Service Providers & Subprocessors
Company draft for attorney review. Version: launch-draft-3. Intended effective date: September 11, 2026. Operator: Johnathon August Roman, doing business as Pineform Labs. Questions and provider-change inquiries: [email protected].
Scope and verification status
This inventory identifies providers evidenced by the current Yevr application and private-beta configuration. It is not a representation that every provider has the same contractual role. Google also supplies the independently connected account service. Exact contracting entities, processor/controller roles, agreements, deployment settings, international-transfer arrangements, provider-specific retention controls, and account-level data-sharing settings are to be confirmed before broader public launch. No certification, data-residency guarantee, contractual notice period, or completed Google verification is claimed.
OpenAI
Purpose: AI response generation through the server-side OpenAI API. Broad data categories: prompts, relevant conversation history, bounded retrieved evidence, pseudonymous safety identifiers, generated responses, and usage metadata. Current code requests `store: false`, which does not establish Zero Data Retention or prove every provider account setting. Yevr does not authorize Google Workspace data to be used for generalized model training. Exact account settings, contracting terms, processing locations, retention controls, and Google Limited Use compatibility must be verified before broader public launch.
Purpose: Google identity verification and separately authorized read-only Gmail, Google Calendar, and Google Drive access, including OAuth token exchange, refresh, and revocation. Broad data categories: account identity, authorization credentials, Workspace read queries, and authorized message/event/document metadata and content. Google's role as the user's account provider is distinct from any processing performed for Yevr; the applicable roles and agreements require review. Google verification and any required restricted-scope security assessment are not represented as complete. Processing location and transfer information: To be confirmed before broader public launch.
Render
Purpose: configured private-beta application hosting and persistent-disk storage. Broad data categories: network/request information processed by the host, application and security logs, identity/session records, tenant conversations and operational records, and encrypted Workspace credentials on the service disk. Processing location, snapshot/backup handling, live account settings, and transfer information: To be confirmed before broader public launch. The repository configuration does not establish the live service's region or all account-level settings.
Changes
We will maintain this inventory as providers change and provide notices required by applicable agreements or law. No billing processor, email-delivery vendor, hosted-voice provider, analytics vendor, or other subprocessor is asserted merely because a future feature might need one. Open-source libraries running within Yevr are not automatically separate hosted data recipients.
Questions about this list may be sent to [email protected]. Postal contact: Johnathon August Roman, doing business as Pineform Labs, 1550 Wilson Blvd, Ste 700 PMB264, Arlington, VA 22209.