Privacy Policy

1. What we collect

Account data. Your email address, display name, sign-in provider and account identifier. If you sign in with Google or GitHub, we receive the profile details those services share with us — we do not receive your password.

Project content. The projects you create, the briefs and chat messages you send, the Skript files and attachments you upload, the code the agent writes, and exports you generate.

Usage and plan data. How many AI requests you have used, your plan and quota, and the timestamps and status of agent runs. This is what the request meter is built on.

Billing data. When paid plans open, our payment provider will collect your payment details and share billing identifiers, plan and invoice status with us. We do not receive or store full card numbers.

Support messages. What you send us when you ask for help, including any files or screenshots you choose to include.

Technical data. IP address, browser and device information, and server logs generated when you use the service, kept for security and debugging.

Analytics. Aggregated, cookieless usage data from this site — see section 4.

2. How we use it

• to create and secure your account, and sign you in;
• to run the agent: sending your brief and the relevant files to the model that writes the code, and validating the result;
• to meter requests, enforce plan limits and prevent abuse of the free tier;
• to provide support and respond to you;
• to keep the service secure, debug failures and understand which features are used;
• to meet legal, tax and accounting obligations;
• to improve the product, using aggregated and de-identified information where possible.

We do not sell your personal data, and we do not use your project content for advertising.

3. Legal bases

Where data protection law requires a legal basis, we rely on: performance of our contract with you (running the service you signed up for), our legitimate interests (security, abuse prevention, product improvement), your consent where we ask for it, and legal obligation (tax and accounting records).

4. Cookies and analytics

This site does not use advertising cookies or cross-site trackers. We use Umami, a self-hosted, cookieless analytics tool, to count visits and understand which sections of the page are read. It records the page URL, referrer, browser and device type, country and the interaction events we define; it does not set cookies and does not build a profile across other websites. Our tracker also honours the browser's Do Not Track preference.

The studio uses browser storage for your signed-in session. That storage is what keeps you logged in; it is not used for advertising.

5. Who processes data

• Google Firebase and Google Cloud — authentication, database and hosting. Our application servers run in the European Union.
• Model providers — the prompts and project files needed to answer a request are sent to the providers that run the model behind the agent. Their handling of that data is governed by their own terms.
• Dodo Payments — when paid plans open, as merchant of record for payments, taxes and invoicing.
• Sign-in providers — Google and GitHub, when you choose to sign in with them.
• Authorities — where we are legally required to disclose information, or where disclosure is necessary to protect rights, safety or the service.

These providers may process data outside your country, including in the United States. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.

6. How long we keep it

Account and project data is kept while your account is open. Delete a project and it is removed from the active service; close your account and we delete or de-identify your personal data, apart from records we must keep for legal, tax, security or dispute reasons. Server logs are kept for a limited period for security and debugging. Aggregated analytics that cannot identify you may be kept longer.

7. Security

Data is encrypted in transit, access is restricted to the systems and people that need it, and credentials are stored in a managed secret store. No service can promise perfect security, so keep your sign-in method secure and tell us if you suspect unauthorised access.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to a supervisory authority. You can export your projects from the studio at any time. For anything else, email support@evoslabs.dev from the address on your account and we will respond within the period the law requires.

9. Children

The service is not directed at children under 13, and you must be at least 13 to create an account. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy as the service changes. The date at the top of this page shows the current version; for material changes we will give notice in the app or by email.