Evidano Privacy Policy

1. Introduction

AILYZE, Inc. (“AILYZE”, “we”, “us”, or “our”) provides Evidano, the AI research platform available at www.evidano.com (the “Service”). Before August 1, 2026, the Service was offered under the AILYZE name. This Privacy Policy applies in the same way to accounts created under either name.

This Privacy Policy explains how we collect, use, store, share, and protect Personal Data when you visit our website, create or use an account, or take part in an AI Interview or other research that one of our customers conducts using the Service. It also explains the choices and rights available to you and how to exercise them.

This Policy should be read together with our Terms of Service. Capitalized terms used but not defined here have the meanings given in the Terms of Service. This Policy does not govern third-party services you choose to connect to the Service; see Section 4.5.

2. Definitions

The following capitalized terms have the meanings given to them below:

Customer Data

The documents, files, text, audio, recordings, prompts, and other data that you or your users upload, import, create, or process within the Service, including AI Interview recordings, transcripts, and participant responses and the questions, follow-up questions, and conversational responses the AI moderator generates, together with the output the Service generates from all of these. Customer Data is the same thing the Terms of Service calls “Content”. Customer Data may include Personal Data. It does not include Account Data or Communications Data.

Personal Data

Information relating to an identified or identifiable natural person. Where this Policy refers to “personal information”, it means the same thing.

Account Data

Personal Data we collect to create and administer an account: your name, email address, sign-in credentials, profile image, and, for paying customers, the billing contact details needed to complete a transaction.

Communications Data

Information you choose to send us when you contact support, report a problem, or give feedback, including any excerpt or file you attach.

Usage Data

Data generated automatically by your use of the Service or by the Service’s infrastructure, such as IP address, browser type, login times, in-product actions, file sizes, error codes, and security events. Usage Data never includes the contents of Customer Data.

Google User Data

Personal Data we receive from Google when you sign in with your Google account, or that we access through a Google API you authorize us to use.

AI Interview

An interview with a Research Participant conducted through the Service by an AI avatar moderator that a customer configures and deploys.

Research Participant

An individual whose information appears in a customer’s Customer Data, such as an interviewee, survey respondent, or AI Interview participant. Research Participants do not hold Evidano accounts.

Assigned Region

The Microsoft Azure region — United States (US East) or European Union (West Europe) — in which an account’s Customer Data and Usage Data are stored and processed. See Section 10.

Sub-processor

A third party we engage to process Personal Data on our behalf, under written terms that restrict its use of that data to the service we have contracted it to provide.

3. Our Role: Controller and Processor

Our obligations under data protection law depend on which data we are handling.

• Customer Data — we act as a processor. Our customers decide what Customer Data to put into the Service and why. We process it only on their documented instructions, which are given through their use and configuration of the Service and through any Data Processing Agreement. Where Customer Data contains Personal Data about Research Participants or other people, the customer is the controller. The customer is responsible for having a lawful basis to collect that data, for giving those people the notices they are owed, for obtaining any consent that is required — including consent to take part in an AI Interview and to be recorded — and for honoring their rights. We assist customers with these obligations as described in Section 9.5.
• Account Data, Usage Data, and Communications Data — we act as a controller. We decide how to use the data needed to create your account, bill you, secure the Service, and support you. Sections 5.1 and 5.2 set out those purposes and our legal bases. If your account was provisioned by your employer or academic institution, that organization may administer your account and may have rights to access, retain, or delete it.
• Google User Data — we act as a controller for the profile information used to sign you in, and as a processor for content you import through an optional Google integration, which becomes Customer Data once it reaches your workspace.

A Data Processing Agreement covering our role as a processor is available on request at info@evidano.com; see Section 14.

