Privacy Policy

1. Information We Collect

Account & Billing Data

• Contact details such as name, email address, and company information
• Authentication details (hashed passwords, passkeys, session tokens)
• Plan selection, invoices, payment confirmations, and tax identifiers

Usage & Conversation Data

• Prompts, files, and responses exchanged with supported LLM providers
• Conversation titles, tags, and credit consumption metrics
• Device data (IP address, browser/OS metadata) and diagnostic logs

Support, Careers, and Feedback Forms

• Details you submit via "Contact Support," "Request a Feature," or Contact page forms, including subject category, message content, and Turnstile captcha proof
• Applicant data uploaded through Careers modals (resume/CV files, position applied for, LinkedIn/GitHub links). Files are stored in cloud storage and forwarded via email to our hiring team.
• Metadata such as timestamps, IP address, and user-agent to prevent abuse

Cookies & Similar Technologies

EVA uses cookies, local storage, and session tokens to keep you signed in, remember preferences (e.g., selected AI model), and measure anonymized product usage. We ask for your consent before setting any non-essential cookies, via the banner shown on your first visit. You can manage or withdraw your consent at any time. We also use Cloudflare Turnstile for bot detection; Cloudflare may process limited device data to assess risk.

2. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Performance of a contract (Article 6(1)(b) GDPR): To create and manage your account, process payments, deliver AI responses, and provide customer support.
• Legitimate interests (Article 6(1)(f) GDPR): To prevent fraud and abuse, ensure platform security, analyze anonymized usage patterns to improve the Service, and send transactional communications. We balance these interests against your rights and freedoms.
• Compliance with a legal obligation (Article 6(1)(c) GDPR): To retain billing records as required by tax and accounting law, and to respond to lawful requests from authorities.
• Consent (Article 6(1)(a) GDPR): For non-essential cookies and for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

3. How We Use Your Information

• Authenticate you, manage subscriptions, and display your credit balance
• Route prompts to the chosen LLM provider and return responses
• Provide customer support, answer feature requests, and send transactional emails
• Process job applications, forward CVs to the Careers team, and send confirmation receipts
• Monitor platform health (uptime, error rates, response times) and prevent abuse
• Comply with legal obligations, enforce our Terms, and maintain security (rate limiting, audit trails)

We do not use your conversation content to train AI models. We may use anonymized, aggregated service metrics (such as credit consumption patterns and error rates) to improve platform performance; this data cannot be linked back to individual users or conversations.

4. How We Share Information

LLM & Infrastructure Partners

We pass the minimum viable prompt and content data to the LLM provider you select (Google, OpenAI, Anthropic, xAI, Perplexity, DeepSeek, Meta, Mistral, Qwen, GLM, Moonshot, or MiniMax). Each provider processes data under their own terms and privacy policies. Outputs are returned to your EVA workspace and stored for history unless you delete them. We encourage you to review each provider's privacy policy before submitting sensitive content.

Operational Vendors

We rely on vetted providers for:

• AWS (SES for email delivery)
• Cloudflare (Turnstile captcha and network edge security)
• Google Cloud (Cloud Storage for file uploads)
• Supabase (database hosting)
• Stripe (subscription billing and fraud prevention)
• PostHog and Sentry (product analytics and error monitoring)

These vendors may only process data on our behalf and under contractual confidentiality obligations. Where required by GDPR, we have entered into Data Processing Agreements (DPAs) with each vendor.

Legal & Safety

We may disclose information if required by law, court order, or subpoena, or to protect the rights, property, or safety of EVA, our customers, or others.

5. Data Retention

• Conversation history: Retained until you delete it or your account is closed. After deletion, data is purged from live systems within 30 days and from backups within 90 days.
• Support tickets and feature requests: Retained for 2 years after resolution to track patterns and prevent repeat abuse, then deleted.
• Applicant CVs and career data: Retained for up to 90 days after a role closes. You may request earlier deletion by emailing privacy@evaonline.ai.
• Billing records: Retained for 7 years as required by US federal tax law and applicable accounting regulations.
• Security and abuse logs (IP, timestamps, captcha data): Retained for 90 days, then deleted unless required for an ongoing investigation.

6. Security

EVA uses encryption in transit (HTTPS/TLS) and at rest, role-based access controls, audit logging, and regular security reviews. While no system is perfectly secure, we work to detect and mitigate unauthorized access.

Data breach notification: In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours where required by applicable law (e.g., GDPR Article 33). Where the breach poses a high risk to your rights and freedoms, we will also notify you directly without undue delay (GDPR Article 34).

7. Your Choices & Rights

All users may:

• Update profile, billing, and notification preferences in-app
• Delete conversation threads or entire account data via dashboard settings
• Opt out of marketing emails through unsubscribe links (transactional emails will continue)
• Request access, correction, export, or deletion of your personal data by emailing privacy@evaonline.ai

EEA & UK Users (GDPR / UK GDPR)

If you are located in the EEA or UK, you have the following additional rights:

• Right of access (Article 15): Request a copy of the personal data we hold about you.
• Right to rectification (Article 16): Ask us to correct inaccurate data.
• Right to erasure (Article 17): Ask us to delete your personal data where there is no compelling reason for continued processing.
• Right to restriction (Article 18): Ask us to restrict processing while a dispute is resolved.
• Right to data portability (Article 20): Receive your data in a structured, machine-readable format.
• Right to object (Article 21): Object at any time to processing based on legitimate interests, including profiling. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Rights related to automated decision-making (Article 22): EVA does not make solely automated decisions that produce legal or similarly significant effects on you. If this changes, we will update this policy and provide appropriate safeguards.
• Right to lodge a complaint: You have the right to lodge a complaint with the supervisory authority in your country of residence or place of work. In the EU, you can find your local authority at edpb.europa.eu. In the UK, contact the Information Commissioner's Office (ICO).

To exercise any of these rights, email privacy@evaonline.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

California Users (CCPA / CPRA)

California residents have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of the sale or sharing of personal information. EVA does not sell or share your personal information for cross-context behavioral advertising. To submit a verifiable consumer request, email privacy@evaonline.ai with the subject line "CCPA Request."

8. Children's Privacy

EVA is not directed at children under the age of 13 (or under 16 where required by local law, including EEA member states that have set a higher age of digital consent under GDPR Article 8). We do not knowingly collect personal data from children below the applicable age threshold. If we become aware that we have inadvertently collected personal data from a child below the applicable age, we will delete it promptly. If you believe we have collected data from a child, please contact us at privacy@evaonline.ai.

9. International Transfers

EVA is headquartered in the United States. If you access the Service from another country, your information may be transferred to, stored, and processed in the U.S. or other countries where our vendors operate. For transfers of personal data from the EEA or UK to countries not recognized as providing an adequate level of protection, we rely on Standard Contractual Clauses (SCCs)approved by the European Commission (2021/914/EU) or the UK's International Data Transfer Agreement (IDTA), as applicable. You may request a copy of the relevant transfer mechanisms by emailing privacy@evaonline.ai.

10. Updates to this Policy

We may update this Privacy Policy to reflect changes in technology, regulation, or our product roadmap. For material changes, we will provide at least 30 days' advance notice by email or in-app announcement, and where required by law, we will seek your affirmative consent. The "Last Updated" date at the top of this page indicates the current version. For non-material clarifications, updating the date is sufficient notice.

11. Contact Us