Privacy Policy

1. Data controller

The controller of your personal data is Walter Martín Lopes, with tax ID 45134320V and registered address at Calle Badajoz 2, 3º Derecha, 10400 Jaraíz de la Vera (Cáceres), Spain.

For any question regarding the protection of your data, you can write to us at contacto@evyagent.com.

2. Data we process

If you only visit the site or write to us: name, email address, company, phone number and the content of your message, plus the technical browsing data strictly necessary to provide the service.

If you subscribe to Evy, we also process: your account data (email, name and, if you sign in with Google, the basic data of that profile); the business data you give us (name, country, time zone, sector); billing data, which is collected and held by our payment provider; the content of what you discuss with your assistant and the files you hand it; the activity summaries, calendar and file listing your server reports so we can show them in the panel; technical connection data such as your IP address and browser, which we keep in the activity log for security; and the date you accepted the terms and the privacy policy when subscribing and the version you accepted, which we keep with your subscription at our payment provider as proof of that acceptance.

There are two things we never see: the credentials of the channels you connect (they travel encrypted from your browser to your server, and only it can open them) and the content of your backups (they are encrypted with your recovery phrase before leaving your server).

We use no analytics cookies, no tracking tools and no advertising profiling. We do not process special categories of data or data from minors.

3. Purposes and legal basis

To provide the service you subscribed to: creating and maintaining your server, running your assistant, showing you its activity in the panel and supporting you. The legal basis is performance of the contract.

To answer your enquiries and contact requests, on the basis of your consent and of pre-contractual measures taken at your request.

To manage the waiting list and let you know when the product launches, on the basis of your consent.

To keep the service secure, detect abuse and keep a record of sensitive actions, on the basis of our legitimate interest in protecting the service and its users.

To comply with our legal obligations, in particular tax and accounting ones.

4. Data retention

We keep your account data and the content of your server for as long as your subscription lasts. If you cancel, we delete your server, its data and its backups on the last paid day; if you withdraw within 14 days of your first payment, we do so in the following hours; if the subscription ends for non-payment, we do so 10 days later. Until you delete your account, we keep your sign-in details (email and name) and your account history in the panel (your plan, billing and the activity log), so you can see your invoices or subscribe again. If you delete your account, we delete your sign-in details and your assistant stops working at that moment; we delete your server, its backups and your account history in the following hours. We keep the security log of the sign-ins to your account (your email, the IP address, the browser and failed sign-in attempts) for up to 12 months, also after you delete your account, to protect the service; then it is erased.

Your conversations with the assistant go straight to your server and do not pass through our systems, except short notes of what your assistant does (such as "quote created") that your server sends us for the activity log. The pages your assistant publishes, and anything saved from them, pass through our systems only while they are being delivered and are not stored there.

Invoices, billing data and the proof that you accepted the terms are kept by our payment provider for the periods required by tax and accounting rules, also after you delete your account. If you need an invoice, write to us. Once no longer necessary, they are securely erased.

5. Recipients and processors

We do not sell your data, nor do we hand it to third parties for their own use. To provide the service we rely on the following providers, each with its own role:

Hetzner Online GmbH (Germany): hosts the private server where your assistant and its data live.

Supabase, on Amazon Web Services infrastructure (Frankfurt, Germany): central database and storage for backups and files in transit.

Vercel: hosts and runs this website and the panel. Functions execute in Frankfurt.

Stripe: processes payments and refunds and handles invoices and the associated tax data.

Resend: sends the service emails (sign-in, usage warnings, alerts).

Google: sign-in with Google if you choose it, anti-fraud protection on the sign-in form, and the cloud services that generate the encryption keys and create your server.

OpenRouter and the AI model provider you choose: they receive the text of every query your assistant needs to answer. See the next section.

GitHub: distributes the images of the software running on your server and the content of the skills you install.

Each provider processes data according to our instructions and to its own data processing terms.

6. International transfers and use of AI models

Your server, the central database and your backups are in the European Union.

There is one important exception we want you to know about: for your assistant to answer you, the text of the conversation and whatever you ask it to work on are sent to the AI model provider you have selected. Most of those providers sit outside the European Economic Area. We ask them not to use that content to train their models, but the transfer does happen and we cannot guarantee that inference takes place inside the European Union.

Some of our providers (payments, email, Google services) are US companies or may process data outside the European Economic Area. In those cases the transfer relies on an adequacy decision or on the standard contractual clauses approved by the European Commission.

If you connect your assistant to a messaging channel (WhatsApp, Telegram and the like), the conversations you hold there are also governed by that platform's own terms, which are independent from us.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to contacto@evyagent.com, proving your identity.

From the panel you can also download a copy of your data and delete your account and your server at any time.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

Your server's disk is encrypted, so its contents cannot be read if someone steals or copies the machine. We manage that key so we can recover your assistant without bothering you, which means our infrastructure can access the data while it is running: we would rather tell you than promise otherwise.

Backups and exports are different: they are encrypted with your 12-word recovery phrase before leaving your server. If you lose it, nobody can open them, not even us.

The credentials of the channels you connect travel end-to-end encrypted from your browser to your server, with no way for us to read them.

Communication between our systems and your server is authenticated with per-customer certificates. We review these measures periodically.

9. Changes to this policy

We may update this policy to reflect regulatory or service changes. The version in force will always be published on this page, with its update date.

10. Contact

If you have any question about this policy or about how we process your data, write to us at contacto@evyagent.com.