4. Information We Collect

4.1 Information You Provide

• Account Data. When you register, we collect your name, email address, and sign-in credentials. You may add a profile image. If you buy a Paid Plan, we collect the billing contact details needed to complete the purchase. Card and bank account details are entered directly into Stripe’s payment form; we never see or store your full card number.
• Customer Data. You provide Customer Data when you use the Service. This may include interview transcripts, research articles, reports, survey responses, social media content, data collected from public websites, audio and meeting recordings, prompts, AI Interview data, and the output the Service generates.
• Communications Data. When you contact us, we collect what you choose to send. If you paste an excerpt of your Customer Data or attach a file to a support request, that copy is handled as Communications Data so that we can help you. Please send only what we need to diagnose the issue.

4.2 AI Interviews

Customers can deploy an AI avatar moderator to interview Research Participants. A participant joins through a link that the customer shares with them. The link is limited to a single interview project and gives no access to any other content in the customer’s workspace. Participants do not create an Evidano account.

An AI Interview generates a recording of the session, a transcript, the participant’s responses, and the questions, follow-up questions, and conversational responses the AI moderator produces. All of this is Customer Data. It belongs to the customer who ran the interview, is stored only in that customer’s Assigned Region, and is handled on the same terms as any other Customer Data. Technical connection data generated during the session, such as IP address and browser type, is recorded as Usage Data in the same region for security purposes.

The customer running the interview is responsible for telling participants, before the interview begins, that they will be interviewed by an AI moderator and that the session will be recorded, and for obtaining their consent. If you are a participant and have questions about an interview, please contact the organization that invited you; see Section 9.5.

4.3 Information We Collect Automatically

• Usage Data. IP address, browser type, operating system, login times, actions performed within the Service, file sizes, error codes, and security events.
• Operational telemetry. Our monitoring and diagnostic systems record only an approved list of metadata fields, such as event names, error codes, file sizes, timestamps, and account identifiers. Request bodies, document text, transcripts, audio, prompts, interview content, and output are removed before any telemetry is recorded, and automated tests verify that this removal works. Telemetry is stored in your Assigned Region and never leaves it.
• Cookies. We set only strictly necessary session cookies, such as the cookie that keeps you signed in. They are marked Secure and HttpOnly. We do not use advertising, cross-site tracking, or third-party analytics cookies, so we do not ask for cookie consent.

4.4 Information from Sign-In Providers

If you sign in with Google, we receive your basic profile information — your name, primary email address, Google account identifier, profile picture URL, and locale — as you authorize on Google’s consent screen. Sign-in requests only theopenid,email, andprofilescopes. This information is stored in your Assigned Region.

4.5 Optional Integrations

You may connect Dropbox, Microsoft OneDrive, Google Drive, Google Forms, Google Meet, or Zoom to import content. Integrations are off by default. Each one is connected only when you authorize it on that provider’s consent screen, which shows the access requested and its purpose. We access only the items you select. Access tokens are stored encrypted in Microsoft Azure Key Vault and are deleted when you disconnect the integration. We request the narrowest access each feature needs, and any change to the access we request is reviewed and approved by our Security Officer.

For the Google integrations:

• Google Forms import. We requestforms.body.readonly,forms.responses.readonly, anddrive.metadata.readonly. We read the titles of your forms so you can choose one, then read the questions and responses of the form you select. We do not modify or delete anything in your Google account.
• Google Meet recording import. We requestmeetings.space.readonlyanddrive.readonly, which Google classifies as a restricted scope. We use this access solely to locate and retrieve the meeting recordings you select. We do not browse, index, or retain the wider contents of your Google Drive.
• Google Drive import. We request read-only access and use it solely to retrieve the files you select for import. We do not modify or delete anything in your Google Drive.

Content you import becomes Customer Data: it is stored in your Assigned Region, is never used to train AI models, and can be deleted at any time. You may disconnect an integration from within the Service at any time, or revoke Google’s access from your Google account permissions page. The providers of these integrations are not our sub-processors. Your use of them is governed by their own terms and privacy policies, and we are not responsible for how they handle your data before it reaches the Service.

