1. Who we are and how to contact us
This policy explains how Eviven collects and uses personal data when you visit eviven.com, request access, sign in, or use the Eviven app. Eviven (company registration in progress). Registered company details will be published here once available.
For any privacy question or request, email privacy@eviven.com. We reply within one month.
2. Our role
Eviven is the controller for the personal data it needs to run the website, handle access requests, manage accounts and sign-in, keep the service secure, and communicate with customers.
For content your organisation adds to its workspace (documents, requirements, tasks, notes, customer and site records, photos, service reports and Assistant conversations), Eviven acts as a processor on your organisation's behalf. Your organisation is the controller for that content, and our processing follows its instructions under a data processing agreement, which we provide on request.
3. Personal data we collect
Depending on how you interact with us, we process:
- Access requests: your name, business email, optional phone number, how you heard about us and your message.
- Account and sign-in: your email address, your role and workspace membership, and sign-in events. Each sign-in code is stored only as a one-way hash, expires after 10 minutes and works once. To limit repeated wrong codes we keep one-way hashes of your email address and IP address for up to one day.
- Workspace content: whatever your organisation chooses to upload or write, which may include names and contact details of people at customers, suppliers and sites.
- Voice features: when you choose to speak to the Assistant or dictate a note, your recording is sent to our speech provider to be turned into text. We keep the resulting text, not the recording. Spoken replies are generated only when you ask for them.
- Technical data: IP address, browser and device information and security logs, used to deliver the service and protect it from abuse. For access requests we store a keyed hash of your IP address for a short period to prevent spam.
- Settings stored on your device, such as light or dark appearance and your preferred Assistant voice. These stay in your browser and are not sent to us.
4. Why we use it and our legal bases
We use personal data only for these purposes, under the EU General Data Protection Regulation (GDPR):
- Replying to your access request and deciding whether to invite you: taking steps at your request before a contract (Article 6(1)(b)) and our legitimate interest in running our business (Article 6(1)(f)).
- Providing the service, your account and sign-in: performance of our contract with your organisation (Article 6(1)(b)).
- Keeping the service secure, preventing abuse and fixing problems: our legitimate interest in a safe and reliable service (Article 6(1)(f)).
- Keeping accounting and other records we are required to keep: legal obligation (Article 6(1)(c)).
- We do not send marketing emails without your consent, and we do not sell personal data.
5. AI features
Eviven uses AI to read the documents your organisation selects, compare them with customer requirements, and answer questions in the Assistant. The AI receives only the excerpts and context needed for each task.
AI results are suggestions. A person in your organisation reviews and decides; Eviven does not make decisions about you that have legal or similarly significant effects based solely on automated processing. Any change the Assistant prepares waits for your confirmation.
We do not use your content to train AI models, and we use AI providers under business terms that do not allow them to train their models on it.
6. Who we share it with
We share personal data only with service providers that process it for us under written agreements, and only as needed to run Eviven:
- Supabase: database, private file storage and sign-in.
- Vercel: hosting of the website and app, and routing of AI requests.
- OpenAI: AI analysis of selected document excerpts and Assistant answers.
- xAI: speech-to-text and text-to-speech for voice features.
- Resend: delivery of sign-in codes and service emails.
7. Transfers outside the EU/EEA
Our app runs in the EU (Frankfurt). Some of the providers above are based in the United States and may process data there. When personal data leaves the EU/EEA, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the relevant safeguards.
8. How long we keep it
We keep personal data only as long as needed:
- Access requests: 12 months, then deleted automatically.
- Sign-in codes: valid for 10 minutes and usable once. Records used to limit wrong codes are deleted within a day.
- Assistant conversations: kept for 90 days, then deleted. You can clear them sooner in Settings.
- Account data: for as long as your account exists, then deleted, except where we must keep records by law.
- Workspace content: for as long as your organisation keeps it or its agreement with us continues. Deleted content is also removed from backups as they expire on their regular schedule.
- Accounting records: as long as Swedish law requires, currently seven years.
9. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to our processing, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.
To use these rights, email privacy@eviven.com. For workspace content, we will pass your request to the organisation that controls it and help it respond.
You can also complain to a data protection authority. In Sweden this is Integritetsskyddsmyndigheten (IMY, imy.se); you can also contact the authority where you live or work.
11. Security
We protect personal data with encryption in transit, private file storage, separation between workspaces, role-based access and regular backups. No system is completely secure, and we will notify affected customers and authorities of a personal data breach as the law requires.
12. Changes to this policy
We will update this page when our processing changes and show the date of the latest version at the top. For material changes, we will also tell customers by email before the change takes effect.