The short version
Evatin holds your business records: your leads and clients, your notes and tasks, your files, and the transcripts of calls you chose to record. It lives on servers in Sydney, Australia. A small number of companies help run it, and every one of them is named below along with exactly what it sees. We don't sell any of your data, we don't share it with anyone else, and we don't use it to train Eva or anything else.
You can take a copy of everything at any time, and you can delete your account yourself. When you do, it's gone.
Who we are
Evatin is based in Australia. In this policy, "Evatin", "we", "us" and "our" all mean Evatin: the app at evatin.com, this website, and the team that runs them. "Eva" is the assistant inside the app.
Contact: hello@evatin.com
What Evatin collects
Your account
- Your email address and sign-in credentials. Passwords are stored hashed by the sign-in service, never in plain text, and never where we can read them.
- Your name, your timezone, and a profile photo if you add one.
- A record of which version of the terms and the points shown at sign-in you agreed to, and when.
- Your plan, and how much of its allowance you've used this month.
Your business records
Everything you put in, and the things Eva works out from it:
- Leads and clients: names, email addresses, phone numbers, pipeline stage, and the notes you keep against each of them.
- Notes, tasks and reminders, including the ones Eva creates from your calls.
- Files you upload: proposals, worksheets, pricing sheets, programme outlines. Private to you, never shared with the client they relate to.
- Calls you chose to record: the transcript, the meeting link, when it happened, how long it ran, and what Eva concluded from it.
- Your conversations with Eva, and the small set of durable things she remembers about how you like to work. She remembers preferences and corrections, not a running log of your day.
- Your business profile: what your business does, who you work with, how you price.
Collected on its own
- Ordinary server logs: the time of a request, the page asked for, the IP address it came from, and any error that happened. These are kept by the hosting provider for a short period and we read them only to fix things.
- If you turn on notifications, a push subscription: an address your browser hands out so it can be reached, and the keys needed to encrypt what is sent to it. It identifies a browser, not a person, and it is deleted when you turn notifications off or the browser revokes it.
There is no analytics script, no advertising pixel and no tracking of any kind in the app or on this website.
How we use it
- To run Evatin for you. Storing your records, showing them back to you, and letting Eva read them so she can answer questions, write your briefing, and fill in what a call produced.
- To reach you about your account. Sign-in and password emails, and the reminders and briefings you asked for. Nothing promotional is sent to an app account.
- To keep Evatin running. Enforcing plan limits, and reading logs when something breaks.
That's the list. Your data isn't used for advertising, isn't sold, isn't shared for anyone else's purposes, and isn't used to train any model.
Who else touches it
Evatin is built on a handful of services. They are infrastructure: none of them are advertisers, none are data brokers, and none get your data for their own use. Here is each one, what it holds, and where.
| Service | What it does | What it sees | Where |
|---|---|---|---|
| Supabase | The database, file storage and sign-in | Everything listed above. Also sends the sign-in and password emails. | Sydney, Australia |
| Vercel | Runs the app and this website | Your data passes through as pages are built; nothing is stored beyond ordinary server logs. | Sydney, Australia |
| Recall.ai | Joins and records the calls you ask Eva to join, and produces the transcript | The audio and video of a recorded call, for 48 hours, then deleted. See Call recording. | Frankfurt, Germany (EU) |
| Anthropic | Runs the model behind Eva | The part of your data Eva needs for the answer in front of her. See Where Eva thinks. | United States |
| Push services | Deliver notifications to your browser, if you turn them on | An opaque delivery address and an encrypted message. The service (Apple, Google or Mozilla, depending on your browser) cannot read the contents. | Depends on your browser |
When paid plans open, payments will be handled by Stripe, and card details will go to Stripe directly and never to Evatin. We'll add Stripe to this table before that happens. If any other service is ever added, this page changes first.
Where Eva thinks
Eva is built on Anthropic's Claude models. When you talk to her, when she writes your morning briefing, when she reads a call, or when she summarises a file you uploaded, the relevant part of your data is sent to Anthropic to produce the answer. She's sent what she needs for the task in front of her: your open tasks, your pipeline, the names on your list, the transcript being read. Not your whole account.
Anthropic deletes what it receives within 30 days, and does not train its models on it. Both of those are Anthropic's published commercial terms for the kind of account Evatin runs on, checked at the source on 31 August 2026, and checked again whenever this page is reviewed.
Anthropic processes in the United States. There is no European processing option at the time of writing. That matters if you have a client whose contract requires their data to stay in Europe; see Data residency.
Call recording
This is the part that involves someone other than you, so it gets its own section.
Eva only joins a call when you ask her to. She appears as a visible participant with a name, so everyone can see she's there. Tell the other person before she joins. In most Australian states every party to a private conversation has to agree to it being recorded, not just the person doing the recording, and the law where the other person is may say the same. Eva showing up in the participant list is a backstop, not consent. Getting that agreement is your responsibility, and the terms say so.
What happens to a recording:
- Recall.ai records the call and produces a transcript. Recall deletes the recording, audio, video and its own copy of the transcript, 48 hours after the call.
- Evatin downloads the transcript when the call ends and keeps it in your account. That's the copy you read on the Calls page. Evatin does not keep the audio or the video.
- Eva reads the transcript once to work out what happened and what was agreed. That reading goes to Anthropic, under the terms above.
How long the transcript is kept is up to you. A new account keeps transcripts until you delete them. In Settings you can instead choose a window, from 7 days to a year, after which transcripts clear on their own. And you can delete any single transcript at any time, with the option of downloading a copy first.
