EvolveX AI — Privacy Policy
Contents
Version 1.6 — Effective 5 October 2026.
1. Who we are
Evolvex Technology CO. LLC operates EvolveX AI. Our registered address is Office 108, Office 9, Zalfa Building, Al Garhoud, Dubai, United Arab Emirates. Dubai Department of Economic Development commercial licence: 1454109. VAT registration: 104877211300003. Contact [email protected] for privacy, access, correction, export, deletion or security requests. Identify the relevant account, but do not send passwords, recovery keys or unnecessary identity documents.
For our account administration, billing, security and service operations, Evolvex determines the purposes of processing. When an organisation supplies personal data for us to process on its instructions, that organisation normally controls the business purpose and our Business Data Processing Addendum applies to our processing on its behalf. A reseller or employer may independently control its users, workspace and retention settings. The actual activity determines these roles.
2. Information we process
| Information | What it includes and why it is used |
|---|---|
| Account and access | Email address, account and organisation identifiers, roles, verification, sessions and device associations, to register users, sign in and enforce access. |
| Phone verification and account security | The phone number you provide, verification and delivery state, optional sign-in code preference, protected number-matching values, recovery-code hashes and session verification records, to verify control of a number, manage access and prevent abuse. |
| AI conversations and projects | Prompts, responses, reasoning where available, selected files or excerpts, tool inputs and results, project metadata and attachments, to provide the work you request and maintain its history. |
| Local computer activity | Relevant file paths and contents, commands, terminal results, operating-system information and action records, to operate authorised tools. A chosen project folder is context, not a security sandbox. |
| Images and screen interaction | Images you attach or ask to inspect, saved screenshots, previews and computer-control targets. Screenshots can contain information from other visible applications. |
| Mail and collaboration | Mail bodies, addresses, subjects, attachments, drafts, task data, comments, mentions, contact invitations, group memberships and connected messages, to provide your selected mailbox and collaboration features. |
| People and HR | When these features are used, employee names, email addresses, phone numbers, work details, salary and pay entries, and leave types, dates and reasons (including sick leave), to manage your organisation’s personnel records. |
| Drive and backups | Stored file data, encrypted chunks and manifests where that workflow is selected, and associated service metadata; local schedules, paths and job results, to store, restore and synchronise files. |
| Plugins and connectors | Plugin code and configuration, authorised connection information and selected results from local/LAN systems, to run the installed extension and answer related requests. A plugin may process data outside the application through its own authorised connections. |
| Voice dictation | When enabled and started by you, a temporary recording and its transcription. The text is returned to an editable draft; the recording is not a saved chat attachment. The voice workflow is described below. |
| Billing and service use | Plan assignments, allowances, reset rights, measured usage, balance adjustments and transaction or invoice references, to administer the agreed service and resolve billing issues. |
| Operational and support records | Request times and identifiers, network addresses where recorded, errors, security events, application version, delivery state, and information you provide in a support request, to operate, protect and troubleshoot the service. |
Sources include you, your device, authorised users in your workspace, your organisation, selected integrations and providers needed to fulfil your request. Information copied from a message into a task or from a task into an AI chat becomes a separate record at its destination; deleting the original does not automatically erase every derived copy.
3. Where processing happens
Local commands, files and plugin backends can run on your computer. Local transcripts and saved artifacts are kept in the application's device profile or the location you select. Relevant context is also sent to the EvolveX AI service for inference. “Local project” and “My Computer” do not mean offline inference or that no data leaves the device. The application uses the managed Pro service; enterprise service assignments are controlled by Evolvex administrators.
Cloud projects, account services, mail and collaboration require server processing. Remote Android virtual devices run on servers and stream their display to the client. Previews and connected services receive the information needed for the requested interaction. Local plugins can have the file and network privileges of the operating-system user; their independent connections are not confined to cloud infrastructure.
Enterprise Cloud and Enterprise On-Premise have different deployment arrangements. On-premise processing is available only after the agreed installation is provisioned. Its accepted processing schedule identifies permitted inference, storage, management, support and LAN access. Neither an enterprise label nor a folder selector establishes UAE-only residency, complete network isolation or exclusive local processing.
4. Purposes and lawful processing
We process information to provide the requested service, administer the agreement, protect accounts and systems, meet legal obligations, respond to verified requests and resolve disputes. We limit processing to the relevant purpose. Where consent is required, we obtain a specific informed choice and provide a way to withdraw it. A necessary contractual or legal purpose does not authorise unrelated collection.
