Eva

Privacy Policy

Draft · Last updated: July 2026

1. Who we are and our roles

The Eva service is operated by [OPERATOR], [ADDRESS], reg. no. [REG NO], e-mail [CONTACT E-MAIL] ("we").

  • For your account data we act as the controller.
  • For the content of your customers' e-mails processed on your behalf, you are the controller and we act as your processor under Art. 28 GDPR, based on our Data Processing Agreement.

2. What we process and why

Account data (contract performance, Art. 6(1)(b)); mailbox credentials (encrypted with AES-256-GCM; contract performance); e-mail content and attachments of your customers including AI classification and reply drafts (as processor under your instructions — drafts are never sent without your approval); knowledge base, chat and settings (contract performance); usage counters (contract performance); technical logs without e-mail content (legitimate interest). Marketing only with consent.

3. Sub-processors and international transfers

Supabase, Inc. (database, auth, storage — EU, Frankfurt) · Vercel, Inc. (hosting — compute in Frankfurt, EU; global network; DPA with SCCs) · Anthropic, PBC (AI processing — transfer to the USA; DPA with SCCs Module 2/3; contractually does not train models on our data; retention up to 30 days) · Stripe (payments — planned).

4. Retention

Account data and content: for the lifetime of the account. E-mail attachments: deleted automatically after 30 days. Account deletion is immediate and irreversible (we currently run no database backups; if backups are introduced, deleted data will be purged from them within 14 days and this policy updated). Anthropic copies expire per their retention (max. 30 days).

5. Security

TLS in transit and encryption at rest; mailbox credentials additionally encrypted at application level (AES-256-GCM); tenant isolation via Row Level Security; human-in-the-loop — no reply is sent without your approval.

6. Your rights

Access, rectification, erasure (Settings → "Delete account"), portability (Settings → "Export my data"), restriction, objection, and complaint to the Czech DPA (uoou.gov.cz). If you are a customer of our customer, please contact that company directly — they are the controller of your data; we will assist them.

7. Cookies

Only technical cookies required for sign-in and security. No analytics or marketing cookies — hence no cookie banner.