Deleting a transcript removes the words. The record that the call happened, when, how long it ran and who it was with, stays in your account until the account is deleted, along with anything Eva wrote from it. That is deliberate: it is what lets Evatin count calls against your plan without keeping what was said.
Files you upload
When you attach a file to a client or your business profile, the text inside it is extracted and Eva writes a short summary, so that she knows the file exists and what it's for. That summary is produced by Anthropic under the terms above. Day to day Eva is shown only the file's name and that summary; she opens the full contents only when a question you've asked needs them.
Files are stored in Sydney alongside your other records and are never shared with the client they relate to.
How long it is kept
| What | Kept for |
|---|---|
| Recordings held by Recall.ai | 48 hours after the call. |
| Call transcripts in Evatin | Until you delete one, or until the retention window you set in Settings runs out. With no window set, until your account is deleted. |
| Leads, clients, notes, tasks, reminders, files | Until you delete them, or your account is deleted. |
| Conversations with Eva, and what she remembers | Until your account is deleted. |
| Data sent to Anthropic | Deleted by Anthropic within 30 days. |
| Server logs | A short period, set by the hosting provider, then gone. |
| Record of the terms you agreed to | Kept while your account exists, on purpose: it's the record of what you were told and when. |
| Everything, after you delete your account | Removed straight away from the live database and file storage, including your sign-in. The hosting provider's daily encrypted backups of the whole database roll over within a couple of weeks and take the last copy with them. |
What you can do
All of these are controls in the app, not requests you have to email us for:
- Correct anything. Every record is editable, including what Eva wrote.
- Delete a lead or client, and choose whether their notes and files go with them.
- Delete any note, task, reminder or file, at any time.
- Delete a call transcript, with the option of downloading a copy first, or set a retention window so transcripts clear on their own.
- Get a copy of everything. Settings exports your whole account as a single file: every record, every field, with download links for your files.
- Turn notifications off, which removes the push subscription.
- Delete your account. Settings deletes everything, including your sign-in, immediately. There is no waiting period and no one to convince.
For anything not on this list, email us.
Your rights
Evatin is run from Australia and this policy is written to follow the Australian Privacy Principles. Under them you can ask us what personal information we hold about you, ask for it to be corrected, and complain if you think we've handled it badly. The controls above cover almost all of that without needing to ask.
If you are in the United Kingdom or the European Economic Area, you also have rights under the UK GDPR and the GDPR: to access, correct, delete and receive a copy of your personal data, to restrict or object to its processing, and to complain to your local supervisory authority. The export and delete controls above are how the first four are done; for the rest, email us.
About the people in your records. Your leads and clients are your contacts, not ours. You decide what goes into Evatin about them and you are responsible for having the right to keep it there. We hold that information only to run Evatin for you, and we act on it only on your instructions. If one of them asks you what you hold about them, the export gives you the answer.
Data residency
Some people have clients whose contracts require their data stay in a particular place, most often inside Europe. Evatin can't currently promise that, and we'd rather say so plainly than leave it vague.
Your records sit in Sydney. Call recording runs in the EU. The part that can't move yet is Eva: Anthropic processes in the United States, with no European option available at the time of writing.
So if you're under a strict EU-residency obligation for a particular client, the honest advice is not to record those calls and to keep that client's details out of Evatin for now. Ask us if you're unsure. We'd rather talk it through than have you find out later.
Security
- Every account's data is isolated at the database level, not just in the app's code. Even if the app had a bug, one account's queries cannot return another account's rows.
- The credential the app runs on can only read and write ordinary data. It can't change the database's structure and it can't bypass the isolation above.
- Everything travels encrypted, and everything is stored encrypted at rest by the providers above.
- The accounts on every service that touches Evatin have multi-factor authentication turned on.
What we can't promise yet. Direct access to the database is not yet logged, so we can't currently show you a record of who looked at what. That is on the list, and this paragraph will change when it's done rather than before.
If you find a security problem, please tell us at the address below before telling anyone else, and we'll fix it and thank you.
Cookies and your browser
The app sets the cookies needed to keep you signed in, and nothing else. There are no analytics or advertising cookies. If you turn on notifications, your browser holds the push subscription described above. If you install Evatin to your home screen, nothing is cached on your device: every page is fetched fresh, so no client data sits in your browser between visits.
This website
This website, at evatin.com, is a static page. It sets no cookies. Its fonts are loaded from Google Fonts, which means Google's servers see your IP address when the page loads, as they do on most of the web.
If you join the waitlist, we keep your name, your email address, what you do and which tools you use today, so we can tell you when Evatin opens and understand who's asking for it. That's the only use. If you'd like to be taken off it, email us. Until you press send, the form keeps a draft of what you've typed in your own browser's storage so it isn't lost on a refresh; nothing leaves your browser before then.
What we don't do
- We don't sell your data. There's no advertising in Evatin and no plan for any.
- We don't share it with anyone beyond the services named above.
- We don't use it to train Eva or any other model, and neither does Anthropic.
- We don't look at your data unless you've asked us to look at something, or something is broken and fixing it requires it.
- We don't knowingly hold data from anyone under 18. Evatin is a tool for running a business.
Changes
Evatin changes over time, and sometimes this page does too. Small clarifications get made quietly and the date at the top moves. If anything changes in a way that matters, particularly a new service that sees your data or a change to how long something is kept, we'll tell you in the app or by email before it takes effect, rather than quietly updating the page.
Questions and complaints
Email hello@evatin.com. You'll get a real answer, usually within a few days.
If you're not happy with how we've handled a complaint about your personal information, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au. If you're in the UK or EU, your local data protection authority can hear it too.