Privacy Policy

Collection, use, retention, and privacy rights handling.

Scope

This Privacy Policy applies to all services provided by Evident Technologies, LLC, including the Evident platform, website, API, and related tools. By using our services, you acknowledge that you have read and understood this policy.

This policy does not constitute legal advice. It describes our data practices in plain language for transparency.

Information we collect

Account information

When you create an account, we collect your name, email address, and organization (if provided). If you subscribe to a paid plan, payment information is processed through our third-party payment processor — we do not store credit card numbers.

Evidence and uploaded files

Files you upload to the platform are stored for processing and retrieval. We compute a SHA-256 hash of each file on upload for integrity verification. Original files are stored immutably and are not modified by the platform. We do not access, review, or analyze your evidence except as necessary to provide the processing services you request.

Usage data

We collect information about how you interact with the platform: pages visited, features used, processing requests, timestamps, and IP addresses. This data is used to maintain security, enforce rate limits, and improve the service.

Audit logs

The platform generates append-only audit logs recording every action taken on evidence. These logs are a core feature of the service and are retained for the duration of your account plus any legally required retention period.

How we use your information

  • Provide, maintain, and improve the Evident platform
  • Process evidence files according to your instructions
  • Maintain audit trails and chain of custody records
  • Enforce tier-based access controls and usage limits
  • Send account-related communications (security alerts, billing notices)
  • Detect and prevent fraud, abuse, and security threats
  • Comply with legal obligations

Data storage and security

Evidence files and derivatives are encrypted at rest using AES-256. All data in transit is protected by TLS 1.2 or later. Access to production systems is restricted by role-based access control with audit logging.

We implement security practices including: regular vulnerability assessments, dependency monitoring, rate limiting, and automated alerting for anomalous access patterns.

Data retention

We retain your evidence files and audit logs for as long as your account is active, plus any retention period required by applicable law. When you delete evidence through the platform, the deletion is recorded in the audit log, and the evidence is marked for disposition according to configured retention policies.

Account information is retained for as long as your account is active. If you close your account, we will delete or anonymize your personal information within 90 days, except where retention is required by law.

Your rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate personal information
  • Request deletion of your personal information (subject to legal retention obligations)
  • Export your data in a portable format
  • Withdraw consent where processing is based on consent

Cookies and tracking

We use essential cookies for authentication and session management. We do not use third-party advertising cookies. Analytics, if used, are first-party and do not track users across sites.

Third-party services

We use third-party services for payment processing, infrastructure hosting, and AI model inference. These providers process data only as necessary to provide their services and are bound by data processing agreements. We do not share your evidence files with third parties except as required to process them on your behalf (e.g., AI model providers for transcription).

Payment processing (PCI compliance)

Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified service provider. Credit card numbers, CVVs, and other cardholder data are entered directly into Stripe's hosted payment forms and never transmitted to or stored on Evident servers. Our PCI scope is limited to SAQ A (fully outsourced card processing).

California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act provides you with specific rights regarding your personal information:

  • Right to know — You may request disclosure of the categories and specific pieces of personal information we have collected.
  • Right to delete — You may request deletion of your personal information, subject to legal retention obligations.
  • Right to opt out of sale — We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
  • Non-discrimination — We will not discriminate against you for exercising your CCPA rights.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the platform or by email before the effective date. Where required by law, we will request explicit consent for updated processing terms.

Contact

For privacy-related inquiries, contact Evident Technologies, LLC through our contact page .