Privacy Notice
Effective: August 11, 2026
Version: 1.2
This Privacy Notice explains how Eveli, Inc. (“EVELI”) collects, uses, discloses and protects personal data when you use eveli.ai and related services.
1. Controller and contacts
Eveli, Inc. is the controller for account, billing, website, security, support, product analytics and marketing data.
Eveli, Inc.
Attn: Privacy
16192 Coastal Highway
Lewes, Delaware 19958
United States
legal@eveli.ai
For personal data a business customer submits for EVELI to process on its behalf, that customer is ordinarily the controller and EVELI is its processor under the Data Processing Addendum.
EVELI does not currently offer paid access to EU/EEA or UK residents. Paid checkout for those territories remains disabled until EVELI has appointed and published the contact details of the EU/EEA and UK representatives required by applicable data-protection law. This paragraph will be replaced with those representative details before regional activation.
EVELI has not designated a data protection officer because it does not currently believe mandatory designation criteria are met. Privacy inquiries go to legal@eveli.ai.
2. Data we collect
We collect:
- Account data: name, email, authentication identifiers, organization, plan and settings.
- Billing and transaction data: billing contact, country, tax status, plan, payment status, invoices, renewal and cancellation records. Payment providers process full card data; EVELI ordinarily receives tokens and limited payment details.
- Customer content: uploaded images, references, text, selections, project information and generated Outputs.
- Generation and product data: models and features used, parameters, credit ledger, timestamps, failure logs, favorites, casts, anchors, downloads and project activity.
- Device and log data: IP address, browser, device, operating system, request data, approximate location, security signals and diagnostic logs.
- Support and legal data: communications, attachments, complaints, rights requests, copyright or illegal-content notices, evidence and resolution records.
- Marketing data: marketing choices, campaign engagement and suppression status.
- Cookie and storage data: consent choices and information described in the Cookie Policy.
- Inferences: limited preferences or risk signals derived from Service activity, such as preferred visual settings or suspected abuse. EVELI does not use the Service to infer sensitive traits or make high-impact decisions about people.
Do not upload highly sensitive information that the Service does not expressly request.
3. Faces, likenesses and biometric data
Identifiable real-person and minor images are prohibited at launch. EVELI processes permitted synthetic imagery to generate and maintain visual consistency, not to identify a person against an identity database, authenticate identity, infer sensitive traits or conduct surveillance.
Under EU and UK data-protection law, biometric data is special-category data when processed for uniquely identifying a person. Some U.S. laws are broader and regulate capture or processing of face geometry even without an identification database. A user's promise or contract with a depicted person may not satisfy a law requiring EVELI itself to provide a written notice and obtain that person's written release.
EVELI will not enable a designated real-person workflow unless it has completed the applicable biometric/privacy assessment, published purpose and retention/destruction terms, obtained any required subject-specific release and implemented deletion controls. Identification, face matching, authentication, emotion recognition, biometric categorization and surveillance remain prohibited.
3A. Sources of data
EVELI obtains data directly from you; automatically from your browser, device and Service activity; from your organization or an account administrator; from payment, authentication, security and generation providers; and from people who submit support, legal, copyright, safety or illegal-content reports. If a business customer provides information about another person, that customer, as controller, is responsible for giving the required notice. EVELI gives an Article 14 or equivalent notice only for processing for which EVELI is independently a controller and no exemption applies.
4. How and why we use data
| Purpose | Data | EU/UK legal basis |
|---|---|---|
| Create and manage accounts; deliver generations, projects, downloads and support | Account, customer content, generation, device, support | Contract; steps requested before contract |
| Process payments, credits, renewals, cancellation, refunds and tax | Account, billing, transaction, country | Contract; legal obligation |
| Secure the Service; prevent fraud, abuse, unauthorized access and rights violations | Account, customer content where necessary, device, logs, risk signals | Legitimate interests in security and rights protection; legal obligation |
| Moderate prohibited or illegal content and respond to notices | Customer content, logs, notice records | Legal obligation; legitimate interests |
| Troubleshoot and improve reliability, usability and generation quality | Generation metadata, logs, support, de-identified operational signals | Legitimate interests; contract where necessary to provide Service |
| Send transactional messages | Account, billing, support | Contract; legal obligation |
| Send marketing | Email and marketing choices | Consent where required; limited soft opt-in only where law permits and an opt-out is offered |
| Meet accounting, tax, corporate, regulatory and dispute duties | Account, billing, legal and transaction records | Legal obligation; establishment, exercise or defense of legal claims |
| Optional contribution of eligible content for generalized model improvement | Specifically selected eligible assets and consent record | Separate, explicit consent; never bundled with Service access |
Where EVELI relies on legitimate interests, it balances those interests against your rights and uses only reasonably necessary data. You may request information about that assessment.
