Privacy Policy

Scope of This Policy

This Privacy Policy applies to EvaNeT websites, applications, and related services (collectively, the "Services"). EvaNeT is operated by EvaNeT.ai. This policy explains how we collect, use, and protect information when you use our platform as a donor, organization administrator, or visitor.

Information We Collect

Information You Provide

• Account Information: Name, email address, password, and organization details when you create an account
• Donation Information: Payment details, billing address, donation amounts, and designation preferences when you make a donation
• Organization Information: Tax ID, organization name, address, banking details for payment processing
• Event Information: Event details, ticket purchases, and attendance records
• Communications: Messages, support requests, and feedback you send us

Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, and time spent on the platform
• Device Information: IP address, browser type, operating system, and device identifiers
• Cookies: Session cookies for authentication and analytics cookies for platform improvement

Email & Inbox Data

When you connect a mailbox to our Inbox product, we access and store the following:

• Email Headers: From, to, subject, date, and message identifiers necessary to display and organize your inbox
• Email Bodies: Message content, encrypted at rest with per-mailbox envelope encryption
• Attachments: Files attached to emails, encrypted at rest alongside their parent messages
• Mailbox Metadata: Folder structure, labels, and read/unread status to maintain sync state

How We Use Your Information

• Provide Services: Process donations, sync email, manage events, and deliver platform features
• Email Features: Display your inbox, sync messages across devices, and perform actions you request (read, archive, send, label)
• AI-Powered Features (with consent): When enabled per mailbox, we use AI to summarize emails and suggest replies. These features are opt-in and can be disabled per mailbox at any time.
• Improve the Platform: Analyze usage patterns to enhance user experience and develop new features
• Communicate: Send transaction confirmations, important updates, and (with consent) marketing communications
• Security: Detect fraud, prevent abuse, and protect the integrity of our platform
• Compliance: Meet legal obligations including tax reporting and anti-money laundering requirements

Google API Data (Gmail and Calendar)

If you choose to connect your Google account, we access and process certain information from Google APIs to provide features such as email workflows and calendar syncing. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access

• Account: Basic profile and email address to identify the connected Google account
• Gmail: Email message metadata and content to display your inbox and perform actions you request (e.g., read, label, archive, trash, send)
• Google Calendar: Calendars and events to display, create, update, and delete events you request

What we store

• Encrypted tokens: Access and refresh tokens are stored encrypted so we can maintain your connection
• Email headers: From, to, subject, date, and message IDs for inbox display and sync
• Email content: We store message content, snippets, and provider payloads to provide Inbox features. Decoded message bodies use application-level envelope encryption. Access to stored content is limited to authorized features and users.
• Calendar event cache (feature-dependent): For certain features (for example, household sharing and automations), we may cache calendar event fields (such as title, time range, description, location, and an event link) so the feature can run reliably

Limited Use commitments

• We use Google API data only to provide and improve user-facing features you’ve requested
• We do not sell Google API data, and we do not use it for advertising or marketing profiling
• We do not allow humans to read your Google API data except as needed for security, fraud prevention, compliance, support you request, or to comply with law
• You can disconnect Google at any time, which stops further access

Scribe by EvaNeT & Scribe Companion

Scribe by EvaNeT is our local-first meeting assistant, and Scribe Companion is its optional browser extension for Google Meet. They follow the same principle: your conversations stay on your device.

What Scribe processes on your device

• Meeting audio and transcripts: captured, transcribed, and summarized on your computer. Recordings, transcripts, summaries, and the people/entity graph are stored in a local database on your device — not on our servers — unless you explicitly enable cloud features.
• Calendar data (if connected): used on-device to match recordings to scheduled meetings and attendee names, under the Google API commitments above.

What Scribe Companion collects

• Google Meet captions: while you are in an active Meet call with captions enabled, the extension reads the caption text and speaker display names shown in the browser tab.
• Where that data goes: only to the Scribe app on the same computer (via 127.0.0.1 loopback). The extension makes no other network requests. No audio, captions, transcripts, or analytics are sent to EvaNeT or any third party by the extension.
• What it never does: no advertising, no tracking, no sale or sharing of meeting content, no training of models on your meetings, and no human review of your captions or transcripts.

Your controls

• You can delete any meeting (recording, transcript, and summary) at any time from within the app.
• You can rename, merge, or delete individual people in the identity graph; deleting a person removes their entity links without touching meeting content.
• You can disconnect the extension at any time by removing it from your browser; the app works without it.

AI Processing & Consent

Some Inbox features use AI to help you manage your email more efficiently. AI processing is subject to your explicit consent and is managed at the individual mailbox level.

What AI features process

• Email Summarization: After you opt in, eligible new messages received after consent may be processed in the background to prepare thread summaries before you open them
• Suggested Replies: After you opt in, eligible new messages received after consent may be processed in the background to prepare suggested reply text

How consent works

• Per-mailbox opt-in: AI processing is off by default for each connected mailbox. You must explicitly enable it per mailbox in your Inbox settings.
• Revocable anytime: You can disable AI processing for any mailbox at any time. Disabling stops all future AI processing for that mailbox.
• Artifact cleanup: Revoking AI consent removes generated assistance (summaries and suggested replies) and uncorrected AI-derived thread analyses for that mailbox. Deterministic routing records and corrections you made remain.
• Defense-in-depth: Even when AI consent is enabled, additional server-side gates verify consent before any AI request is processed.

