Privacy Policy
Last updated: 2 September 2026 · In force
This policy explains how Evda (“we”, “us”) collects, uses, stores, shares and deletes personal data — on our website at evda.ai and inside the Evda application at app.evda.ai.
Evda is a compliance workspace for regulated financial businesses in the EU. Our customers are companies — electronic money institutions, payment service providers and crypto-asset service providers. Their compliance analysts use Evda to run Know Your Business (KYB) and Enhanced Due Diligence (EDD) checks on the companies and people they onboard.
1. Our two roles
We handle personal data in two distinct capacities, and your rights differ depending on which applies:
- Controller. For our website, sales enquiries, and the accounts of the individual analysts who log in to Evda, we decide why and how data is processed. This policy governs that processing.
- Processor. For the case files, documents and third-party information our customers upload into the product, the customer is the controller and we act only on their documented instructions under a Data Processing Agreement. If you are the subject of a due-diligence case, address your requests to that customer; we will assist them.
2. Data we collect
2.1 Website and sales
When you contact us or request a demo we collect the name, work email address, company name and the content of your message. We also collect basic technical data — IP address, browser and device type, pages viewed — to keep the site secure and understand how it is used.
2.2 Your Evda account
When your employer creates an account for you we hold your name, work email address, profile picture, role and permissions within your organisation, and security data: password hash or federated identity, multi-factor authentication secrets, session records, and an audit log of actions you take in the product (who ran a scan, who approved a case, when).
2.3 Data our customers put into the product
Compliance cases contain corporate records, registry extracts, identity and ownership documents, contact details of directors and beneficial owners, screening results and analyst notes. We process this only to provide the service to the customer that uploaded it.
2.4 Data from your Google Account
Evda uses Google APIs in three separate places. Each is a separate consent, each is optional except sign-in, and each may be withdrawn on its own. We explain them individually in section 3.
3. Google user data — what we access and why
The table below lists every Google OAuth scope Evda requests, exactly what it gives us, and what we do with it. We request no other scopes.
| Scope | What we receive | What we do with it |
|---|---|---|
openidemailprofile |
Your Google account identifier, email address and whether Google has verified it, your display name and profile picture URL. | Create and authenticate your Evda account. Nothing else. |
calendar.events |
Permission to create and manage calendar events on the primary calendar of the account you connect. | Create the specific Google Meet call you ask the assistant to schedule with the parties to a case. |
drive.file |
Access limited to the individual files you select in the Google Picker. The rest of your Drive stays invisible to us. | Download the file you picked and file it into the case as a document or chat attachment. |
3.1 Signing in with Google
Signing in requests only openid, email and profile. We use the Google account identifier to recognise you on return visits, your email address to identify your account and send service notifications, and your name and picture to display you to colleagues inside your organisation’s workspace. Sign-in never requests access to your Calendar or your Drive.
3.2 Google Calendar
Connecting Calendar is optional and is done deliberately, per user, on Settings → Integrations. It requests one scope, calendar.events.
We use it for a single purpose: when you instruct the AI assistant to schedule a call with the parties to a case, and you confirm the proposed time, title and attendee list on screen, we create that event on your primary calendar with a Google Meet link attached, and let Google send the invitations. We record the resulting event identifier, Meet link, title, start time and attendee addresses against the case so the call appears in the case timeline.
We do not read your calendar. We do not list, index, analyse or store your existing events, your availability or your other meetings. We create only events you have explicitly confirmed.
3.3 Google Drive
Connecting Drive is optional and separate from Calendar. It requests one scope, drive.file — a narrow permission that grants access only to files you personally select in Google’s own file picker. Google returns an error if we request any file you have not picked, so the remainder of your Drive is inaccessible to us by design. We deliberately did not request drive.readonly or any broader permission.
When you pick a file, we download that file once and store a copy as a case document or chat attachment inside Evda, exactly as if you had uploaded it from your computer. Google Docs, Sheets and Slides are converted to PDF or XLSX during import. To display the picker, a short-lived access token limited to drive.file is passed to your browser for the duration of that picker session; it is the only Google token that ever leaves our servers.
We do not browse, search, index or scan your Drive. We do not create, modify or delete anything in your Drive.
3.4 Limited Use
Evda’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The same commitment applies under the Google Workspace user data and developer policy to data derived from sensitive and restricted scopes.
Concretely: we use Google user data only to provide and improve the features described above; we do not transfer it to others except as needed for those features, for security purposes, or to comply with the law; we do not use it for advertising of any kind; we do not sell it; and no human reads it except where you have given us documented explicit consent to view specific data, where it is necessary for security, or where the law requires it. We will not transfer Google user data to a successor or acquirer without first obtaining your explicit prior consent.