5. How We Use Your Information

5.1 Purposes

We use the information described above only to:

• provide, operate, and maintain the Service, including AI Interviews;
• create and authenticate your account and keep your session secure;
• process payments, deliver invoices, and send billing notices, including renewal reminders;
• send service notices, such as security alerts, notices of changes to this Policy or our Terms, sub-processor notices, and inactive-account warnings;
• respond to support requests and other communications;
• monitor the Service for security, fraud, abuse, and operational stability;
• understand, using Usage Data only, how features are used so that we can improve them; and
• enforce our Terms of Service and comply with our legal obligations.

5.2 Legal Bases for Processing

Where the GDPR or UK GDPR applies and we act as a controller, we rely on the following legal bases under Article 6:

• Performance of a contract (Article 6(1)(b)) — to create and authenticate your account, provide the Service, process payments, deliver invoices, and provide support.
• Legitimate interests (Article 6(1)(f)) — to keep the Service secure and stable, prevent fraud and abuse, maintain security logs, understand how features are used so we can improve them, and establish, exercise, or defend legal claims. We balance these interests against your rights and freedoms, and you may object as described in Section 9.1.
• Legal obligation (Article 6(1)(c)) — to keep invoices and transaction records under tax and accounting law, and to respond to lawful requests from public authorities.
• Consent (Article 6(1)(a)) — where you connect an optional integration, or where we otherwise ask for your consent. You may withdraw consent at any time. Withdrawal does not affect processing carried out before you withdrew it.

Where we process Customer Data as a processor, the customer determines the legal basis for that processing, and we process it only on the customer’s instructions.

5.3 How We Use Google User Data

Google User Data received through Google Sign-In is used solely to (a) create and authenticate your Evidano account, (b) display your name and profile picture within the Service so you can identify yourself, and (c) send service-related email to the address associated with your Google account.

Google User Data received through the optional Google Forms, Google Meet, and Google Drive integrations is used solely to deliver the feature you connected it for: importing the forms, recordings, or files you select, and transcribing or analyzing them at your direction.

We do not use Google User Data for advertising of any kind, and we do not sell it. We do not use Google User Data — or any data received from Google APIs, including Google Workspace APIs — to develop, improve, train, or fine-tune any generalized or non-personalized artificial intelligence or machine learning model. Our use of Google User Data is limited to providing and improving user-facing features that are prominent in the Service.

5.4 Customer Data and AI Models

We operate our own AI models on Microsoft Azure infrastructure in each Assigned Region. We do not use OpenAI, Anthropic, or any other external AI provider to process Customer Data, and our production network blocks outbound connections to external AI provider endpoints.

We never use Customer Data or Google User Data to train, retrain, fine-tune, evaluate, or otherwise improve AI models. Our model development environments have no access to production data stores, so Customer Data cannot enter our training or evaluation datasets. Our development and testing environments use only synthetic or licensed data. Customer Data is used exclusively to provide the features you request.

5.5 No Automated Decisions About You

The Service produces AI-generated transcripts, analysis, and interview dialogue at a customer’s direction. It does not make decisions about you, and the AI moderator does not make decisions about Research Participants. Customers review and remain responsible for any conclusions they draw from Output.

6. How We Share and Disclose Information

6.1 Our Core Commitments

• We never sell, rent, or trade Personal Data or Customer Data.
• We never use Customer Data or Google User Data to train, fine-tune, evaluate, or improve AI models.
• We never send prompts, uploaded documents, interview content, or analysis output to OpenAI, Anthropic, or any other external AI provider.
• We never share data with advertising networks, data brokers, information resellers, or any third party for marketing purposes.
• We never use Google User Data to determine credit-worthiness or for lending decisions.
• Our personnel have no access to Customer Data. See Section 7.2.

6.2 Sub-processors

We use exactly three sub-processors to deliver the Service. Each is bound by written terms that limit its use of data to providing its contracted service, and we review each one’s independent security attestation every year.