What we do NOT do with AI

• We do not train AI models on your email content
• We do not use your email data to improve AI models for other users
• We do not allow human review of your email content for AI training or quality purposes
• We do not share your email content with AI providers except as necessary to process your requests (see Vendor Subprocessors below)

Information Sharing

We share information only in these limited circumstances:

• With Organizations: When you donate, the receiving organization receives your name, email, donation amount, and any information you choose to share
• Payment Processors: Stripe processes all payments and receives necessary payment information
• Service Providers: Vetted providers who help us operate (hosting, analytics, support) under strict confidentiality agreements
• Legal Requirements: When required by law, court order, or to protect rights and safety

We never sell your personal information to third parties.

Vendor Subprocessors

We use the following subprocessors to deliver our services. All subprocessors are bound by data processing agreements and confidentiality obligations.

• Anthropic: AI model provider for email summarization and reply suggestions after per-mailbox consent is enabled
• MiniMax and Kimi (Moonshot AI): AI model providers for other EvaNeT features; the Inbox does not send email content to them for mail assistance
• Stripe: Payment processing
• Resend: Transactional email delivery
• Cloudflare: CDN, DDoS protection, and DNS services

Anthropic receives the sender, subject, and relevant text for eligible new mail after you enable AI assistance for that mailbox. Team mail may also include related client and trip context. Existing mail is not analyzed retrospectively. Anthropic does not use this content to train its models.

Donor Data & Organization Responsibilities

Organizations using EvaNeT for Nonprofits are data controllers for their donor information. We process this data on their behalf as a data processor. Organizations are responsible for:

• Obtaining appropriate consent from donors
• Responding to donor data access and deletion requests
• Using donor data in compliance with applicable laws
• Maintaining their own privacy policies that govern donor relationships

Data Security

We implement robust security measures to protect your information:

• TLS encryption for all data in transit
• AES-256-GCM envelope encryption for email bodies and attachments at rest
• Per-mailbox data encryption keys (DEKs), wrapped by a platform key encryption key (KEK)
• Email bodies and attachments are decrypted only during active pipeline processing and re-encrypted immediately afterward
• Regular security audits and penetration testing
• SOC 2 Type II compliance practices
• Limited access controls and audit logging
• PCI DSS compliance for payment processing (via Stripe)

Data Retention

We retain data only as long as necessary for the purposes described in this policy or as required by law. Specifically:

• Donation Records: 7 years for tax and compliance purposes
• Account Information: Until you delete your account, plus 30 days
• Email Data (active mailbox): Retained while your mailbox connection is active. Email headers, bodies, and attachments are stored for the duration of the connection to provide inbox features.
• Email Data (disconnected mailbox): The "delete" option removes the mailbox and its stored email data. The "preserve" option keeps stored data until you choose deletion or request account data deletion.
• AI-Generated Artifacts: Summaries and suggested replies are deleted immediately when AI consent is revoked for a mailbox
• Usage Analytics: Aggregated and anonymized after 2 years
• Support Communications: 3 years from resolution
• Integration Tokens: Stored encrypted until you disconnect the integration (or as needed to keep the connection active)
• Integration Feature Caches: Retained as needed to provide the feature (for example, calendar event caches for sharing/automation) and subject to periodic cleanup and deletion when you disconnect

Your Rights & Controls

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate or incomplete information
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing activities
• Restriction: Request limited processing in certain circumstances
• Withdraw Consent: Where processing is based on consent

Self-Service Controls

You can exercise several data rights directly within the platform:

• Disconnect a mailbox: Go to Inbox Settings, select a mailbox, and choose "Disconnect." You can choose between "Preserve" (keep stored data) or "Delete" (permanently remove all stored email data).
• Manage AI consent: In Inbox Settings, toggle AI processing on or off for each connected mailbox. Disabling AI consent immediately stops processing and deletes AI-generated artifacts for that mailbox.
• Export your data: Use the Data Export feature in Account Settings to download your account data, including email metadata (headers, folder structure, labels), in a machine-readable JSON format. For full email content export, use your mail provider's native export tools.
• Manage integrations: Disconnect Google, calendar, or other integrations at any time from your Integration Settings.

For requests not covered by self-service controls, contact us at [email protected].

California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal information we collect and how it's used
• Right to delete personal information
• Right to opt-out of sales (we don't sell personal information)
• Right to non-discrimination for exercising your privacy rights

European Privacy Rights (GDPR)

For users in the European Economic Area, United Kingdom, or Switzerland, we process personal data based on:

• Contract: To provide services you've requested
• Legitimate Interests: To improve and secure our platform
• Consent: For optional marketing communications
• Legal Obligation: For compliance requirements

Data may be transferred to the United States with appropriate safeguards including Standard Contractual Clauses.

Cookies & Tracking

We use cookies for:

• Essential: Authentication, security, and core functionality
• Analytics: Understanding how users interact with our platform
• Preferences: Remembering your settings and choices

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

Children's Privacy

EvaNeT is not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy and revising the "Last updated" date. For significant changes, we may also send email notifications.

Contact Us

For privacy-related questions or to exercise your rights, contact us:

• Email: [email protected]
• General Support: [email protected]

We aim to respond to all privacy inquiries within 30 days.