Privacy Notice
Effective: August 27, 2026
Version: 1.4
This Privacy Notice explains how Eveli, Inc. (“EVELI”) collects, uses, discloses and protects personal data when you use eveli.ai and related services.
1. Controller and contacts
Eveli, Inc. is the controller for account, billing, website, security, support, product analytics and marketing data.
Eveli, Inc.
Attn: Privacy
16192 Coastal Highway
Lewes, Delaware 19958
United States
legal@eveli.ai
For personal data a business customer submits for EVELI to process on its behalf, that customer is ordinarily the controller and EVELI is its processor under the Data Processing Addendum.
EVELI does not currently offer paid access to EU/EEA or UK residents. Paid checkout for those territories remains disabled until EVELI has appointed and published the contact details of the EU/EEA and UK representatives required by applicable data-protection law. This paragraph will be replaced with those representative details before regional activation.
EVELI has not designated a data protection officer because it does not currently believe mandatory designation criteria are met. Privacy inquiries go to legal@eveli.ai.
2. Data we collect
We collect:
- Account data: name, email, authentication identifiers, organization, plan and settings.
- Billing and transaction data: billing contact, country, tax status, plan, payment status, invoices, renewal and cancellation records. Payment providers process full card data; EVELI ordinarily receives tokens and limited payment details.
- Customer content: uploaded images, references, text, selections, project information and generated Outputs.
- Generation and product data: models and features used, parameters, credit ledger, timestamps, failure logs, favorites, casts, anchors, downloads and project activity.
- Device and log data: IP address, browser, device, operating system, request data, approximate location, security signals and diagnostic logs.
- Support and legal data: communications, attachments, complaints, rights requests, copyright or illegal-content notices, evidence and resolution records.
- Marketing data: marketing choices, campaign engagement and suppression status.
- Cookie and storage data: consent choices and information described in the Cookie Policy.
- Active-time analytics data: an estimate of meaningful authenticated product use, described in Section 2A.
- Signup context: the country, broad first-level region and timezone inferred from the network connection used when the account was created, described in Section 2B.
- Inferences: limited preferences or risk signals derived from Service activity, such as preferred visual settings or suspected abuse. EVELI does not use the Service to infer sensitive traits or make high-impact decisions about people.
Do not upload highly sensitive information that the Service does not expressly request.
2A. Active-time measurement
EVELI measures active time: an estimate of how long an account is meaningfully using the authenticated product. It is an estimate, not an exact record of what you did.
When time counts. A second counts only while all of the following are true at once: you are signed in to a paid EVELI account; the product tab is visible on screen; you have interacted with the product recently; and that tab is the single active tab counting for your account. Keyboard input, clicks, taps, scrolling and form entry are interactions. Moving the mouse alone is not.
When time does not count. Time is excluded when the tab is hidden or in the background, when you are idle, when you are signed out, and when you are on the marketing site, the legal pages, the sign-in pages or an administrative surface. Generations running in the background do not accrue time. Nothing is measured for visitors who do not have an account.
What is stored. For each account and day: a pseudonymous account identifier, the calendar date in UTC, the environment the activity occurred in, the number of active seconds, and the first and last activity timestamps for that day. Short-lived idempotency receipts are stored so a retried or duplicated submission cannot be counted twice.
What is not stored for this feature. Prompts, entered text, generated content, page or route history, pointer coordinates, IP address, user agent, referrer, device identifier, device fingerprint, and any activity on other websites are not collected or stored for active-time measurement. EVELI does not introduce a third-party analytics SDK, an advertising tracker, a cookie, local storage or IndexedDB to measure active time.
Why. Internal product measurement, reliability, support, capacity planning, and aggregate business reporting.
Who can see it. Individual account activity data is restricted to authorized EVELI administrators. Investors and other external partners receive only aggregate or deidentified reporting. No advertiser or advertising network receives individual-level activity data. EVELI does not sell this data, does not share it for cross-context behavioral advertising, and does not use it for ad targeting.
How long it is kept. Raw idempotency receipts are retained no longer than 7 days. Per-account daily totals are retained while the paid account exists and are then deleted or irreversibly deidentified through the account-deletion workflow in the Data Rights and Account Deletion Notice. Anonymous historical aggregates, which cannot be linked back to an account, may be retained.
Your rights. Where applicable law provides them, you may exercise access, deletion, correction, restriction and objection rights over this data using Section 8.
Classification and choice. Active-time measurement is analytics, not a strictly necessary technology. It is not part of, and is not authorized by, acceptance of the Terms of Service. Where consent is required, it is obtained separately from Terms acceptance and may be withdrawn as easily as it is given.
