Privacy Policy

Last updated: November 2026

‍

1. Introduction

This Privacy Policy explains how Evlio Inc. ("we," "our," or "us") collects, uses, discloses, and safeguards your information when you visit our website, evlio.xyz (the "Website"), and use our product, the Evlio API management platform ("Evlio" or the "Platform").

Evlio Inc. provides the Services described in this policy. Our contact address is 870 N Colorado St, Salt Lake City, UT 84116. We are committed to complying with applicable data protection laws, including U.S. privacy legislation, the GDPR, and the UK GDPR.

‍

2. Our Roles

For the personal data described in this Policy — account, billing, technical, support, and marketing data — Evlio Inc. acts as the data controller.

Where customers submit content containing personal data — API specifications, documentation, or reader records of published documentation portals — the customer is the controller and Evlio Inc. processes that data on the customer's behalf under our Data Processing Agreement. If your personal data appears in a customer's content, the customer is responsible for responding to your requests; you may also contact us at legal@evlio.xyz and we will refer your request appropriately.

‍

3. About This Notice; Marketing

This Policy is a transparency notice: it describes our data practices so that you can make informed decisions. Where applicable law requires your consent for a specific activity — for example, non-essential cookies in the EEA/UK or marketing emails — we ask for that consent separately, and you may withdraw it at any time.

Marketing communications are sent only in accordance with applicable law. Where you have opted in, you may receive surveys, newsletters, offers, and promotional content via email. You can opt out at any time via the "unsubscribe" link or by contacting us.

‍

4. Note for Minors

The Platform is intended for business and professional use and is not directed at minors under 18 or the applicable age of consent. We do not knowingly collect personal information from minors; if we learn that we have, we will promptly delete it. If you believe we may hold information about a minor, please contact us.

‍

5. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information received from third parties or services you connect. The specific information collected depends on how you use the Platform.

5.1 Website and Platform

• Account Information: your name, email address, and password, together with optional profile details (such as country and profile picture) and your communication and marketing preferences, provided when you register or set up your account.
• Single Sign-On and Third-Party Sign-In: if you sign in through a third-party or enterprise identity provider — for example Google, Microsoft (Azure AD / Entra ID), GitHub, Okta, or your organization's SAML/OIDC single sign-on — we receive your email address and, where the provider makes them available, your name and a unique account identifier. We use this solely to create and authenticate your account. Where a workspace requires SSO, your organization administers that login.
• Payment Data: payments are processed by Stripe; we do not store or have access to your full payment card details. We retain only limited billing references (such as your email and a Stripe customer/subscription identifier) to manage your subscription. See Stripe's Privacy Policy.
• Log and Technical Data: IP address, browser and device information, referring URLs, timestamps, and activity/audit logs (for example, sign-ins, failed sign-in attempts, and content changes), used for security, troubleshooting, and service improvement. In corporate workspaces, certain activity data may be visible to your workspace administrators.
• Cookies and similar technologies — see "Cookies and Tracking Technologies" below.
• Communications: information you provide when you contact us or use our in-app support channels.

‍

5.2 Documentation Content and Portals

‍

• ‍API Specifications and Metadata: specifications you import or upload — endpoint structures, examples, and related metadata — used to generate documentation and provide the service.‍
• Documentation Portal Visitors: limited technical data (IP address, browser information, page views) about visits to customer-published documentation, used to host, secure, and measure it. The publishing customer is responsible for its content and for any data it separately collects from readers.

6. How We Use Information

We use the information we collect to: provide, operate, and secure the Platform; improve and personalize the Services; develop new products and features (using aggregated or de-identified information where feasible; communicate with you, including support and, with your consent, marketing; process transactions; prevent fraud and misuse; comply with legal obligations; and enforce our terms and policies. For EEA/UK users, the legal basis for each purpose is described in Section 11.

