What we keep, and why.

Evi (“Evi”, “we”, “us”) is an evidence-first beauty and wellness publication. This policy explains what information we collect, why, and the choices you have.

[PLACEHOLDER: Legal entity name, registered address and company/registration number.]

[PLACEHOLDER: Name and contact details of the person or team responsible for privacy (data protection contact), if different from the support address below.]

• Account information. If you create an account, we store your email address and the authentication credentials needed to sign you in (including identifiers from Google if you sign in that way). We do not ask for your name, address or payment details.
• Saved products, lists and alerts. If you save products, build lists, set price alerts or choose an email preference, we store those choices so My Evi works.
• Optional preferences. If you choose to fill in Evi Match preferences, we store exactly what you enter. It is optional and only ever used to explain which products may fit the preferences you stated.
• Anonymous activity events. When you view a product, save something, compare retailers or click through to a store, we record the event — the page or product involved, the time, and whether you were signed in. If you are not signed in, the event carries a random token generated by your browser. The token contains nothing about you: not your IP address, device details or browsing history.
• Support correspondence. If you email us, we keep your message so we can help you and improve the site.

We don't collect payment information — purchases happen on the retailer's own site, not here. We don't buy or sell advertising profiles, and we don't run third-party advertising or social-tracking pixels. We don't collect sensitive information (health data, biometrics, precise location), and we don't ask for information we don't need to run the features you use.

We treat every photo and screenshot you give Scan with Evi as private. It is made smaller on your phone, held in memory only while Evi reads it, then discarded. We never save the original image, on your device or ours, and our image-reading service is told not to keep it.

Images are used only to identify the product you asked about. They are never used for advertising, training, profiles or anything else. We keep only the result — which catalogue product matched and how confident Evi was — and that record contains no picture.

Evi uses very little tracking technology. What we do use falls into two groups:

• Essential (always on). A session cookie or local storage entry that keeps you signed in, and your explicit cookie choice itself. Without these, accounts, saved products and lists cannot work.
• Optional analytics. A single random token in your browser that lets us count activity — for example, how many people saved a product this week — without identifying anyone. This group also powers features like Trending on Evi. It stays switched off until you allow it in the cookie banner, and you can change your mind at any time via “Cookie settings” in the footer.

We do not use cookies for advertising, cross-site tracking, or profiling.

We use account information to keep you signed in and show your saved products, lists, alerts and preferences. We use activity events in aggregate — never individually — to decide what to investigate, rank Trending on Evi, and understand which products and collections are genuinely useful. We use your email preferences to send only the emails you have explicitly opted into.

We do not sell personal information, and we do not use your information to build advertising profiles.

Hosting, database and authentication: Evi runs on Lovable Cloud (infrastructure provided by Supabase and its hosting partners), which stores account data and event records on our behalf. [PLACEHOLDER: confirm hosting regions and, if applicable, data processing agreement details.]

Retailers and affiliate networks: when you choose a Shop link, you leave Evi and go to the retailer. From that point the retailer's own privacy policy applies — we have no access to what you do there. If a purchase earns Evi a commission, an affiliate network may share limited reporting data with us (for example, that a click converted to an order and its total). We never receive your payment details.

Email delivery: if you opt into emails, they are delivered through an email service provider. [PLACEHOLDER: name of email delivery provider once a sending domain is configured.]

Google sign-in: if you use “Sign in with Google”, Google handles the authentication step under its own policies. We receive only the identifiers needed to create and recognise your account.

Nothing is automatic. Every email category — price drop alerts, saved product updates, The Evi Edit newsletter and new-from-brands-you-save — is off until you switch it on in My Evi, and the date you consented is recorded. You can turn any category off at any time, and every email we send carries a link to manage your preferences.

[PLACEHOLDER: confirm the address and behaviour of the public email preference-management page once it exists.]

Account data: kept while your account exists. Saved products, lists, alerts and preferences: kept while your account exists, and deleted when you ask us to delete your account.

Anonymous activity events: kept for up to [PLACEHOLDER: retention window, e.g. 24 months] in raw form, after which they are aggregated or deleted. Support emails: kept for up to [PLACEHOLDER: retention window, e.g. 24 months].

When data is deleted it is removed from our active systems; backups expire on their normal schedule.

Depending on where you live, you have some or all of the following rights over your personal information:

• Access — ask what we hold about you.
• Correction — ask us to fix anything inaccurate.
• Deletion — ask us to delete your account and its data.
• Portability — ask for a copy of your data in a common format.
• Objection and restriction — object to or ask us to pause certain processing.
• Withdraw consent — withdraw a consent you previously gave (for example, analytics or email), at any time, without affecting anything we did before.
• Non-discrimination — exercising these rights will never change how the site works for you.

If you are in the EEA, the UK or Switzerland, you also have the right to complain to your local data protection authority. If you are a California resident, you have the right to know, delete and correct personal information, and to opt out of any “sale” or “sharing” — Evi does not sell or share personal information for cross-context advertising, so no opt-out flag is required here.

To exercise any right, email the support address below. We will verify the request against your account and respond within [PLACEHOLDER: response window, e.g. 30 days].

Access to Evi's data store is restricted, connections are encrypted in transit, and passwords are handled by the authentication provider rather than stored by us. No system is perfectly secure; if a breach ever affects your personal information, we will notify you as required by law.

Evi is not directed at children. You must be at least 16 years old (or the age of digital consent where you live) to create an account. If we learn an account belongs to someone younger, we will delete it and its data.

Our infrastructure may store or process data in countries other than your own. Where that happens, we rely on the safeguards provided by our infrastructure providers. [PLACEHOLDER: confirm transfer mechanism, e.g. EU Standard Contractual Clauses, once hosting regions are confirmed.]

If we change this policy in a way that matters, we will say so here and note the date below. Continued use of Evi after a change means you accept the updated policy.

Questions, requests or complaints about privacy: email the support address below. [PLACEHOLDER: postal address for formal notices, if required.]

Effective date: [PLACEHOLDER: effective date].