processing. If the processing takes place outside the European Economic Area, the transfer is based on basis of the transfer.
- The sub-processor name of the outgoing provider is replaced by name of the incoming provider, country of establishment, for the following function: function, for the following reason: reason for the replacement.
- The sub-processor name of the provider is removed, and will no longer process data on behalf of CodeDesign.
When it takes effect
The change will be effective from effective date, that is, at least 30 days from the date of this communication. Until that date nothing changes.
Where to find the updated list
The new version of the list, version code of the new version, is already published and available here: https://evolus.ai/en/subprocessors. Previous versions remain available in the history.
If you do not agree
Within 30 days of this communication you may object to the change, on grounds connected with the protection of personal data, by writing to privacy@codedesign.it and stating the name of your organisation and the reasons for the objection.
Within 15 days of your objection we will propose a solution to you: keeping the previous provider for your organisation, if technically possible; deactivating for your organisation the feature that requires the new provider; or adopting supplementary measures that overcome your objection. If no solution were practicable, you may withdraw from the service concerned without penalties, with effect from the effective date of the change and with a refund of the portion of the fee not used.
If we do not receive an objection from you within 30 days, the change will be deemed accepted.
For any clarification we are available at privacy@codedesign.it.
Kind regards
CodeDesign S.r.l.
Via Nino Pesce 38, 18018 Taggia (IM), VAT No. IT01739830089
10.2 Notice in the portal
Shown to users with the role of administrator of the organisation, from the date the communication is sent until 7 days after the effective date.
Title: Change to the providers that process the data
Text:
From effective date the list of the providers that process data on behalf of CodeDesign in order to provide Evolus changes. We have sent you the details by email. You have until deadline for objecting to object, by writing to privacy@codedesign.it.
Actions: "See the updated list", with a link to https://evolus.ai/en/subprocessors, and "Got it", which closes the notice for that user.
List of sub-processors, version 1.1. CodeDesign S.r.l., Via Nino Pesce 38, 18018 Taggia (IM), VAT No. IT01739830089. Data protection contact: privacy@codedesign.it.