‍

7. How We Share Information

We share personal data only with: service providers and sub-processors that support functions such as hosting, payment processing, support, and analytics, under contractual confidentiality and data protection obligations (listed in Annex III of our Data Processing Agreement); authorities, where required by law or to protect rights, safety, or the integrity of the Services; a successor entity in connection with a merger, acquisition, or asset sale, in which case we will notify you; and others with your consent. Sign-in providers (Google, GitHub) process your authentication under their own privacy policies.

We do not sell personal data.

‍

8. Artificial Intelligence Features and Model Improvement

Some features use AI to generate, summarize, search, or otherwise process content. Prompts and documentation content you submit to AI features may be processed by AI providers acting on our behalf, solely to provide the requested functionality. Content submitted through AI features is not used to train general-purpose AI models, with one exception: Evlio Inc. may use documentation you have chosen to make publicly accessible on Evlio to train and improve Evlio Inc.'s own AI models. We do not use private projects, restricted-access documentation, account data, or payment information for training.

We may change AI providers over time; current providers are listed in Annex III of our Data Processing Agreement. Please do not submit personal or confidential information to AI features unless permitted under your organization's policies, and review AI-generated output before relying on it. Enterprise agreements governing AI features control where executed.

‍

9. Data Security

We maintain administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and at rest, encrypted credential storage, logical isolation of customer data by tenant, role-based access controls, and audit logging. Evlio Inc. operates an information security management system compliant with ISO/IEC 27001:2022 and undergoes independent SOC 2 Type II audits. Further detail is set out in Annex II of our Data Processing Agreement.

No method of transmission or storage is completely secure. If a breach affects your personal data, we will act in accordance with applicable breach-notification laws and, where applicable, our Data Processing Agreement.

‍

10. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies to operate our services, keep you signed in, secure our systems, understand how our Website and Platform are used, provide customer support, and support our marketing.

• Strictly Necessary. These technologies are required for our services to function and remain secure, including security, bot protection, authentication, session management, and remembering your cookie preferences.
• Support. We use our support provider (Pylon) within the signed-in Platform to provide customer support. Pylon may use cookies or similar technologies necessary to deliver these features.
• Performance and Analytics. We use providers such as Google Analytics and Hotjar to understand how visitors use our Website and Platform so we can improve them.
• Advertising. We use advertising partners such as Google Ads, LinkedIn, and X to measure campaigns and deliver relevant advertising, subject to their respective privacy policies.
• Your choices. Where required by applicable law, including in the EEA and the UK, we use non-essential cookies and similar technologies only with your consent. You can accept, reject, or customize these categories through our cookie banner and change your preferences at any time through Cookie Settings. You can also manage cookies through your browser settings and, where available, provider opt-out tools such as the Google Analytics opt-out.
• For more information about our processing of personal data, please see our Privacy Policy. If you have questions or wish to exercise your privacy rights, contact us at legal@evlio.xyz

‍

‍

‍

‍

11. Jurisdiction-Specific Provisions

EEA and UK

Our legal bases for processing are: contract (creating and operating your account, providing the Platform, processing transactions); legitimate interests (securing the Platform, preventing fraud and misuse, analyzing and improving the Services, enforcing our terms); consent (marketing communications, non-essential cookies) — which you may withdraw at any time; and legal obligation (tax, accounting, lawful requests). Where we rely on legitimate interests, you have the right to object.

International Transfers: Evlio Inc. is established in the United States and our Services are hosted there. Where personal data is transferred from the EEA, UK, or Switzerland to countries without an adequacy decision, we use appropriate safeguards, including the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

‍

EU and UK Representatives

• EU: Rickert Rechtsanwaltsgesellschaft mbH (Evlio Inc.), Colmantstraße 15, 53115 Bonn, Germany — art-27-rep-evlio@rickert.law
• UK: Rickert Services Ltd UK (Evlio Inc.), PO Box 1487, Peterborough, PE1 9XX, United Kingdom — art-27-rep-evlio@rickert-services.uk

United States

We comply with applicable U.S. state privacy laws, including the CCPA/CPRA, to the extent they apply to us. We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use sensitive personal information for purposes requiring a "limit use" option and do not knowingly collect personal information of consumers under 16. Where required, we honor opt-out preference signals such as the Global Privacy Control. You have the right to access, correct, and delete your personal data, and not to be discriminated against for exercising these rights; authorized agents may submit requests where permitted by law.

