Subprocessors

Subprocessors of customer personal data

These providers may process Customer Personal Data (as defined in the DPA) on Eagle Virtual’s behalf as part of our hosting and delivery infrastructure.

Cloudflare, Inc. (United States). Purpose: content delivery network, DNS, DDoS and bot protection (including Turnstile), web application firewall, edge compute, and edge storage for the service’s websites and application data — the site, its Workers, and its databases run on Cloudflare’s platform. Processing locations: primarily the United States and the EEA, on a geographically distributed global edge network. Transfer mechanism: EU–U.S. Data Privacy Framework (plus UK Extension and Swiss–U.S. DPF), with EU Standard Contractual Clauses and supplementary measures as fallback.

Payment and identity providers

These providers support sign-in and billing. For parts of that processing — for example payment fraud prevention, or your Google or Microsoft account itself — they act as independent controllers under their own privacy notices, not as Eagle Virtual’s processors.

Stripe, Inc. / Stripe, LLC (United States). Purpose: payment processing, subscription billing, and invoicing. No page on this site ever sees a card number; checkout happens on Stripe’s own hosted pages. Processing locations: United States, with Stripe affiliates and service providers in the EU, U.S., and India. Transfer mechanism: EU–U.S. Data Privacy Framework (plus UK Extension and Swiss–U.S. DPF), and Standard Contractual Clauses via Stripe’s Data Transfers Addendum.

Google LLC (United States). Purpose: sign-in identity provider (Google OAuth). We receive your email address and basic profile data when you choose Google sign-in; our use of that data follows the Google API Services User Data Policy, including its Limited Use requirements. Processing locations: global. Transfer mechanism: EU–U.S. Data Privacy Framework (plus UK Extension and Swiss–U.S. DPF), and Standard Contractual Clauses.

Microsoft Corporation (United States). Purpose: sign-in identity provider (Microsoft identity platform OAuth), where enabled. We receive your email address and basic profile data when you choose Microsoft sign-in. Processing locations: global. Transfer mechanism: EU–U.S. Data Privacy Framework (plus UK Extension and Swiss–U.S. DPF), and Standard Contractual Clauses via the Microsoft Products and Services DPA.

Changes to this list

We update this page when a provider is added, removed, or its role changes, and the version date above moves with it. DPA customers who require advance notice of subprocessor changes can request it under the DPA’s subprocessor terms.

What is deliberately absent: this product runs no analytics or advertising tags, no dedicated-server origin outside the platform above, and no email delivery provider — transactional email is off until switched on by an operator decision, and this page will be updated when that changes.