2B. Signup context
When an account is created, EVELI records the country, the broad first-level region (for example a state or province) and the timezone that the trusted network edge infers from the signup connection, together with the time of capture. This is recorded once, at signup, and is not updated by later sign-ins, travel or network changes.
What is not collected for signup context. EVELI does not request or record GPS location, precise coordinates, street address, city or postal code for this purpose, does not use browser geolocation, and does not store the IP address itself as part of the signup context.
Who can see it. Signup context is restricted to authorized EVELI administrators and to bounded first-party product analytics. Investors and other external partners receive only aggregate or deidentified reporting.
3. Faces, likenesses and biometric data
Identifiable real-person and minor images are prohibited at launch. EVELI processes permitted synthetic imagery to generate and maintain visual consistency, not to identify a person against an identity database, authenticate identity, infer sensitive traits or conduct surveillance.
Under EU and UK data-protection law, biometric data is special-category data when processed for uniquely identifying a person. Some U.S. laws are broader and regulate capture or processing of face geometry even without an identification database. A user's promise or contract with a depicted person may not satisfy a law requiring EVELI itself to provide a written notice and obtain that person's written release.
EVELI will not enable a designated real-person workflow unless it has completed the applicable biometric/privacy assessment, published purpose and retention/destruction terms, obtained any required subject-specific release and implemented deletion controls. Identification, face matching, authentication, emotion recognition, biometric categorization and surveillance remain prohibited.
3A. Sources of data
EVELI obtains data directly from you; automatically from your browser, device and Service activity; from your organization or an account administrator; from payment, authentication, security and generation providers; and from people who submit support, legal, copyright, safety or illegal-content reports. If a business customer provides information about another person, that customer, as controller, is responsible for giving the required notice. EVELI gives an Article 14 or equivalent notice only for processing for which EVELI is independently a controller and no exemption applies.
4. How and why we use data
| Purpose | Data | EU/UK legal basis |
|---|---|---|
| Create and manage accounts; deliver generations, projects, downloads and support | Account, customer content, generation, device, support | Contract; steps requested before contract |
| Process payments, credits, renewals, cancellation, refunds and tax | Account, billing, transaction, country | Contract; legal obligation |
| Secure the Service; prevent fraud, abuse, unauthorized access and rights violations | Account, customer content where necessary, device, logs, risk signals | Legitimate interests in security and rights protection; legal obligation |
| Moderate prohibited or illegal content and respond to notices | Customer content, logs, notice records | Legal obligation; legitimate interests |
| Troubleshoot and improve reliability, usability and generation quality | Generation metadata, logs, support, de-identified operational signals | Legitimate interests; contract where necessary to provide Service |
| Send transactional messages | Account, billing, support | Contract; legal obligation |
| Send marketing | Email and marketing choices | Consent where required; limited soft opt-in only where law permits and an opt-out is offered |
| Meet accounting, tax, corporate, regulatory and dispute duties | Account, billing, legal and transaction records | Legal obligation; establishment, exercise or defense of legal claims |
| Optional contribution of eligible content for generalized model improvement | Specifically selected eligible assets and consent record | Separate, explicit consent; never bundled with Service access |
| Measure active product use for internal product measurement, reliability, support, capacity planning and aggregate business reporting | Active-time analytics data (Section 2A) | Consent where required for analytics; otherwise legitimate interests in understanding and improving product use, never bundled with Terms acceptance |
| Understand where accounts sign up, for product analytics, product operations and aggregate business reporting | Signup context (Section 2B) | Legitimate interests in understanding and improving the Service; consent where required |
Where EVELI relies on legitimate interests, it balances those interests against your rights and uses only reasonably necessary data. You may request information about that assessment.
EVELI does not use private customer content for generalized model training without a separate, optional, specific opt-in.
The August 11, 2026 repository review found no advertising network, data broker or cross-context behavioral-advertising integration in the customer application. That remains true with the addition of active-time measurement and signup context: both are EVELI's own first-party measurement, described in Sections 2A and 2B, and neither introduces a third-party analytics SDK, advertising tracker or audience-matching integration. EVELI does not sell personal information for money and does not use customer activity for targeted advertising. EVELI will reassess this statement before enabling any further analytics, advertising, audience-matching or marketing integration and when a state-law coverage threshold is approached.
5. How we disclose data
We disclose data only as reasonably necessary to:
- cloud hosting, database, storage, authentication, security and content-delivery providers;
- payment, subscription, invoicing and tax providers;
- AI inference and generation providers acting under contract;
- email, support and communication providers;
- analytics providers enabled in accordance with cookie and consent rules;
- investors and other external partners, who receive only aggregate or deidentified reporting and never individual-level activity data;
- professional advisers, auditors, insurers and corporate transaction counterparties under confidentiality duties;
- authorities, courts or parties when legally required or necessary to protect rights, safety and the Service; and
- a successor in a merger, financing, reorganization or sale, subject to applicable notice and rights.
