Privacy Policy

1. Introduction

Evnao (“we”, “us”) respects your privacy. This Privacy Policy explains how we handle personal data when you visit our website or use our platform. Applicable privacy duties depend on where Evnao, the workspace owner, and the end user are located. This policy describes current product behavior; it is not a certification of compliance for every customer or jurisdiction.

2. Data We Collect

• Account Data (Customers): name, business email, billing address, subscription details, support inquiries.
• Payment Data: FastSpring is the Merchant of Record for new paid subscriptions and collects payment details during checkout. Certain legacy subscriptions may continue to be processed through the provider originally used to create them. Evnao receives subscription status, order identifiers, and coarse payment-method information from the applicable provider, but does not receive or store card numbers or CVV codes.
• End-User Data: As part of the support service, we process chat messages, email exchanges, contact details supplied in pre-chat forms, conversation ratings, and knowledge files uploaded by workspace members.
• Usage Data: Logins, IP address, device/browser info for security.
• Free-trial eligibility data: verified business root domain, verification status, provider customer and subscription identifiers while the account exists, and keyed one-way HMAC records used to enforce the one-time free trial of paid plans rule. These HMAC records are pseudonymous security/abuse-prevention records, not reversible copies of the original identifiers. Evnao does not use invasive browser fingerprinting for trial eligibility.
• Cookies: We use necessary cookies for site functionality. We use analytics cookies only with consent.

3. How We Use Data & Legal Bases

We use your data to provide and maintain the Service, process payments, communicate updates and security notices, comply with law, and improve the product. Resolved and closed conversation data is deleted by Evnao's scheduled retention job after the workspace's configured plan window. The immediate-deletion setting removes eligible resolved conversations on the next cleanup run; it does not by itself change an external AI provider's separate processing policy.

Knowledge suggestions: Evnao may create draft knowledge suggestions from resolved conversations when the workspace uses that feature. Drafts require owner review before publication. Evnao does not currently guarantee automated removal of every item of personal or sensitive information, so owners must review suggestions before publishing them.

We process data under the following bases:

• Contract: Necessary to provide the subscribed Service to the Customer.
• Consent: For cookies, marketing emails, or any optional features.
• Legal Obligations: To comply with courts or regulations.
• Legitimate Interests: Where applicable, Evnao may rely on legitimate interests in preventing fraud, enforcing one-time promotional eligibility for free trials of paid plans, protecting the Service, and securing accounts, balanced against the rights and interests of affected individuals. This basis may not apply identically in every jurisdiction; where a different legal basis is required under local law, Evnao will rely on the applicable alternative.

4. Third-Party Processors & Data Transfers

We use FastSpring as the Merchant of Record and primary payment provider for new subscriptions. Certain legacy subscriptions may continue to be processed through the provider originally used to create them. We use Google for knowledge embeddings. Live AI generation uses Evnao's managed Google Gemini account unless a Pro workspace owner connects a supported Google, NVIDIA NIM, OpenAI, or Anthropic account. Customer-authorized channels may use Meta, Telegram, or Brevo. Optional PostHog analytics loads only after consent. Shopify, Zendesk, Calendly, and custom HTTPS actions receive only the data required for an owner-authorized feature or customer request. These providers may process data outside the Customer's country; required transfer terms and safeguards must be assessed for the deployment.

5. Data Retention

Evnao's scheduled retention job removes eligible resolved and closed conversations according to the configured plan window. Open conversations remain so support can continue. Provider-side copies follow the provider's own processing and retention terms. Evnao does not currently offer a provider-side Zero Data Retention guarantee.

To enforce the one-time free-trial-of-a-paid-plan rule after account or workspace deletion, Evnao may retain keyed HMAC values derived from a verified root domain, verified owner email, and documented payment-provider customer ID. These values are pseudonymous security/abuse-prevention records, not reversible copies of the original identifiers. They are retained for the configured anti-abuse period from trial activation (24 months by default), then removed by scheduled retention. They are used only for trial eligibility, abuse review, security, and related legal claims.

6. Your Rights

You have the right to:

• Access and obtain a copy of your data;
• Rectify or update inaccurate data;
• Delete your data (“right to be forgotten”), subject to legal exceptions;
• Object to or restrict processing;
• Data portability (for machine-readable copy);
• Withdraw consent at any time for future processing;
• In California: the right to know, delete, correct, or limit sensitive data; no sale/sharing of data (Evnao does not sell data).

Requests can be made via email at privacy@evnao.com. Workspace owners can also request a machine-readable workspace export in Security settings. Evnao will verify identity and scope before acting; deletion, objection, and provider-data requests currently require review rather than a fully automated portal.

7. Security & Children's Privacy

We maintain technical and organizational measures (encryption, firewalls, access controls) to protect data. Only authorized staff have access to production systems. Our Service is not for children under 16, and we do not knowingly collect data from minors.

8. Contact Us

For privacy inquiries or to exercise your rights, email privacy@evnao.com.