Privacy policy.

1. Who is responsible

EVA.AI LIMITED (company number 08700214), registered in England and Wales. Registered office: Martlet House, E1 Yeoman Gate, Yeoman Way, Worthing, West Sussex BN13 3QZ. Contact: ben@eva.ai. EVA.ai is our trading name.

We are the data controller for this website, our public Talk to EVA service, our own business relationships and our own recruitment. When we process candidate or employee information for a customer, the customer is normally the controller and its privacy notice explains that deployment. See section 7.

2. What we collect and why

Providing information is voluntary unless a field is marked as required for the service you request. Without the required contact details, we may be unable to provide that resource or arrange a meeting. You can browse public pages and examples without submitting a resource form.

Do not enter another person’s employee records, CV, salary, health information or other sensitive data into public chat. Use the agreed customer channel for workforce data. If you include information in error, contact ben@eva.ai; we will assess your removal request and any legal obligation to retain a limited record.

3. Public conversations with an AI system

Talk to EVA generates AI responses during the conversation. These may contain errors and are not individually reviewed by a human before they appear. They help frame an organisational enquiry; they do not decide a person’s employment, eligibility or other legally significant outcome.

Selecting a suggested question prepares an editable draft. You control whether to send it. A public conversation does not itself create a customer account, provision a Workspace or approve access to the platform. Any separately agreed human follow-up is distinct from the instant AI conversation.

Conversation data is processed by the services supporting our AI responses and enquiry handling. We do not use your conversations to train third-party foundation models. Ask us for the current processing and sub-processor information. Clearing browser storage does not delete records already sent to our services; contact us to exercise your rights.

4. Recipients and international transfers

Authorised EVA personnel and service providers receive information needed for their role. Categories include website hosting and security, AI processing, email and business administration, and HubSpot for forms, CRM and meetings. Optional marketing or visitor-identification providers are described in the cookie notice. We may also disclose information where required by law or to professional advisers handling a relevant matter. We do not sell personal data.

Where personal information is transferred outside the UK or EEA, we must use the mechanism applicable to that transfer, such as an adequacy decision or approved contractual safeguards. Contact ben@eva.ai for the current recipient and country details and a copy or explanation of the relevant safeguards. A vendor logo does not specify where your information is processed.

5. How long we keep information

We assess retention by the purpose and status of the record: whether a request is still open, whether requested follow-up remains relevant, whether a commercial relationship is active, and whether legal, accounting or dispute requirements justify keeping it. When these purposes end, information should be deleted or anonymised. We keep only the information needed for any remaining purpose.

A withdrawn consent or marketing objection may require a minimal record so that we respect your choice. A legal hold may require relevant information to be retained while a matter is resolved. Contact us for the period or criteria applicable to your record. Browser storage has its own lifetimes, described in the cookie notice; those lifetimes do not determine server-side retention.

6. Your rights and choices

Depending on the processing and the law that applies, you can ask to access or correct your information, erase it, restrict its use, or receive a portable copy. These rights have conditions and lawful exceptions. We may need information to confirm your identity. We normally respond to rights requests within one month; where the law allows an extension or pause, we will explain it.

Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time, without giving a reason.

Withdrawing consent: contact ben@eva.ai, use an unsubscribe link where provided, or change your cookie settings. Withdrawal does not affect processing that was lawful before it, and we may retain a limited record to respect your choice or meet a separate legal obligation.

7. Customer deployments and role-based access

When a customer uses EVA for its workforce or candidates, it determines the purpose, lawful basis, permitted uses and relevant access rules. EVA processes that data under the applicable customer agreement and documented instructions. The customer’s notice should explain the collection, use, recipients, retention, AI involvement and rights for that deployment.

Access is configured for the client and the use case. Employees, managers, HR and other authorised viewers can be given access to individual assessments and analyses where this is agreed. EVA and Customer Success can configure role-based permissions accordingly. The agreed access rules and privacy notice explain who can see each type of response and analysis.

Individual access, confidential respondent groups and aggregate reporting are different controls. An example’s reporting threshold is not a universal product rule. If you are an employee or candidate using a customer deployment, contact the organisation identified in its notice. If you contact us, we will help identify the responsible controller and assist it as required.

Our AI transparency statement explains the distinction between AI-supported recommendations and the organisation’s decisions. Our candidate privacy notice applies when you apply to work for EVA itself.

8. Data protection complaints

To make a data protection complaint, email ben@eva.ai or write to our registered office. Explain what happened, how it affected you and the outcome you would like. You can use our complaint form, completed electronically or on paper. Contact us if you need another accessible format.

We will acknowledge your complaint within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. A complaint does not replace a separate request to exercise your data rights.

You can also complain to the Information Commissioner’s Office (ICO), or to another competent supervisory authority where applicable. Our process does not restrict that right.

We use complaint details to investigate, respond and meet our legal complaint-handling obligations. Access is limited to people who need to handle the matter, including advisers or relevant service providers where necessary. Retention depends on the investigation, outcome, follow-up and applicable legal requirements.

9. Changes to this notice

The revision date above identifies this version. We will update the notice when our use of information changes and provide further notice where required. This website notice does not amend a customer contract or replace the customer’s own privacy notice.