Privacy Policy

This Privacy Policy explains how Eva Commerce, Inc. (“Eva”, “we”, “us”) collects, uses, and protects personal information in connection with our websites, software platforms, and services. It should be read together with our Terms and Conditions, our Data Processing Agreement, and our Subprocessors list.

1. Who This Policy Covers

This policy covers three groups. Website visitors: people who browse eva.guru and our related sites. Customers and prospects: people who create accounts, request information, book meetings, or represent businesses that use our services. Our customers’ end customers: shoppers and subscribers whose personal information we process on behalf of the businesses we serve. For this third group, Eva acts as a processor or service provider under the instructions of its customer, and our Data Processing Agreement governs that processing. If you are a shopper of a brand that works with Eva, the brand is responsible for your data, and requests about it should be directed to the brand; we forward any request we receive to the responsible business without undue delay.

2. Information We Collect

Information you provide: name, business email address, phone number, company name and role, and the contents of messages you send us, including through forms, chat, email, and meeting bookings. Information collected automatically: IP address, browser and device information, pages visited, referring pages, and interactions with our sites, collected through cookies and similar technologies. Account and service data: credentials for connected commerce platforms that customers authorize, business performance data from those platforms, billing details, and support history. Information from third parties: business contact information from data providers and publicly available sources, used for business-to-business outreach.

3. How We Use Information

We use personal information to provide, operate, and improve our services; to create and manage accounts; to respond to inquiries and provide support; to send service communications and, where permitted, marketing communications, which you can opt out of at any time; to analyze and improve our websites; to protect the security and integrity of our systems; and to comply with legal obligations.

4. Legal Bases

Where the EU or UK General Data Protection Regulation applies, we process personal information on the following legal bases: performance of a contract, our legitimate interests in operating and promoting our business in ways that do not override your rights, your consent where required, and compliance with legal obligations.

5. Artificial Intelligence

Eva uses artificial intelligence tools in delivering its services. We do not use our customers’ data, confidential information, or content to train or fine-tune any Eva or third-party artificial intelligence model without prior written consent, and we configure AI tools to exclude customer data from model training to the extent the tool provides such controls, as described in our Data Processing Agreement and Terms and Conditions.

6. How We Share Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We share personal information only with: the service providers listed on our Subprocessors page and other vendors that support our business under contractual confidentiality and data protection obligations; the commerce, advertising, and analytics platforms our customers already operate, at their direction; professional advisers; and authorities where required by law. If Eva is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction under equivalent protections.

7. Cookies and Analytics

We use cookies and similar technologies for site functionality, analytics, and marketing measurement. You can control cookies through your browser settings, and where a consent banner is presented, through the choices it offers. We honor opt-out preference signals, such as the Global Privacy Control, where required by law.

8. International Transfers

We are headquartered in the United States and process information there and in the locations listed on our Subprocessors page. Where personal information originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

9. Retention

We keep personal information for as long as needed for the purposes described in this policy: for the life of the relationship and a reasonable period afterwards for business records, or as required by law. Personal information processed on behalf of customers is retained and deleted according to the Data Processing Agreement and the customer’s instructions.

10. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, and logging and monitoring, as described further in our Data Processing Agreement. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority. California residents have the right to know, correct, and delete personal information, the right to opt out of sale or sharing (we do not sell or share personal information), the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising these rights. To exercise any right, contact us at privacy@eva.guru. We verify requests and respond within the timeframes required by applicable law. An authorized agent may submit a request on your behalf with proof of authorization.

12. Children

Our websites and services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this policy from time to time. The “Last Updated” date at the top reflects the current version, and material changes will be communicated through our websites or by email where appropriate.

14. Contact

Eva Commerce, Inc., San Diego, California, USA. Privacy questions and requests: privacy@eva.guru.