• Microsoft Corporation (Microsoft Azure) — cloud hosting, compute for the AI models we operate, databases, storage, key management, backup, and monitoring. Azure holds Account Data, Customer Data, and Usage Data, all in your Assigned Region. Microsoft also provides our internal workforce sign-in (Microsoft Entra ID) and deployment pipelines (Azure DevOps), which do not store your data. Microsoft Azure is the only sub-processor that holds Customer Data. It provides the hosting environment and does not use your data for its own purposes.
• Stripe, Inc. — payment processing for Paid Plans. Stripe receives your name, email address, and billing details and collects your card or bank details directly. Stripe processes this data in the United States and other countries where it operates. Stripe never receives Customer Data.
• GitHub, Inc. — hosting and review of our source code. GitHub receives no Customer Data, Account Data, or Usage Data about you. We list it for completeness because it forms part of our independently audited system.

We do not use any other sub-processor. In particular, we do not use third-party services for error monitoring, product analytics, or application delivery: those functions run inside our own Microsoft Azure environment in your Assigned Region.

6.3 Other Recipients

Apart from our sub-processors, we disclose Personal Data only to the following, and none of them receives Customer Data from us:

• Your organization, where your account is provisioned or administered by your employer or institution.
• Services you connect yourself, such as Google Sign-In and the integrations in Section 4.5, to the extent needed to make the connection work.
• Our EU and UK representative, DataRep, when you or a supervisory authority contact us through them (Section 11).
• Auditors and professional advisers, such as our independent auditors, penetration testers, and lawyers, under confidentiality obligations, where needed for audits, security testing, or legal advice.
• Public authorities and parties to a business transfer, as described in Sections 6.6 and 6.7.

6.4 Changes to Our Sub-processors

We will notify customers by email or in-product notice before we engage a new sub-processor, and before it begins processing any data. You may object on reasonable data protection grounds. If we cannot resolve your objection, you may terminate the affected Paid Plan as described in Section 12 of our Terms of Service.

6.5 Sharing of Google User Data

We do not transfer or disclose Google User Data to third parties except (i) as necessary to provide or improve user-facing features of the Service, in which case the only recipient is Microsoft Azure acting on our instructions; (ii) to comply with applicable law or valid legal process; (iii) as part of a merger, acquisition, or sale of assets, in which case the recipient will be bound by terms at least as protective as this Privacy Policy; or (iv) with your explicit consent.

We do not transfer or disclose Google User Data for advertising, targeted or personalized advertising, retargeting, credit-worthiness assessment, lending, sale to information resellers or data brokers, or to develop, improve, train, or fine-tune any generalized or non-personalized AI or machine learning model.

6.6 Legal Requests

We may disclose information where we believe in good faith that disclosure is required by law or valid legal process, or is necessary to protect the rights, property, or safety of AILYZE, our users, or others. We review each request for legal validity and disclose only what is required.

Because our personnel have no access to Customer Data, we will ask any authority seeking Customer Data to request it from the customer directly. Where we are legally permitted to do so, we will notify the affected customer before any disclosure so that they can seek to challenge it. We log every legal request we receive, and we will provide a customer with an accounting of disclosures concerning their data on request.

6.7 Business Transfers

If AILYZE is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to confidentiality obligations and continued protection consistent with this Privacy Policy. We will notify you before your Personal Data becomes subject to a materially different privacy policy.

7. Data Security

7.1 Our Safeguards

Our security program is independently audited under the AICPA SOC 2 Type 2 framework for the Security, Availability, Confidentiality, and Privacy criteria. We renew the audit annually, and the current report is available to customers and prospective customers on request under a non-disclosure agreement. Our safeguards include:

• Encryption. TLS 1.2 or higher, with HSTS, for all data in transit. AES-256 encryption at rest using FIPS 140 validated cryptographic modules, with keys held in a separate Azure Key Vault for each region.
• Isolation. Customer Data is logically separated by customer, and automated tests run on every build confirm that one customer cannot reach another’s data. Databases, storage, and key vaults are reachable only over private network connections, with public network access disabled.
• Access control. Multi-factor authentication on all administrative systems, least-privilege role-based access, just-in-time and time-limited administrative elevation that must be approved and is logged, quarterly access reviews, and removal of access within 24 hours of an employee leaving.
• Threat protection. Web application and network firewalls, DDoS protection, rate limiting on sign-in and API endpoints, malware scanning of every uploaded file before processing, continuous vulnerability scanning, and an annual penetration test by an independent firm.
• Monitoring and resilience. Security monitoring and alerting in each region, audit logs kept in tamper-proof storage, deployment across multiple availability zones, daily backups, and regularly tested restore and disaster recovery procedures.
• People. Background checks before access to production systems, written confidentiality agreements, and security and privacy training at hire and annually.

No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. You are responsible for keeping your sign-in credentials secure.

7.2 No Personnel Access to Customer Data

Our systems are built so that our personnel cannot read Customer Data. No employee role grants access to the databases, storage, or key vaults that hold it; only the Service’s own automated processes can read it, to provide the Service to you. There is no emergency (“break-glass”) procedure that gives personnel access, and the Service has no feature that lets our staff view or impersonate a customer’s workspace. Any attempt to grant a person direct access to Customer Data triggers an immediate security alert.

If you choose to send us part of your Customer Data in a support request, that copy is handled as Communications Data and is seen only by the personnel handling your request. When we investigate a suspected security incident or misuse of the Service, we use only Account Data, Communications Data, and Usage Data. We never review your research files, recordings, transcripts, or output.

7.3 Health Information

The Service can process Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) only where we have executed a Business Associate Agreement (BAA) with the customer. Customers must not upload PHI without an executed BAA; our Terms of Service set out the consequences. To request a BAA, contact info@evidano.com. We maintain a BAA with Microsoft covering the Azure services that host the Service.

Customers who process health data or other special categories of personal data under the GDPR or UK GDPR are responsible for having a valid condition for that processing under Article 9 and should put a Data Processing Agreement in place with us.

7.4 Breach Notification

• Where we process Customer Data as a processor, we will notify the affected customer without undue delay after becoming aware of a personal data breach affecting it, and will endeavor to do so within seventy-two (72) hours, so that the customer can meet its own notification obligations. We will provide the information reasonably available to us and assist the customer in notifying regulators and affected individuals.
• Where we act as a controller for Account Data, Usage Data, and Communications Data, we will notify the competent supervisory authority within seventy-two (72) hours of becoming aware of a personal data breach where the GDPR or UK GDPR requires it, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
• In all cases, notifications will describe the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed. We will also meet any additional requirements under HIPAA and United States state breach notification laws.

8. Data Retention, Export, and Deletion

We keep Personal Data only for as long as we need it for the purposes in Section 5, subject to the legal retention exceptions below. Our retention periods are:

• Customer Data you delete. Removed from our production systems immediately, and removed from our encrypted backups within thirty-five (35) days as those backups expire. After that it cannot be recovered.
• Customer Data and Account Data when your account ends. When your account is closed or terminated, your Customer Data remains in our production systems for thirty (30) days so that you can export it. It is then deleted from production and removed from backups within a further thirty-five (35) days. If you want your Customer Data deleted immediately, delete it from within the Service before you close your account. Account Data is deleted on the same timeline, except for records we must keep under the legal retention exceptions below.
• Inactive Free Plan accounts. If a Free Plan account is inactive for twelve (12) consecutive months, we may delete the account and its Customer Data. We will email you at least thirty (30) days beforehand so that you can sign in or export your data first. See Section 5.1 of our Terms of Service.
• Security and audit logs. Kept for one (1) year in tamper-proof storage and then deleted. Because these logs cannot be altered, entries that include your account identifier or IP address are not removed early when you close your account.
• Other Usage Data and telemetry. Kept only as long as needed for troubleshooting, security, and service improvement, and for no longer than one (1) year.
• Communications Data. Kept for as long as needed to resolve your request and maintain a record of it, and deleted when your account is deleted, subject to the legal retention exceptions below.

