Privacy policy

Everything on this page follows from one distinction. Get it clear and the rest of the document reads easily.

We never decide to do something new with your conversation data. If you want it deleted, you say so and it goes.

Three kinds of thing, and nothing else.

• Conversation data. Message text and call transcripts from the platforms you connect, call recordings where your platform sends them, and the metadata around a conversation: timings, language, which bot handled it, which of your clients it belongs to.
• Account data. The name, work email address and role of each person you invite. Sign-in events, API key use, and an audit record of who changed a setting.
• Service data. Scores, findings, metrics and reports our system produces from the above, plus ordinary technical logs needed to run and secure the service.

We do not run advertising, we set no advertising cookies, and we do not buy or enrich data about the people in your conversations.

For conversation data we are the processor, so the basis for holding it in the first place is yours, not ours. Section 8 explains what that means for you in practice.

This is a commitment, not a preference. We do not use your conversation data to train, fine-tune, or otherwise improve any machine-learning model, ours or anyone else’s. We pass the same instruction to every provider described in section 5, and we use their interfaces on terms that exclude training.

There is one narrow thing we do reserve. We may use de-identified, aggregate statistics across customers to improve our default checks and published benchmarks, for example how often a category of failure occurs. Aggregate means numbers, never text, never audio, and nothing that identifies you, your clients, or a person in a conversation. If you would rather we did not, write to privacy@evidova.com and we will exclude your workspace.

Scoring a conversation means asking several independent models to read it. That is how the product works, and it means we rely on a small number of other companies. We keep the list short on purpose.

• A managed database and object storage host, which holds everything, including transcripts inside their retention window and call recordings.
• Model providers, four of them, from different companies on purpose, so no single model both produces a score and reviews it. They receive conversation text, and call audio where audio is judged.
• An email delivery provider, which receives your name, your email address and the contents of an alert or digest we send you.

Each one is under a written contract that limits them to serving us, bars them from using your data for their own purposes, and requires them to delete it. We will tell you before a new provider starts handling conversation data, so you have time to object.

For the current list, naming each company and the country it processes in, write to privacy@evidova.com. We send it the same day, and enterprise buyers usually ask for it during review.

Storage sits in the region set for your workspace. Scoring does not: the model providers in section 5 process conversation text in the United States, and our email provider is there too. We are telling you plainly because a residency promise that only covers the database is not a residency promise.

• For UK and EU personal data we rely on the UK International Data Transfer Addendum and the European Commission's standard contractual clauses, with the assessments those require.
• For Indian personal data, the Digital Personal Data Protection Act allows transfer to any country the government has not restricted, and our contracts with each recipient carry security, breach-reporting and deletion terms.
• For US personal information, our providers act as service providers and are contractually barred from using the data for their own purposes.

If your obligations do not allow processing outside your region, tell us before you connect a platform. Do not assume the default suits you.

A nightly job does this, per workspace, and it deletes rather than hides. You can shorten your window at any time and the next run enforces the shorter one.

Your end users never signed up with us. They spoke to your AI agent. So the duty to have a lawful reason for recording them, and to tell them it happens, sits with you. Our terms of service say the same thing in contract language.

What we give you to make that easier:

• Redaction as data arrives. When you switch it on, we detect email addresses, phone numbers, payment card numbers, Aadhaar numbers and PAN numbers, and replace them before the message is stored.
• A separate vault for the originals. Unredacted text goes to a store only senior roles can open, and every read is logged with who did it and when.
• This is off until you turn it on. We would rather say so here than let you discover it later. Redaction cannot be applied backwards, so switch it on before you connect a live platform.

If an end user asks you to delete their data, you can act on it in the product, and we help with anything the product cannot reach.

• Each workspace is isolated in the database itself, by row-level security tied to the identity making the request, not by a filter in application code that someone can forget.
• Sign-in is passwordless, by a single-use emailed link or your Google account, so there is no password of ours to steal.
• API keys are scoped, can be limited to one client, and can be revoked and rotated. Each one shows when it was last used.
• Reads of the unredacted vault are recorded separately from ordinary access.
• Data is encrypted in transit and at rest by our infrastructure providers.

No system is perfect, and we will not pretend otherwise. Report anything you find to security@evidova.com and we will respond.

These rights come from different laws, and they overlap. Rather than make you work out which applies, we offer all of them to everyone.

Write to privacy@evidova.com. We reply within 30 days. We ask for enough proof of identity to be sure we are not handing your data to someone else.

If you are an end user of one of our customers, we will pass your request to them, because it is their data and their decision. Tell us who you spoke to and we will route it.

If we get it wrong you can complain to a regulator: the Information Commissioner’s Office in the UK, the Data Protection Board of India, or your state Attorney General in the United States. We would rather you came to us first.

If personal data is breached we tell affected customers without undue delay, and the relevant regulator within 72 hours of finding out. We tell you what happened, what data was involved, and what we have done, and we do not wait until the picture is complete to make the first contact.

Evidova is a tool for businesses, and nobody under 18 should have an account. We do not knowingly process children’s data. If your AI agents talk to children, tell us before you connect them, because Indian law requires verifiable parental consent and that changes what you and we must do.

If we change something that matters, we will email the account owners and put the new date at the top before it takes effect. We will not quietly widen what we may do with your data. Expanding data rights by silent edit is the practice this industry is rightly being called out for, and we are not going to do it.

• Privacy and data requests: privacy@evidova.com
• Security reports: security@evidova.com
• Everything else: legal@evidova.com

This page is governed by Indian law, and disputes about it go to the competent courts in India. That does not take away a right you have under the law of the country you live in.