3.5 We do not train AI on your Google data
Data obtained through Google APIs is never used to develop, improve or train non-personalized artificial intelligence or machine learning models. A document you import from Drive is processed by our AI features exactly like any other case document — read at the moment of analysis to produce findings for your case, and never retained by the model provider for training (see section 5).
4. Why we process data, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service to your organisation | Performance of a contract |
| Authentication, security, fraud and abuse prevention, audit logging | Legitimate interests; legal obligation |
| Calendar and Drive connections | Your consent, given per integration and withdrawable at any time |
| Responding to sales enquiries | Legitimate interests; steps prior to a contract |
| Service notifications and billing | Performance of a contract |
| Meeting our own legal and regulatory duties | Legal obligation |
5. Artificial intelligence
Evda uses large language models to read case documents and draft findings for the analyst. Document text is sent to our AI provider at the moment of analysis and is not retained by that provider or used to train its models. Model output is always a draft: a human analyst reviews and decides. Evda makes no decision producing legal or similarly significant effects on any person by automated means alone (GDPR Art. 22).
6. Who we share data with
We do not sell personal data and we do not share it for advertising. We disclose it only to:
- Sub-processors — a short list of vetted providers who process data on our instructions under contract. They are named on our Sub-processors page, which we keep current and give customers notice before changing.
- Your own organisation — colleagues in your workspace see your name, picture and the actions you take, as their permissions allow.
- Authorities — where we are legally obliged to disclose, and only to the extent required.
- A successor — if the business is acquired or reorganised, subject to this policy continuing to apply. Data obtained through Google APIs is transferred only with your explicit prior consent.
7. Where data is stored and how it is protected
Evda runs on Amazon Web Services in the European Union (Frankfurt, eu-central-1). Data is encrypted in transit with TLS and at rest.
Google refresh tokens receive additional protection: each is encrypted with AES-256-GCM under a key held only by our application before it is written to the database, and each integration uses a separately derived key. Google access tokens are never written to disk — they are obtained on demand and held in memory only for the request that needs them.
Further measures include role-based access control within each customer workspace, isolation of each customer’s data, multi-factor authentication, an immutable audit log, least-privilege access for our staff, and monitoring. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
8. How long we keep data
- Account data — for as long as your account exists, then deleted or anonymised.
- Customer case data — for the term of the customer’s subscription. On termination we return or delete it in line with the DPA. Customers may need to retain records longer to satisfy anti-money-laundering law; that retention period is theirs to set.
- Google Calendar and Drive connections — until you disconnect them, or until your account is deleted.
- Files imported from Drive — these become case documents and follow the customer’s case-data retention above. Disconnecting Drive stops future imports; it does not remove documents already filed into a case, which the customer may need for its own compliance records. Ask your workspace administrator to delete a specific document.
- Calendar events we created — the event lives in your Google Calendar and is yours to delete there. We keep our record of it with the case.
- Audit logs — retained as required for security and regulatory purposes.
- Sales enquiries — up to 24 months from our last contact.
9. Withdrawing access and deleting your data
9.1 Disconnect Calendar or Drive inside Evda
Open Settings → Integrations and select Disconnect on the Google Calendar or Google Drive card. We revoke the token with Google and delete the stored connection, including the encrypted refresh token, immediately. Each integration disconnects independently, and disconnecting either one does not affect your ability to sign in.
9.2 Revoke access from your Google Account
You can revoke Evda’s access at any time, directly at Google, at myaccount.google.com/permissions. Select Evda and choose Remove access. Our stored tokens stop working at once and the affected features stop until you reconnect. When we detect that access has been revoked, we delete the stored connection and its encrypted refresh token, in the same way as if you had disconnected inside Evda.
9.3 Delete your account
Ask your workspace administrator to remove your account, or write to nik@evda.ai and we will act on your request within 30 days. On the same request and within the same period we will delete a specific document you name, including one imported from Google Drive. Deleting an account removes your profile, your integration connections and their tokens, and your sessions. Case data belonging to your organisation remains under that organisation’s control; a customer may request full deletion of its workspace at any time.
10. Your rights
Under the GDPR you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting processing already carried out.
Write to nik@evda.ai. We respond within one month. If your request concerns case data uploaded by one of our customers, we will direct it to that customer, who is the controller. You also have the right to complain to your national data protection authority.
11. Cookies
We use cookies that are necessary to run the service — keeping you signed in, protecting against cross-site request forgery, and balancing load. Details are on our Cookie Notice.
12. Children
Evda is a business tool. It is not directed at children and we do not knowingly collect data from anyone under 16.
13. Changes to this policy
We may update this policy. The date at the top always reflects the current version. If a change materially affects how we handle your data — in particular any change to the Google scopes we request or how we use Google user data — we will notify affected users by email or in the product before it takes effect.
14. Contact
Questions, requests or complaints about privacy: nik@evda.ai.