Acknowledging this policy is not blanket consent to advertising, optional tracking, unrelated model training or every future use of your data. We do not sell your private content or use it to target advertising to you. We will not use private content for unrelated general-purpose model training without a separate lawful basis, clear notice and any required affirmative choice. Required service processing and security investigation remain subject to this policy and applicable law.
Phone verification through WhatsApp is required for existing and new personal accounts. An organisation can require it through its account policy. A verified number can be linked to one personal account per service installation, or one account within a company; the same number may be used in a different company. This verifies control of the number, not a legal identity. Requiring a code for a new sign-in is a separate option you can enable; renewing an already verified session does not by itself require another code. Backup recovery codes support access when the old number is unavailable, including when optional sign-in codes are off.
5. Voice, images and sensitive information
Microphone capture starts only when you choose the feature and allow the required device permission. In the EvolveX AI dictation workflow, audio is held temporarily for transcription, then released rather than saved as an audio file or chat attachment. The service does not intentionally write the recording or transcript into its transcription logs. Processing and network runtimes can hold temporary memory copies until released; this is not a claim of forensic memory erasure. Cancellation asks the service to stop and prevents a late result from being inserted into another draft. Text you subsequently send is retained as ordinary conversation content. This policy for app dictation does not erase voice messages already sent through independent services such as Telegram.
Saved screenshots and attached images have a different lifecycle from short-lived computer-control frames. OS capture permissions do not erase images you already saved or sent. Review what is visible before capture and provide only what the task needs.
Do not connect health records, biometric information, financial records or other regulated data unless you have a lawful basis and the relevant organisational and contractual safeguards. General AI features are not a certified clinical, financial or safety decision system. An enterprise deployment for regulated data requires a separately agreed processing scope and safeguards before that data is supplied.
6. Encryption and device storage
In the encrypted Drive workflow, the client encrypts file chunks and manifests before uploading them; unlocking and using the vault requires the relevant client-side keys. Storage retains the encrypted content for that workflow. Local names, schedules, job records, account metadata, exported recovery material and decrypted copies may have different protection. Removing key references from an unlocked session is not guaranteed erasure of every memory copy. Lost recovery keys can make encrypted content irrecoverable.
This protection does not mean that all mail, cloud files, conversations or service metadata are encrypted with keys available only to you. The service and its authorised processors must access relevant plaintext to provide AI, mailbox and other requested features. Submitting decrypted Drive content to AI or a recipient is a separate disclosure. Device credentials use available operating-system protection; exported files and device backups are also subject to your device's protections.
7. Who receives information
Recipients may include authorised users or administrators of your workspace, the people you choose to contact or share with, contracted hosting, infrastructure, storage, inference, communications and support providers, professional advisers under confidentiality, and authorities where disclosure is legally required. A payment provider receives payment information only when a payment method is offered and you choose to use it; an Admin balance entry is not a card transaction. Do not send card details through chat or support email.
We require appropriate instructions, confidentiality and safeguards from processors we engage. Their role is distinct from a service you independently connect or an external recipient you select. Publicly published content and shared links may be copied beyond our control according to their access configuration. A merger or transfer of the service may involve a successor under appropriate confidentiality, notice and legal safeguards, not unrestricted sale of private content.
You may ask [email protected] for the current providers and processing locations relevant to your deployment, and business customers can obtain the processing schedule before contracting for regulated or restricted use.
We use Twilio Verify and WhatsApp for verification delivery and checks. We submit the destination number for delivery and the code you enter with its verification reference for checking. These requests do not include your EvolveX conversations or files. The code passes through our service to Twilio; we do not save plaintext verification codes. Twilio and WhatsApp can also act as independent controllers for relevant processing under their own terms, including service operations, security, legal compliance and service improvement. See the Twilio Privacy Notice, Twilio Data Protection Addendum and WhatsApp Privacy Policy. The pre-send notice identifies this processing; using verification is not consent to unrelated marketing or tracking.
8. International processing
Your device, selected recipients, connected services and the hosting or inference resources assigned to your account may be in different countries. We do not promise that ordinary cloud processing remains in your country or solely within the UAE. Where an international transfer is subject to applicable data-protection requirements, the relevant permitted transfer basis and safeguards must be in place. Acknowledging this policy is not a substitute for a legally required safeguard. Contact our privacy address for information about the arrangements applicable to your service. Sector-specific, organisational or jurisdictional restrictions may require a separate deployment agreement before processing starts.
9. Retention and deletion
We retain account content to provide the ongoing service and its history, until it is deleted through applicable controls, an authorised organisation's retention setting or a verified deletion request, subject to lawful exceptions. Local conversations, screenshots, downloaded files and exports remain on the device or chosen storage until removed there. Organisational content and external recipients' copies may remain under their separate control.
