LEGAL — PRIVACY POLICY
What we collect, and why.
Evident processes personal data to run the platform, answer enquiries and meet its own obligations. This page says what that means in practice.
LAST UPDATED 12 APRIL 2026
VERSION 4.2
GDPR ALIGNED
ON THIS PAGE
01
02
03
04
05
06
07
08
09
01
When you visit this website, request a demo or receive marketing, Evident Labs GmbH is the controller of your personal data.
When you use the platform to assess your own AI systems, we act as a processor on your instructions. In that case, your organisation is the controller and the data processing agreement governs what we do.
02
We collect only what the service needs. We do not ask for special-category data and we ask customers not to place it in the register.
Account data: name, work email, organisation, role and authentication metadata.
Usage data: pages viewed, actions taken, device type and truncated IP address.
Support data: messages, attachments and call notes you choose to share.
Billing data: company details, VAT number and invoice history. Card data is handled by our payment processor.
03
We rely on three legal bases, and we name them rather than hiding behind “legitimate interest”.
Contract: to provide the platform, authenticate users and administer your subscription.
Legitimate interest: to secure the service, prevent abuse and improve the product using aggregated usage.
Legal obligation: to keep tax records and respond to lawful requests.
Consent: for the newsletter and non-essential analytics. Consent can be withdrawn at any time.
04
Retention is set per record type, not as a single policy.
Account data: for the life of the subscription, then 30 days.
Billing records: ten years, as required by German commercial law.
Product logs: 90 days, then deleted or aggregated.
Support tickets: 24 months after closure.
Applicant data: six months after the hiring decision.
Marketing contacts: until you unsubscribe, then suppressed.
05
We do not sell personal data. We share it with subprocessors that help us run the service — hosting, email, payments and support — each bound by a data processing agreement.
The current subprocessor list is public on the security page. Customers receive 30 days’ notice before a new subprocessor is added. Data is hosted in the EU by default; where support access requires a transfer outside the EEA, we rely on standard contractual clauses and supplementary measures.
06
You can request access, rectification, erasure, restriction, portability or object to processing. We respond within one calendar month and will tell you if we need to extend that period.
Where we process data as a processor, requests should be directed to your organisation. We assist them in responding. You also have the right to complain to a supervisory authority — in Berlin, the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
07
Essential cookies are required to keep you signed in and to protect forms against cross-site request forgery. Non-essential analytics load only after you consent.
The full list — four cookies in total — is on the cookie policy page. We do not run advertising pixels, social trackers or cross-site fingerprinting.
08
Personal data is encrypted in transit with TLS 1.3 and at rest with AES-256. Access is limited to named employees, reviewed monthly, and logged.
We test controls continuously, commission an annual penetration test and publish a SOC 2 Type II report under NDA. A personal data breach is notified to the controller without undue delay and within 48 hours of confirmation.
09
For privacy questions, write to privacy@evident.systems or to Evident Labs GmbH, Chausseestraße 42, 10115 Berlin, Germany. Our data protection officer can be reached through the same address.
If you are a customer and need a signed DPA, the current version is available on the DPA page and can be executed through your order form.
Questions about this document?
PRIVACY@EVIDENT.SYSTEMS · DPO ON REQUEST
Contact legal