Your data and Eva

Privacy policy

Effective 5 October 2026

This policy explains how Arabian Software Hub FZCO (“we”, “us”, or “our”) processes personal data when you use Eva’s website, hosted platform, mobile companion app, and related support services. If you connect Eva to a host operated by somebody else, that host operator is also responsible for its own processing and policies.

Data we process

• Account data: email address, display name, authentication provider identifiers, account and session identifiers, plan status, and sign-in security records.
• Your content: prompts, model responses, conversations, workspace files, memory, knowledge sources, settings, and content you ask Eva or a connected tool to process.
• Voice data: microphone audio you deliberately submit for transcription, generated speech, and resulting transcripts. Eva does not enable background recording.
• Connected-service data: information returned by services, tools, channels, browsers, or accounts that you choose to connect and instruct Eva to use.
• Device and operational data: IP address, security and gateway logs, device platform, locale, notification permission state, and push-notification token.
• Support and billing data: messages you send to support and subscription status from our web billing provider. The Eva mobile companion app does not sell subscriptions or accept payment.

How we use data

We process this data to:

• authenticate you, operate your account, and provide Eva’s requested features;
• send your instructions to the AI, speech, hosting, and integration services needed to complete them;
• save and restore your workspace, conversations, preferences, and authorized connections;
• deliver security, account, and privacy-minimized push notifications;
• prevent abuse, diagnose failures, protect accounts, and meet legal obligations; and
• answer support, privacy, and account-deletion requests.

AI processing and connected services

Eva is an agent service: it sends relevant instructions and content to the model, speech, or tool providers needed for the task you request. If you connect an external service, Eva may read from or act in that service under the access you grant. Those providers process data under their own terms and the configuration of your Eva host. Do not submit content to a provider or tool whose terms you do not accept.

Who receives data

We disclose data only as needed to operate Eva or when legally required, including to:

• hosting, storage, email, authentication, payment, push-notification, AI, and speech service providers;
• connected tools and services you choose to authorize;
• professional advisers, regulators, courts, or law enforcement where required; and
• a successor in a merger, financing, reorganization, or sale, subject to applicable law.

Eva’s mobile app contains no third-party advertising SDK and, as of this policy’s effective date, no general-purpose analytics or crash-reporting SDK. We do not sell personal data or use it for third-party behavioral advertising.

Storage and security boundary

Hosted Eva stores durable per-user data on its host. While Eva is working, the host processes workspace content, prompts, responses, files, and configured secrets in plaintext so it can call models and tools. The host operator is therefore inside the trust boundary. Eva is not end-to-end encrypted from the host operator, and we do not claim that the server cannot see your data.

We use access controls, encrypted transport, account-scoped storage, short-lived credentials, and other technical and organizational safeguards. No system is completely secure; protect your account and submit only data appropriate for the host and providers you use.

Retention

We retain account data and durable Eva content while your account is active and as needed to provide the service. Security records, diagnostic logs, billing records, and backup copies may remain for limited operational, fraud-prevention, tax, dispute, or legal purposes. Connected providers may apply their own retention periods. We delete or de-identify data when it is no longer needed, subject to these obligations.

Your choices and rights

• Manage notification, connected-service, conversation, file, and workspace controls in Eva.
• Delete your account from Eva’s Settings screen.
• Use our account-deletion page if you cannot access the app.
• Contact [email protected] to request access, correction, deletion, restriction, portability, or to object where applicable.

We may need to verify your identity before acting on a request. Deleting your private Eva data does not remove content already shared into a multi-user room from the other members’ shared transcript. Legal and operational retention exceptions may also apply.

International processing

Our service providers may process data in countries other than yours. Where required, we use contractual or other lawful safeguards for international transfers.

Changes and contact

We may update this policy as Eva, our providers, or legal requirements change. We will post the updated policy here and change the effective date. Questions and privacy requests can be sent to [email protected].