Export. You can export your Customer Data at any time using the export tools in the Service.

Google access. If you sign in with Google or connect a Google integration, revoking the Service’s access in your Google account settings stops any further access to Google User Data.

Legal retention exceptions. We keep specific records beyond the periods above only where we must, and only for as long as the requirement lasts: invoices and transaction records required by tax and accounting law; records subject to a legal hold, litigation, or a regulatory or law-enforcement request; and records needed to establish, exercise, or defend legal claims. Legal holds are documented and limited to the specific records required. Anything retained on this basis is not used for any other purpose and is deleted when the requirement ends.

9. Your Data Protection Rights

9.1 EEA, United Kingdom, and Switzerland

Subject to applicable law, you have the right to:

• access the Personal Data we hold about you and obtain a copy of it;
• have inaccurate or incomplete Personal Data corrected;
• have your Personal Data erased;
• restrict our processing, or object to processing based on our legitimate interests;
• receive Personal Data you provided to us in a portable format;
• withdraw consent at any time where we rely on consent, without affecting processing carried out before you withdrew it;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions (Section 5.5); and
• lodge a complaint with your local supervisory authority.

9.2 California

In the preceding twelve (12) months, we have collected the following categories of personal information as a business: identifiers (such as name, email address, account identifier, and IP address); customer records and commercial information (such as billing contact details and purchase history); internet or other electronic network activity (Usage Data); and account log-in credentials, which are sensitive personal information. We collect them from you, from your devices, and from sign-in providers you choose to use, for the purposes in Section 5.1. We disclose them for business purposes only to the service providers in Section 6.2 and the recipients in Section 6.3, and we keep them for the periods in Section 8.

California residents have the right to:

• know the categories and specific pieces of personal information we have collected about them, the categories of sources, the purposes for collecting it, and the categories of third parties to whom we disclose it;
• request deletion of their personal information;
• request correction of inaccurate personal information;
• limit the use and disclosure of sensitive personal information. We use it only to provide the Service and for other purposes permitted without a right to limit, so no separate opt-out is offered;
• opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and have not done so in the preceding twelve (12) months. Because we do not sell or share personal information, Global Privacy Control signals do not change how we treat your data;
• opt out of automated decision-making technology used for decisions that produce legal or similarly significant effects. We do not use personal information for such decisions; and
• not be discriminated against for exercising these rights.

You may use an authorized agent to submit a request. We will ask the agent for written permission signed by you and may ask you to verify your identity directly.

9.3 Other United States State Privacy Laws

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island — have rights to access, correct, delete, and obtain a portable copy of their Personal Data, and to opt out of targeted advertising, the sale of Personal Data, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not engage in any of those three activities. Where your state provides a right to appeal a refused request, you may appeal by replying to our decision or writing to info@evidano.com, and we will respond within the period your state’s law allows.

9.4 How to Exercise Your Rights

To exercise any of these rights, contact us at info@evidano.com. Many rights can also be exercised directly in the Service: you can review and correct your Account Data in your account settings, and export or delete your Customer Data at any time. We acknowledge privacy requests within five (5) business days and respond within the period required by applicable law. We may need to verify your identity before acting, and we will use the verification information only for that purpose. Exercising these rights is free unless a request is manifestly unfounded or excessive. These rights are subject to the legal retention exceptions in Section 8.

9.5 Research Participants

If you are an interviewee, AI Interview participant, survey respondent, or other individual whose information appears in a customer’s workspace, we hold that information as a processor on the customer’s behalf, and the customer decides what happens to it. Our personnel cannot access it. Please direct your request or question to the organization that collected your information. If you contact us instead, we will forward your request to that customer without undue delay and assist them in responding.

10. Data Residency and International Transfers

Two regions. The Service runs as two independent deployments on Microsoft Azure: one in the United States (US East) and one in the European Union (West Europe). Each has its own compute, AI models, databases, storage, encryption keys, backups, logging, and monitoring.

