Legal
Privacy
Last updated:
Draft — counsel review before production
This page is a draft. It has not been reviewed by counsel and is not a binding policy until it has. Anything marked as a placeholder is deliberately not filled in.
Who is responsible
Evoye GmbH, An der Allee 130, 55122 Mainz, Germany. Email info@evoye.com. This is also our data-protection contact. More in the imprint.
Evoye is the controller for this website, early access, and accounts and sign-ins, including those of invited people. Content in a work area is processed by Evoye on behalf of the work area’s owner, who is the controller (Art. 28 GDPR). Where the owner uses FEATit only privately, Evoye is the controller and uses the content only to provide FEATit. On a deployment a customer runs itself, the customer is the controller, and Evoye receives none of its data.
Your right to object (Art. 21 GDPR). You may object at any time, on grounds relating to your situation, to processing based on our legitimate interests (Art. 6(1)(f) GDPR). Write to info@evoye.com.
What we process, why, and for how long
| What | Why, and legal basis | How long |
|---|---|---|
| Website visits: technical request data | Delivering and securing the website and FEATit (legitimate interest, Art. 6(1)(f) GDPR) | Logs rotate by size, so the oldest are overwritten |
| Early access: what you enter in the form | Answering your request (Art. 6(1)(b) GDPR). A conversation you agree to: your consent (Art. 6(1)(a) GDPR) | Unconfirmed: deleted within about an hour of expiry. Confirmed: deleted 12 months after you confirm it. The follow-up we filed from it is kept |
| Account and sign-ins: name, email address, preferences, credentials, and device and network details of your sign-ins | Providing FEATit and account security (Art. 6(1)(b) and (f) GDPR). Optional device details such as a Mac’s network address: your consent (§ 25(1) TDDDG), which you can withdraw in Settings | While the account exists. Network addresses: about an hour after a sign-in ends. The ended sign-in itself: 90 days after it ends |
| Email we send, and records of delivery, bounces and unsubscribes | Providing FEATit, respecting unsubscribes and protecting our sending (Art. 6(1)(b), (c) and (f) GDPR) | Delivery records: 90 days. Unsubscribe links: 24 months. An address that bounced, complained or unsubscribed is kept, so we never mail it again |
| Billing for paid plans | The contract and our duty to keep accounts (Art. 6(1)(b) and (c) GDPR) | Up to ten years (§ 257 HGB, § 147 AO) |
| Optional features you switch on: the desktop app’s bridge, push to iPhone and iPad, AI analysis | Providing the feature you chose (Art. 6(1)(b) GDPR). Reading data from your device for it rests on your switching it on (§ 25(1) TDDDG) | Until you switch it off or delete the account |
| Messages you send us | Answering you (Art. 6(1)(b) or (f) GDPR) | As long as needed, or as the law requires |
If someone invites you, we receive your email address from them. If you sign in with Google, Microsoft or Apple, we receive your name and email address from them.
AI analysis uses the provider the owner chooses. Your content is never used to train AI models, by Evoye or by anyone on its behalf. FEATit makes no decision about you based solely on automated processing (Art. 22 GDPR).
Cookies and storage. Neither the website nor the apps use analytics, advertising or tracking tools. The website sets no cookies, the web app sets only strictly necessary ones, and the apps store only what they need to work, such as your sign-in and preferences (§ 25(2) No. 2 TDDDG).
Required data. We need a name, an email address and a credential to open an account and cannot provide FEATit without them. FEATit is not directed at children under 16.
Who receives data
These recipients act on our instructions:
| Service | Purpose | Where, and transfer safeguard |
|---|---|---|
| Hetzner Online GmbH | Hosting, storage, backups | Nuremberg, Germany (EU) |
| OVHcloud | Offsite copy of the backups | France (EU) |
| Mailgun | ⟦placeholder: mail-region⟧ | |
| Apple’s push service (APNs) | Push to iPhone and iPad | ⟦placeholder: apns-transfer⟧ |
| Stripe | Payments | ⟦placeholder: stripe-transfer⟧ |
| ⟦placeholder: support-tools⟧ | Email to and from info@evoye.com | As stated |
Outside the EEA, we rely on an adequacy decision or on standard contractual clauses (Art. 45, 46 GDPR). Services you connect, such as a sign-in or AI provider, GitHub or GitLab, receive data on your instruction.
Your rights
You can download your data and delete your account under Settings. Deletion runs 14 days after the request, and backups, kept for recovery (Art. 6(1)(f) GDPR), are removed 30 days after they were taken. You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and portability (Art. 20), to object (Art. 21, see above), and to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Write to info@evoye.com. You may also complain to a supervisory authority (Art. 77 GDPR), for Evoye the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, www.datenschutz.rlp.de.