Privacy Policy

1. Information We Collect

Account & Billing Data

• Contact details such as name, email address, and company information
• Authentication details (sign-in identifiers and session tokens). If you sign in with email and password, your password is stored only in hashed form by our sign-in provider, Firebase (Google); EVA never sees or stores it.
• Plan selection, invoices, payment confirmations, and tax identifiers

Usage & Conversation Data

• Prompts, files, and responses exchanged with supported LLM providers
• Conversation titles, tags, and credit consumption metrics
• Device data (IP address, browser/OS metadata) and diagnostic logs

Support, Careers, and Feedback Forms

• Details you submit via "Contact Support," "Request a Feature," or Contact page forms, including subject category, message content, and Turnstile captcha proof
• Applicant data uploaded through Careers modals (resume/CV files, position applied for, LinkedIn/GitHub links). Files are stored in cloud storage and forwarded via email to our hiring team.
• Metadata such as timestamps, IP address, and user-agent to prevent abuse

Cookies & Similar Technologies

EVA uses cookies, local storage, and session tokens to keep you signed in, remember preferences (e.g., selected AI model), and measure product usage. Without your consent we measure usage only in cookieless mode — no cookies or device storage, no identification (legitimate interest, Article 6(1)(f) GDPR). We ask for your consent before setting any non-essential cookies, enabling session recordings, or loading Google Analytics, via the banner shown on your first visit. You can manage or withdraw your consent at any time. We also use Cloudflare Turnstile for bot detection; Cloudflare may process limited device data to assess risk.

When you have an account, we also record a limited set of account events on our servers — for example sign-up, plan purchase or cancellation, and which AI model a message was sent to — linked to your account ID, to operate and improve the service (legitimate interest). These events never contain your messages, prompts, file names or email address.

2. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Performance of a contract (Article 6(1)(b) GDPR): To create and manage your account, process payments, deliver AI responses, and provide customer support.
• Legitimate interests (Article 6(1)(f) GDPR): To prevent fraud and abuse, ensure platform security, analyze anonymized usage patterns to improve the Service, send transactional communications, and send account holders occasional product emails (for example getting-started tips, a notice when your credits run out, and new models in EVA), and our newsletter about EVA and our blog (sent through Sender.net). You can turn these off anytime in Settings or with the unsubscribe link in each email, and you can untick the newsletter box when you sign up. We balance these interests against your rights and freedoms.
• Compliance with a legal obligation (Article 6(1)(c) GDPR): To retain billing records as required by tax and accounting law, and to respond to lawful requests from authorities.
• Consent (Article 6(1)(a) GDPR): For non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

3. How We Use Your Information

• Authenticate you, manage subscriptions, and display your credit balance
• Route prompts to the chosen LLM provider and return responses
• Provide customer support, answer feature requests, and send transactional emails and occasional product emails you can turn off
• Process job applications, forward CVs to the Careers team, and send confirmation receipts
• Monitor platform health (uptime, error rates, response times) and prevent abuse
• Comply with legal obligations, enforce our Terms, and maintain security (rate limiting, audit trails)

We do not use your conversation content to train AI models. We may use anonymized, aggregated service metrics (such as credit consumption patterns and error rates) to improve platform performance; this data cannot be linked back to individual users or conversations.

4. How We Share Information

LLM & Infrastructure Partners

We pass the minimum viable prompt and content data to the LLM provider you select (Google, OpenAI, Anthropic, xAI, Perplexity, DeepSeek, Meta, Mistral, Qwen, GLM, Moonshot, or MiniMax). Models from DeepSeek, Meta, Qwen, GLM, Moonshot and MiniMax are reached through OpenRouter, an AI routing service, and may be processed outside the United States. Each provider processes data under their own terms and privacy policies. Outputs are returned to your EVA workspace and stored for history unless you delete them. We encourage you to review each provider's privacy policy before submitting sensitive content.

When a model searches the web to answer you, the provider sends search queries based on your message to its search service. We do not send your name or email with these queries.

When you ask a model to create an image, your request is sent to that model's provider, and the generated image is stored with your chat and deleted when you delete the chat or your account.

Operational Vendors

We rely on vetted providers for:

• AWS (SES for email delivery)
• Cloudflare (Turnstile captcha and network edge security)
• Google Cloud (Cloud Storage for file uploads)
• Supabase (database hosting)
• Stripe (subscription billing and fraud prevention)
• PostHog, Google Analytics and Sentry (product analytics, traffic measurement and error monitoring)
• Sender.net (newsletter for account holders; unsubscribe anytime)

The full list, with what each provider processes and where, is on our Subprocessors page.

