Privacy Policy

This policy explains what Chen Luborets (pre-incorporation) ("Evoliv", "we") collects when you visit evolivcore.com and its subdomains or use Project AIDR, why, who processes it on our behalf, how long it is kept and the rights you have. Evoliv is not yet incorporated; until it is, the person named above is the controller of this data.

In short: our websites run no tracking or analytics scripts and set no cookies for analytics or advertising. Our public pages run no script at all, with one exception: the Project AIDR page runs a single script of our own, solely for its live demonstration. That script runs entirely in your browser, the page's security policy prevents it from contacting any server, and it stores nothing. The console and sign-in pages are web applications and run our own code to work; none of it tracks you. We measure traffic on our own servers, without tracking you across sites, and we never sell personal data.

Visiting our websites. Like any web server, ours receive your IP address, the page requested, the referring page and your browser's user-agent string. We use them to deliver pages, keep the service secure and count usage (see Analytics).

Your account. Your email address, name, sign-in credentials (a password, stored only as a hash, and the public keys of any passkeys you register) and session records, including a one-way hash of your browser's user-agent string so we can recognise devices you have signed in from.

Your organisation and its verification. The organisation's legal name and registration details, contact names, emails and phone numbers, and — when you apply for verification — the identity and company documents you submit. These fields are encrypted in our database with keys held in a hardware-backed key service.

Your agents. Agent identifiers, public keys, the credentials we issue and their revocations. A tamper-evident audit log records changes; it holds identifiers and hashes, not your contact details.

Payments. Payments are handled by Stripe. Your card details go directly to Stripe and never reach our servers. We keep the Stripe customer and subscription identifiers, and your plan and billing status. Stripe processes payment data under its own privacy policy.

Emails. Account and security emails (address confirmation, password resets, verification outcomes, billing notices) are sent through Amazon Simple Email Service.

Support requests. What you write to us from the console: the subject, your messages, the category and, if you choose one, the agent it concerns, with our replies. They are encrypted in our database. Our support staff read them to answer you; in your organisation, the person who opened a request, its admins and auditors can read it, and billing members can read billing requests.

We count page views, downloads and the steps of signing up — for example, account created, organisation created, verification submitted, first agent enrolled — to learn what works and where people get stuck. All of it is recorded on our servers and sent to our analytics provider, PostHog, from there. No analytics code runs in your browser and no cookie is set.

• Your IP address is not sent to PostHog.
• To count unique visitors without cookies, we derive a pseudonymous identifier from your IP address and user-agent with a secret that changes every day and is then discarded, so a visit cannot be linked to the next day's or traced back to you.
• Sign-up steps are recorded against a pseudonymous account identifier, never your name or email.
• We keep analytics events for no longer than 12 months.

We share personal data only with providers that run parts of our service, under contracts that limit them to our instructions:

• Amazon Web Services (United States) — hosting, storage, backups, encryption keys and email.
• Stripe — payments and billing.
• PostHog (United States) — analytics, as described above.
• Cloudflare — domain name service (DNS) for our domains.

We may also disclose data where the law requires it. Our servers are in the United States. Where the law that protects your data (for example in Israel, the EEA or the UK) restricts transfers abroad, we rely on the safeguards these providers offer, such as the European Commission’s Standard Contractual Clauses.