Other Jurisdictions

We process personal data in accordance with the data protection laws of the jurisdictions where our users are located, to the extent they apply to us — including Australia (Privacy Act; complaints may also be raised with the OAIC), Brazil (LGPD, including the rights in Article 18), Canada (PIPEDA and the provincial laws of British Columbia, Alberta, and Quebec; data is transferred to and processed in the U.S.), India (DPDPA), Japan (APPI, including transfer safeguards), Singapore (PDPA, including deemed consent where applicable), Switzerland (FADP), Thailand (PDPA), Indonesia, and Malaysia. To exercise rights or raise questions or complaints under any of these laws, contact us using the details below; we may require proof of identity.

‍

12. Data Retention

We keep personal information only as long as needed for the purposes described in this Policy and to meet legal obligations. In particular:

Account data: retained while your account is active; deletion requests are completed within 30 days of verification, except for data we must keep for legal, security, or accounting purposes.

Customer Content: retained while your workspace is active. Downgrading from a paid to a free plan does not delete your data; content is deleted on your request or account deletion, within 30 days.

Authentication tokens expire automatically; deleted data may persist briefly in encrypted backups until purged on our rolling backup cycle.

‍

13. Your Rights

Depending on your location, you may have the rights listed below. If you are located in the EEA or the UK, you have all of these rights under the GDPR and the UK GDPR.

• Right to be informed: to receive clear information about how we collect and use your personal data, which this Policy provides.
• Right of access: to confirm whether we process your personal data and to obtain a copy of it, together with information about how it is processed.
• Right to rectification: to have inaccurate personal data corrected and incomplete personal data completed.
• Right to erasure: to have your personal data deleted, subject to the exceptions described below.
• Right to restriction of processing: to limit how we use your personal data in certain circumstances, for example while we verify its accuracy or assess an objection you have raised.
• Right to data portability: to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller where technically feasible. This applies where processing is based on your consent or on a contract with you and is carried out by automated means.
• Rights related to automated decision-making: not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Evlio Inc. does not make such decisions.
• Right to withdraw consent: where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Right to object. Where we process your personal data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. This includes our use of publicly accessible documentation to improve our AI models. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed to establish, exercise, or defend legal claims. You may also object at any time to the use of your personal data for direct marketing, and we will stop such processing.

How to exercise your rights. To exercise any of these rights, contact us at legal@evlio.xyz or contact our Data Protection Officer directly (details below). We will verify your identity in a manner proportionate to the request and respond within one month of receipt. Where necessary, taking into account the complexity and number of requests, we may extend this period by up to two further months, in which case we will inform you of the extension and the reasons for it within the first month. Requests are free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee based on administrative costs or decline the request, as permitted by law.

Limits on erasure. We may retain personal data despite an erasure request where retention is necessary to comply with a legal obligation, such as tax and accounting requirements, or to establish, exercise, or defend legal claims. Deleted data may persist briefly in encrypted backups until it is purged on our rolling backup cycle, as described in Section 12.

Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority. In the EEA, this is the data protection authority in your country of residence, place of work, or place of the alleged infringement. In the UK, it is the Information Commissioner’s Office (ICO). We would appreciate the opportunity to address your concerns first, so please feel free to contact us beforehand.

‍

14. Changes to This Privacy Policy

We may update this Policy to reflect changes in our practices or legal requirements. Significant updates will be announced by posting the revised Policy on our Website; we encourage you to review it periodically.

‍

15. Contact Us

Evlio Inc.
870 N Colorado St, Salt Lake City, UT 84116, United States

Email: legal@evlio.xyz

‍