The current subprocessor list is published separately. EVELI contractually restricts subprocessors from using private customer content for their own generalized model training.
6. International transfers
EVELI is based in the United States and uses providers in the United States and other countries. Those countries may have different data-protection laws.
Where EU/EEA or UK transfer rules apply, EVELI uses an applicable adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, participation in an approved data-privacy framework where valid, and supplementary technical and organizational safeguards. You may request information about the relevant mechanism at legal@eveli.ai.
7. Retention
EVELI retains data only as long as reasonably necessary for the stated purpose, subject to the following default schedule and legal holds:
| Data | Default retention |
|---|---|
| Account, authentication and subscription records | Account life, then deletion or restriction after a verified request, subject to the financial, consent, security and legal records below |
| Browser-local casting state and session data | Until the user signs out, clears the relevant browser storage or deletes it through an available product control; browser-local data is not a cloud backup |
| Server-side casting state and private EVELI asset storage, when production persistence is active | Account/project life, then deletion after a verified request or product deletion control, subject to technical completion and documented legal holds |
| fal.ai request payloads | Up to 30 days under fal.ai's current default; EVELI's launch implementation must send the provider's no-payload-storage header before live customer generation is enabled |
| fal.ai temporary generated media | Provider-controlled until copied to EVELI's private storage and deleted or expired under the configured provider lifecycle; EVELI's launch implementation must set a short expiry and restricted access |
| Generation and security logs | A risk-based operational period, ordinarily no more than 12 months, with longer restriction only for a documented incident, abuse case or legal duty |
| Credit ledger, invoices, tax and transaction records | 7 years or longer if tax law requires |
| Contract acceptance, consent and withdrawal records | 7 years after account closure or the relevant transaction |
| Support communications | 3 years after closure, unless attached to a dispute or legal duty |
| Legal, copyright, DSA and fraud records | Duration of matter plus applicable limitation period, ordinarily up to 7 years |
| Marketing profile | Until opt-out, account closure or 24 months of inactivity; minimal suppression record retained to honor opt-out |
| Cookie choice | Until withdrawal, material purpose change or the next refresh required by applicable law and EVELI's configured consent policy |
| Active-time idempotency receipts | No longer than 7 days |
| Active-time per-account daily totals | While the paid account exists, then deleted or irreversibly deidentified through the account-deletion workflow; anonymous historical aggregates that cannot be linked to an account may be retained |
| Signup context (country, broad region, timezone) | Account life, then deleted with the account through the account-deletion workflow |
Deletion may be delayed when necessary to preserve evidence, comply with law, resolve disputes, enforce agreements or protect safety. Retained data is restricted to that purpose.
8. Your rights
Depending on location, you may have rights to:
- access and obtain a copy of personal data;
- correct inaccurate data;
- delete data;
- restrict or object to processing;
- receive portable data;
- withdraw consent at any time without affecting earlier lawful processing;
- opt out of marketing;
- appeal certain privacy-request decisions;
- object to certain automated decisions; and
- complain to a data-protection authority.
EVELI does not make decisions producing legal or similarly significant effects based solely on automated processing.
Submit requests to legal@eveli.ai. EVELI may verify identity and authority proportionately. Authorized agents must provide proof of authority. EVELI will respond within the period required by applicable law, ordinarily one month under EU/UK law, subject to permitted extensions.
EU/EEA users may complain to the supervisory authority where they live, work or believe an infringement occurred. UK users may complain to the UK Information Commissioner's Office. EVELI asks that you contact legal@eveli.ai first so it can attempt to resolve the issue, but this is not a condition of complaining.
9. Marketing choices
Marketing consent is optional, separate from the Terms and unchecked by default. Transactional, security, billing and legal messages are not marketing.
Use the unsubscribe link in any marketing email or contact legal@eveli.ai. Opt-out may take a short operational period, but EVELI will retain a minimal suppression record so it does not re-enroll you accidentally.
10. Cookies and similar technologies
EVELI currently uses browser local storage for authentication session data, device-scoped identity, casting state and related product state. It contains no advertising integration.
Active-time measurement (Section 2A) is an optional analytics purpose rather than a strictly necessary one, but it is not a device technology: it sets no cookie, writes no local storage or IndexedDB entry, reads no device identifier, and loads no third-party script. It runs only in the signed-in product and only when the conditions in Section 2A and the Cookie Policy are met. If EVELI later enables further non-essential technologies, it will update the Cookie Policy and obtain consent before those technologies run where required.