These vendors may only process data on our behalf and under contractual confidentiality obligations. We require our vendors to process personal data under data processing terms, including Standard Contractual Clauses where required.

Legal & Safety

We may disclose information if required by law, court order, or subpoena, or to protect the rights, property, or safety of EVA, our customers, or others.

5. Data Retention

• Conversation history: Retained until you delete it or your account is closed. After deletion, data is purged from live systems within 30 days and from backups within 90 days.
• Support tickets and feature requests: Retained for 2 years after resolution to track patterns and prevent repeat abuse, then deleted.
• Applicant CVs and career data: Retained for up to 90 days after a role closes. You may request earlier deletion by emailing privacy@evaonline.ai.
• Billing records: Retained for 7 years as required by US federal tax law and applicable accounting regulations.
• Product analytics (PostHog): When you delete your account, we also request deletion of your analytics profile and its events from PostHog, which is completed within 30 days. Session recordings are kept for no more than 30 days.
• Security and abuse logs (IP, timestamps, captcha data): Retained for 90 days, then deleted unless required for an ongoing investigation.

6. Security

EVA uses encryption in transit (HTTPS/TLS) and at rest, role-based access controls, audit logging, and regular security reviews. While no system is perfectly secure, we work to detect and mitigate unauthorized access.

Data breach notification: In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours where required by applicable law (e.g., GDPR Article 33). Where the breach poses a high risk to your rights and freedoms, we will also notify you directly without undue delay (GDPR Article 34).

7. Your Choices & Rights

All users may:

• Update profile, billing, and notification preferences in-app
• Delete conversation threads or your account via dashboard settings
• Opt out of marketing emails through unsubscribe links (transactional emails will continue)
• Request access, correction, export, or deletion of your personal data by emailing privacy@evaonline.ai

EEA & UK Users (GDPR / UK GDPR)

If you are located in the EEA or UK, you have the following additional rights:

• Right of access (Article 15): Request a copy of the personal data we hold about you.
• Right to rectification (Article 16): Ask us to correct inaccurate data.
• Right to erasure (Article 17): Ask us to delete your personal data where there is no compelling reason for continued processing.
• Right to restriction (Article 18): Ask us to restrict processing while a dispute is resolved.
• Right to data portability (Article 20): Receive your data in a structured, machine-readable format.
• Right to object (Article 21): Object at any time to processing based on legitimate interests, including profiling. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Rights related to automated decision-making (Article 22): EVA does not make solely automated decisions that produce legal or similarly significant effects on you. If this changes, we will update this policy and provide appropriate safeguards.
• Right to lodge a complaint: You have the right to lodge a complaint with the supervisory authority in your country of residence or place of work. In the EU, you can find your local authority at edpb.europa.eu. In the UK, contact the Information Commissioner's Office (ICO).

To exercise any of these rights, email privacy@evaonline.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

Your California Privacy Rights (CCPA/CPRA)

What we collect. Identifiers (account ID, email address), commercial information (plan and purchase history), internet activity (pages visited, features used, approximate location from IP), and the content you choose to submit, which we use only to provide the service.

Selling and sharing. We do not sell personal information for money. When you allow analytics cookies, we may share limited usage and conversion data (for example, that a visit led to a sign-up) with Google to measure and improve our advertising. Under California law this may be considered a "sale" or "sharing" for cross-context behavioral advertising. We never share the content of your chats.

Your rights. You can ask to know what personal information we hold about you, ask us to delete or correct it, and opt out of sharing. We won't treat you differently for exercising these rights. Send requests to privacy@evaonline.ai; we'll respond within 45 days.

Opting out. Use "Do Not Sell or Share My Personal Information" in the footer of any page. We also honor the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as an opt-out of sharing automatically.

8. Children's Privacy

EVA is intended for users 18 and older. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we will delete the account and its data. If you believe someone under 18 has used EVA, contact privacy@evaonline.ai.

9. International Transfers

EVA is headquartered in the United States. If you access the Service from another country, your information may be transferred to, stored, and processed in the U.S. or other countries where our vendors operate. For transfers of personal data from the EEA or UK to countries not recognized as providing an adequate level of protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (2021/914/EU) or the UK's International Data Transfer Agreement (IDTA), as applicable. You may request a copy of the relevant transfer mechanisms by emailing privacy@evaonline.ai.

10. Updates to this Policy

We may update this Privacy Policy to reflect changes in technology, regulation, or our product roadmap. For material changes, we will provide at least 30 days' advance notice by email or in-app announcement, and where required by law, we will seek your affirmative consent. The "Last Updated" date at the top of this page indicates the current version. For non-material clarifications, updating the date is sufficient notice.

11. Contact Us