How we handle your data, in plain English.

EvenX Ltd is the data controller for personal data collected through our website (evenx.co.uk) and our platform. We are a company registered in England & Wales under number 16776145 and registered with the Information Commissioner's Office under reference ZC170755.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

When you visit the website

• Basic technical information such as your device, browser and IP address
• Pages visited and general usage patterns, in aggregate form
• Information you submit via our contact or careers forms

When you use the platform

• Account information: your name, work email, and organisation
• Authentication data (managed on our behalf by Clerk)
• Event data you or your team create in your workspace
• Files and attachments you upload
• Communication records within the workspace
• Usage data such as feature interactions and audit events
• Billing information (processed by Stripe; we do not store full card details)

When you apply for a job

• Your name, contact details, department of interest and any links you share
• The content of your application message

• To provide, secure and improve the EvenX platform
• To communicate with you about your account, updates and support requests
• To process payments and manage subscriptions
• To respond to enquiries submitted through our website
• To evaluate job applications and manage recruitment
• To meet legal and regulatory obligations
• To analyse aggregate usage patterns and improve product decisions

We do not sell your personal data. We do not use your event data or content to train third-party AI models.

• Contract. To provide EvenX to you and administer your subscription.
• Legitimate interests. To secure our systems, understand how the product is used, prevent fraud, and communicate about your account.
• Consent. For optional communications such as newsletters, where requested. You can withdraw consent at any time.
• Legal obligation. Where processing is required by law, such as responding to regulator requests.

We share personal data only with the subprocessors necessary to deliver EvenX. Each subprocessor is bound by a data processing agreement and appropriate security controls.

• Supabase (AWS). Database and file storage. UK (London).
• Vercel. Application hosting and CDN. UK / EU.
• Stripe. Payment processing and billing. US, under UK/EU DPA.
• Clerk. Authentication and identity. US, SOC 2 Type II.
• OpenAI. Powers Eva AI features. US, DPA available. Content is not used to train foundation models.
• Resend. Transactional email delivery. US.

We may also disclose personal data if required by law, regulation or valid legal process, or to protect the rights, property or safety of EvenX, our customers or others.

Primary data storage is in the United Kingdom. Certain subprocessors listed above may process data outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards including the UK International Data Transfer Agreement (UK IDTA) or the EU Standard Contractual Clauses, as applicable.

• Account and workspace data. For as long as your account is active, and up to 30 days after termination, at which point it is deleted. Encrypted backups are purged within the 30-day rolling backup window.
• Authentication logs. 90 days (via Clerk).
• Billing records. For as long as required by UK tax and accounting law (typically 6 years).
• Contact form submissions. Up to 24 months, unless a longer retention is necessary to serve you.
• Job applications. 12 months from receipt, then deleted unless you ask us to keep them for future roles.

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to erase your data ("right to be forgotten")
• Restrict or object to certain kinds of processing
• Receive a portable copy of your data
• Withdraw consent where processing is based on consent

To exercise any of these rights, email info@evenx.co.uk. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Our website uses a minimal set of cookies. Strictly necessary cookies keep you signed in and remember your preferences. We use privacy-friendly analytics that do not track you across other sites. Where we would use non-essential cookies, we will ask for your consent first.

Encryption in transit (TLS 1.2/1.3) and at rest (AES-256), UK-based hosting, role-based access control, and audited access to production systems. For the full detail, see our Security & Trust page.

EvenX is not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time. Material changes will be communicated in-app or by email at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when it was most recently revised.

Questions or requests about your data can be sent to info@evenx.co.uk. For security concerns, see the responsible disclosure section of our Security page.