Privacy Policy

When you register, we collect your name, email address, and a hashed password. You may also optionally upload a profile picture from your profile page. Profile pictures are stored on AWS S3. This data is used to authenticate you, display your identity within the workspace, and send you service-related emails (such as campaign notifications and password resets).

Organisation owners provide a workspace name and optionally upload a logo. Logos are stored on AWS S3. We also store department names, member roles, and invitation records to manage access control.

Workspace managers create feedback forms (questions) and campaigns (active feedback cycles). We store these definitions as part of the service.

Contributors submit responses to campaigns. Responses may include text, numerical ratings, yes/no answers, and multiple-choice selections. Responses are stored and made available only to authorised members of the organisation that created the campaign.

Responses are linked to a contributor account to enforce the one-response-per-person rule. Reviewers and managers can see aggregate analytics; individual responses are accessible to managers, admins, and owners depending on their role.

Webcam capture is a core part of every Evalora submission. When a contributor submits feedback, the browser requests webcam access and captures an image at the point of submission. This image is stored on AWS S3 and is displayed alongside the contributor's response in the response viewer, visible only to authorised members of the organisation (managers, admins, and owners, based on their role).

Organisation administrators are responsible for informing contributors that a webcam image will be captured and retained as part of their feedback submission, and for ensuring this complies with applicable employment and privacy law in their jurisdiction.

We collect standard server logs including IP addresses, browser type, device information, and request timestamps. This data is used for security monitoring and debugging. We do not use it for advertising or tracking.

If you contact us by email at support@evalora.pro, we may use that correspondence to respond to your query. Email communication is handled externally via our email provider and is not stored within the Evalora platform itself.

Stores uploaded files — organisation logos, user profile pictures, and webcam images captured during feedback submissions. CSV, XLSX, and PDF exports are generated on-demand and streamed directly to the requester; they are not stored on S3. Data may be stored in AWS regions including Asia Pacific and US East.

When an authorised user generates an AI summary, the following data is sent to the Anthropic API: the organisation name, campaign titles, question text, and the text-based answer values from submissions. No individual user names or email addresses are included. Anthropic's data use is governed by their API usage policy.

AI summaries are an optional feature. If you do not use the AI summary function, no data is sent to Anthropic.

Our frontend and backend are hosted on Vercel's infrastructure. Vercel processes request and response data as part of serving the application.

Transactional emails (invitations, campaign notifications, password resets) are delivered via Zoho Mail SMTP. Email addresses and the content of service emails pass through Zoho.

Subscription payments are processed by Razorpay, a PCI-DSS compliant payment gateway. When you subscribe, your payment details (card number, UPI ID, or bank details) are collected and stored directly by Razorpay — we never store or have access to your raw payment credentials. Razorpay may retain payment data in accordance with their own Privacy Policy. We store only the subscription ID and payment reference ID for billing and support purposes.

You can request a copy of the personal data we hold about you.

You can correct inaccurate data directly through your account settings, or ask us to correct it on your behalf.

You can request that we delete your personal data. Note that deleting your account removes your identity, but feedback responses you submitted may remain in your organisation's workspace as they belong to the organisation, not to you as an individual. Contact your organisation admin to request deletion of your responses.

You can contact us to request a copy of the personal data we hold about you (name, email address, and profile picture). Organisation campaign data is owned by the organisation; contact your organisation admin regarding exports of that data.

Where we process data based on legitimate interests, you may object to that processing by contacting us. We will assess whether our legitimate interests override yours in each case.

If you are an Indian resident, you have the right to access, correct, and erase your personal data under the Digital Personal Data Protection Act, 2023. You also have the right to nominate another person to exercise these rights on your behalf. Grievances can be raised with us at the contact below before escalating to the Data Protection Board of India.

If you are in the EEA or UK and believe we are processing your data unlawfully, you have the right to lodge a complaint with your local data protection authority.