Retention of operational records depends on their purpose, the need to investigate an error or security incident, and any applicable legal obligation or claim. Relevant audit payloads and performance metrics use bounded maintenance schedules; these are different from content and billing records. Drive trash may remain recoverable before its scheduled permanent removal. Backup and replicated copies can take an additional rotation or maintenance cycle to expire after deletion from an active store, and must not be restored to ordinary service in a way that disregards a deletion request. We will explain relevant remaining copies or a lawful hold when responding to a verified request. Restricted legal or security retention does not permit unrelated reuse.
Billing, tax, contractual acceptance and dispute records are kept for the periods required by the applicable recordkeeping obligation and to establish or defend lawful claims, then removed or appropriately anonymised when no longer needed. A single universal period does not apply to every category or jurisdiction.
Signing out, removing a linked account from one device, cancelling a subscription, locking a vault and deleting server content are separate actions. To request account closure, export or deletion, contact [email protected] and identify the account and scope. We verify authority proportionately and respond within the applicable legal period. If your organisation controls the data, we may direct the request to it while providing the assistance required of us. We explain a lawful refusal or extension and do not require withdrawal of a complaint to process a valid request.
You can initiate deletion of your personal account from Settings → Delete my account in supported apps. We show what will be deleted, any actions you need to resolve first, and the limited records retained for legal or security purposes. After identity verification, deletion is scheduled with a seven-day cancellation window. You can cancel from the same screen until deletion starts. Personal account content includes chats, files, personal cloud projects and Journey data and connections. Organisation accounts submit a request to their organisation’s administrators; shared organisation records may be retained or transferred. Existing automatic renewal must be cancelled and resources belonging to other users must be resolved before deletion can proceed. Removing an account from one device is only sign-out and does not request deletion. If the in-app control is unavailable, you can still contact us at [email protected].
You can also request deletion without reinstalling the app at https://evolvextech.ai/legal/delete-account.html.
For phone security, we retain the active number encrypted, a protected matching value scoped to the installation or company, verification state and recovery-code hashes while the account remains in use. Turning off optional sign-in codes does not remove the verified number or backup codes. A number change replaces the active number and rotates backup codes. Account-deletion lockout removes temporary verification requests, authorisation proofs, operation results and session verification proofs from the active database; the number remains reserved until final account deletion removes the phone profile and recovery records.
Verification-request and operation records become eligible for scheduled cleanup after 24 hours; short-lived authorisation proofs become eligible 24 hours after expiry. An encrypted backup-code disclosure is accessible only during its five-minute same-operation retry window and is then removed by scheduled cleanup. These are eligibility and access limits, not promises of immediate physical erasure. Backup rotation follows the rules above. Twilio and WhatsApp apply their own retention and deletion arrangements; our cleanup does not delete messages on your device or guarantee deletion of their independent records.
10. Your rights and choices
Depending on applicable law and its exceptions, you can request information about processing, access and a portable copy, correction, deletion, restriction, objection to relevant processing, withdrawal of consent, and human review of certain consequential automated decisions. Withdrawal does not make earlier lawful processing unlawful. You can also revoke device permissions, stop a run, disconnect integrations or change notification previews, although an action already delivered to another system may not be recalled.
Write to [email protected] with your request. You can complain to the competent data-protection or other authority without first waiving your right to contact a regulator or court. We will identify the applicable complaint route when handling your request. We do not require unnecessary identity material or payment for rights that must be provided without charge.
11. Security and incidents
We use safeguards appropriate to the processing, including account permissions, restricted operational access, transport protection, protected device credentials and feature-specific approval controls. No service can promise that errors or breaches are impossible. We assess, contain and investigate personal-data incidents and notify affected customers, individuals or authorities as required by applicable law and contract. Business processing also follows the Data Processing Addendum.
12. Cookies, notifications and changes
Sign-in uses essential session and security mechanisms. The client stores necessary preferences, credentials, drafts and feature data. Browser sessions let you select linked accounts. Notifications can expose content on a device's screen if previews are enabled; review both application and OS settings. Optional marketing or non-essential tracking, if offered, requires its own notice and any required choice. This policy does not silently enable optional technologies.
The service is intended for adults. If you believe a child's data has been supplied contrary to the service rules, contact us so we can assess and address it. We date and version policy changes and provide appropriate notice of material changes before new processing begins. A changed policy does not silently expand consent. Our contact remains [email protected].