Privacy Policy
Last updated: April 2025
1. Data Controller
The data controller for personal data processed through the EVVY platform is EVVY, Warsaw, Poland. You can contact us regarding data protection matters at: hello@getevvy.ai. We are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national law.
2. What Data We Collect
We collect and process the following categories of personal data: (a) Account data: email address, hashed password, name, and billing profile (address, company name, VAT ID) — provided by you at registration or in account settings; (b) Transaction data: order history, payment status, and invoice snapshots — generated when you place orders; (c) Usage data: pages visited, orders placed, and task inputs/outputs — collected automatically; (d) Communication data: any messages you send us via email or in-platform messaging. We do not collect sensitive personal data (e.g. health, racial origin, or political opinions).
3. How We Use Your Data
We use your personal data to: (a) provide and operate the Service — fulfil your orders, generate AI outputs, and deliver results; (b) manage your account and authenticate your identity; (c) send transactional emails (order confirmations, delivery notifications, password resets); (d) comply with legal obligations, including VAT invoicing requirements; (e) improve the Service through aggregate, anonymised analytics. We do not use your data for automated decision-making that produces legal effects.
4. Third Parties
We share your data only with trusted processors necessary to operate the Service: Stripe (payment processing — Stripe Privacy Policy applies), Resend (transactional email delivery), Supabase / Neon (database hosting in the EU), Anthropic (AI model API — input data is sent to generate outputs; Anthropic's data usage policies apply), and Vercel (hosting). We do not sell your personal data to any third party. All processors are bound by data processing agreements.
5. Data Retention
We retain your account data for as long as your account is active. Order and payment records are retained for 7 years to comply with tax and accounting obligations. If you delete your account, we will erase personal data within 30 days, except where retention is required by law. AI-generated task outputs are retained in your account until you request deletion.
6. Your Rights (GDPR)
Under GDPR, you have the right to: (a) access the personal data we hold about you; (b) correct inaccurate data; (c) erase your data ("right to be forgotten") where no legal retention obligation applies; (d) restrict or object to processing; (e) data portability — receive your data in a structured, machine-readable format; (f) withdraw consent at any time (where processing is consent-based); (g) lodge a complaint with the Polish Data Protection Authority (UODO) or your local supervisory authority. To exercise any right, contact hello@getevvy.ai. We will respond within 30 days.
7. Cookies
We use a single functional cookie ("evvy_lang") to remember your language preference. This cookie does not track you across sites and contains no personal data. We do not use advertising, analytics, or tracking cookies. No cookie consent banner is shown because we use only strictly necessary cookies. You can delete this cookie at any time in your browser settings without affecting core functionality.
8. Contact
For any privacy-related enquiries, requests to exercise your rights, or concerns about how we handle your data, please contact us at: hello@getevvy.ai — EVVY, Warsaw, Poland. We aim to respond to all requests within 30 days.