11. Private-content training
EVELI does not train generalized AI models on private Inputs, references or Outputs by default. An optional contribution program, if offered, will:
- use a separate, affirmative and asset-specific choice;
- identify the content, purpose and withdrawal effect;
- exclude identifiable third parties, minors and confidential client work; and
- preserve proof of consent.
EVELI may use independently generated synthetic R&D assets and aggregated or de-identified operational statistics that do not identify a user or reveal private content.
12. Security and incidents
The reviewed implementation keeps Stripe, Supabase service-role and fal.ai credentials on server routes; verifies Stripe webhook signatures; fails closed when payment or generation safety switches are not enabled; stores live generated assets in a private Supabase bucket; issues time-limited signed asset URLs; and enforces user-scoped asset paths. Authentication tokens and local casting state are stored in the user's browser local storage, so users should sign out and protect access to their device. EVELI also uses transport encryption supplied by its hosting and service providers. No system is completely secure.
The review also identified two controls that must precede live customer generation: fal.ai payload non-retention and short-lived, restricted provider media. Until those controls pass an end-to-end test, EVELI will keep live customer generation disabled.
If a personal-data breach creates a notification duty, EVELI will notify authorities, affected customers or data subjects within legally required periods and provide information reasonably available at the time.
13. Children
The Service is for adults aged 18 or older. EVELI does not knowingly create accounts for children. Do not upload a minor's identifiable image. EVELI may block or remove such content, preserve legally required evidence and make reports required by child-safety law.
14. U.S. state privacy disclosures
Residents of certain U.S. states may have access, correction, deletion, portability, opt-out, sensitive-data limitation/consent and appeal rights. Authorized agents may submit requests where law permits. EVELI will honor legally recognized browser-based opt-out signals, including Global Privacy Control, when applicable.
EVELI will not discriminate against a person for exercising a privacy right. Submit requests through the process in Section 8.
The table below describes the customer application and repository reviewed on August 11, 2026. EVELI is below the California Consumer Privacy Act business thresholds based on its current pre-launch scale, but uses this disclosure as a transparent baseline and will reassess coverage as the business grows.
| U.S. disclosure | Verified production entry |
|---|---|
| Categories collected and sources | Identifiers and account data; subscription, transaction and credit-ledger data; browser/device and security data; casting briefs, prompts, references and generated images; product events, diagnostics, support and legal communications; active-time analytics data as described in Section 2A. Sources are the user, the user's browser and device, EVELI product activity, Stripe, Supabase, Cloudflare and fal.ai. |
| Business/commercial purposes | Account authentication, service delivery, generation, private storage, billing, subscription administration, support, security, fraud prevention, legal compliance, reliability improvement, internal product measurement and capacity planning. |
| Categories disclosed for business purposes and recipient categories | Identifiers, transaction and device data to Stripe; identifiers, account and application data to Supabase; request and security data to Cloudflare; prompts, permitted reference images, generation parameters and temporary Outputs to fal.ai; support/legal communications to EVELI's email provider. |
| Categories sold or shared | None. EVELI does not sell personal information for money and does not use customer data for cross-context behavioral advertising. Active-time analytics data is not sold, not shared for cross-context behavioral advertising, not used for ad targeting, and never disclosed to an advertiser or advertising network at individual level. |
| Sensitive personal information | The launch product prohibits identifiable real-person and minor images and does not use face data to identify or authenticate anyone. Credentials and payment information are used only for authentication, security and payment administration. |
| Retention criteria | The purpose-based schedule in Section 7, provider defaults disclosed there, user deletion requests, legal holds and statutory accounting duties. |
| Opt-out methods and browser signals | Because the reviewed product does not sell, share or use personal information for targeted advertising, no sale/share event is currently generated for Global Privacy Control to suppress. EVELI will treat a recognized signal as an opt-out before enabling any activity to which it legally applies. |
| Privacy-request appeal route | legal@eveli.ai with “Privacy Appeal” in the subject |
EVELI does not knowingly sell or share personal information of consumers under 16. The Service does not support accounts for anyone under 18.
14A. EU Data Act exports
Contractual switching and export rights for covered data-processing services are described in the Terms. They are separate from, and do not reduce, GDPR/UK GDPR access and portability rights.
15. Changes
EVELI may update this Notice. It will display the effective date and give advance notice of material changes where required. EVELI will not use a policy update to retroactively authorize generalized training on private content. New processing based on consent will require new consent.
16. Contact
Privacy questions and requests: legal@eveli.ai
Support: support@eveli.ai
Eveli, Inc., Attn: Privacy, 16192 Coastal Highway, Lewes, Delaware 19958, United States.