Choosing your region. You may select your preferred region before you register. If you do not, we assign your region automatically at registration from your detected location: customers located in the United States are assigned to US East, and all other customers to West Europe. If you use a VPN or otherwise mask your location, you may be assigned a region you did not intend, so please select your region before registering if residency matters to you. Your region is fixed at registration.

What stays in your region. Customer Data — including AI Interview data and all backups — is stored and processed only in your Assigned Region and is never transferred out of it. Backups are kept in the same region, and replication to other regions is disabled. Usage Data, including operational telemetry and security logs, and the Account Data we store are also kept in your Assigned Region.

What may be processed elsewhere. AILYZE is a United States company. The following Personal Data may be processed outside the European Economic Area, the United Kingdom, or Switzerland:

• billing details processed by Stripe, Inc. in the United States and other countries where Stripe operates; and
• Account Data, Usage Data, and Communications Data accessed remotely by our personnel in the United States to provide support, billing, and security.

Transfer safeguards. Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss equivalents, as applicable, or on the recipient’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. These are supplemented by encryption in transit and at rest. Customer Data is never transferred.

11. EU and UK Representative

We have designated DataRep as our representative under Article 27 of the GDPR and Article 27 of the UK GDPR.

European Union

United Kingdom

Either office can also be reached by email at datarep@evidano.com.

Individuals in the European Economic Area and the United Kingdom, and supervisory authorities, may contact our representative on any matter relating to the processing of Personal Data, in addition to contacting us directly at info@evidano.com. You may exercise any of the rights in Section 9 through either route.

12. Age Restriction and Children’s Privacy

Evidano accounts are only for individuals aged 18 or older, and registration requires confirmation of age. We do not knowingly allow anyone under 18 to create an account, and we do not knowingly collect Personal Data directly from children under 13. If you believe someone under 18 has created an account, or that a child has provided us with Personal Data, contact us at info@evidano.com and we will delete the account and the information.

This restriction governs who may hold an account. It does not prevent customers from lawfully conducting research that involves minors, including interviews, provided the customer holds the required parental consents, ethics approvals, and lawful basis. A customer must not invite a child under 13 (or under 16 in the European Economic Area) to an AI Interview without verifiable parental consent. Such Customer Data is governed by Sections 3 and 5.4 like any other.

13. Google API Services — Limited Use Disclosure

Evidano’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Consistent with those requirements, we use Google User Data solely to provide or improve user-facing features that are prominent in the Service; we do not transfer or use Google User Data for serving advertising; and we do not allow humans to read Google User Data unless we have your affirmative agreement, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized. In practice, content imported through Google integrations is Customer Data, which our personnel cannot access (Section 7.2). We do not use Google User Data — including data obtained through any Google Workspace API — to develop, improve, or train generalized or non-personalized AI or machine learning models. We review our compliance with these requirements annually.

14. Data Processing Agreement and Business Associate Agreement

For customers subject to the GDPR, the UK GDPR, the CCPA/CPRA, or another law that requires written terms with a processor or service provider, our standard Data Processing Agreement is available on request at info@evidano.com. It incorporates the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum where they apply, sets out the security measures described in Section 7, and includes the sub-processor notification and objection rights described in Section 6.4.

Customers covered by HIPAA can request our Business Associate Agreement at the same address (see Section 7.3). Where an executed DPA or BAA conflicts with this Policy, the executed agreement governs for the processing it covers.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will update the effective date at the top of this page and notify you by email or through a notice in the Service at least thirty (30) days before the change takes effect, unless a change must take effect sooner to comply with law. If you do not accept a change, you may export your data and close your account before it takes effect, as described in Section 8. Your continued use of the Service after the effective date means the revised Policy applies to you.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, or wish to exercise any of your rights, please contact us. We acknowledge privacy inquiries and complaints within five (5) business days and resolve them within the period applicable law allows. Our Privacy Officer is responsible for this Policy.