EVELI does not use private customer content for generalized model training without a separate, optional, specific opt-in.
The August 11, 2026 repository review found no advertising network, data broker or cross-context behavioral-advertising integration in the customer application. EVELI does not sell personal information for money and does not use customer activity for targeted advertising. EVELI will reassess this statement before enabling any analytics, advertising, audience-matching or marketing integration and when a state-law coverage threshold is approached.
5. How we disclose data
We disclose data only as reasonably necessary to:
- cloud hosting, database, storage, authentication, security and content-delivery providers;
- payment, subscription, invoicing and tax providers;
- AI inference and generation providers acting under contract;
- email, support and communication providers;
- analytics providers enabled in accordance with cookie and consent rules;
- professional advisers, auditors, insurers and corporate transaction counterparties under confidentiality duties;
- authorities, courts or parties when legally required or necessary to protect rights, safety and the Service; and
- a successor in a merger, financing, reorganization or sale, subject to applicable notice and rights.
The current subprocessor list is published separately. EVELI contractually restricts subprocessors from using private customer content for their own generalized model training.
6. International transfers
EVELI is based in the United States and uses providers in the United States and other countries. Those countries may have different data-protection laws.
Where EU/EEA or UK transfer rules apply, EVELI uses an applicable adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, participation in an approved data-privacy framework where valid, and supplementary technical and organizational safeguards. You may request information about the relevant mechanism at legal@eveli.ai.
7. Retention
EVELI retains data only as long as reasonably necessary for the stated purpose, subject to the following default schedule and legal holds:
| Data | Default retention |
|---|---|
| Account, authentication and subscription records | Account life, then deletion or restriction after a verified request, subject to the financial, consent, security and legal records below |
| Browser-local casting state and session data | Until the user signs out, clears the relevant browser storage or deletes it through an available product control; browser-local data is not a cloud backup |
| Server-side casting state and private EVELI asset storage, when production persistence is active | Account/project life, then deletion after a verified request or product deletion control, subject to technical completion and documented legal holds |
| fal.ai request payloads | Up to 30 days under fal.ai's current default; EVELI's launch implementation must send the provider's no-payload-storage header before live customer generation is enabled |
| fal.ai temporary generated media | Provider-controlled until copied to EVELI's private storage and deleted or expired under the configured provider lifecycle; EVELI's launch implementation must set a short expiry and restricted access |
| Generation and security logs | A risk-based operational period, ordinarily no more than 12 months, with longer restriction only for a documented incident, abuse case or legal duty |
| Credit ledger, invoices, tax and transaction records | 7 years or longer if tax law requires |
| Contract acceptance, consent and withdrawal records | 7 years after account closure or the relevant transaction |
| Support communications | 3 years after closure, unless attached to a dispute or legal duty |
| Legal, copyright, DSA and fraud records | Duration of matter plus applicable limitation period, ordinarily up to 7 years |
| Marketing profile | Until opt-out, account closure or 24 months of inactivity; minimal suppression record retained to honor opt-out |
| Cookie choice | Until withdrawal, material purpose change or the next refresh required by applicable law and EVELI's configured consent policy |
Deletion may be delayed when necessary to preserve evidence, comply with law, resolve disputes, enforce agreements or protect safety. Retained data is restricted to that purpose.
8. Your rights
Depending on location, you may have rights to:
- access and obtain a copy of personal data;
- correct inaccurate data;
- delete data;
- restrict or object to processing;
- receive portable data;
- withdraw consent at any time without affecting earlier lawful processing;
- opt out of marketing;
- appeal certain privacy-request decisions;
- object to certain automated decisions; and
- complain to a data-protection authority.
EVELI does not make decisions producing legal or similarly significant effects based solely on automated processing.
Submit requests to legal@eveli.ai. EVELI may verify identity and authority proportionately. Authorized agents must provide proof of authority. EVELI will respond within the period required by applicable law, ordinarily one month under EU/UK law, subject to permitted extensions.
EU/EEA users may complain to the supervisory authority where they live, work or believe an infringement occurred. UK users may complain to the UK Information Commissioner's Office. EVELI asks that you contact legal@eveli.ai first so it can attempt to resolve the issue, but this is not a condition of complaining.
9. Marketing choices
Marketing consent is optional, separate from the Terms and unchecked by default. Transactional, security, billing and legal messages are not marketing.
Use the unsubscribe link in any marketing email or contact legal@eveli.ai. Opt-out may take a short operational period, but EVELI will retain a minimal suppression record so it does not re-enroll you accidentally.
10. Cookies and similar technologies
EVELI currently uses browser local storage for authentication session data, device-scoped identity, casting state and related product state. The customer application reviewed on August 11, 2026 contained no advertising or optional analytics integration. If EVELI later enables non-essential technologies, it will update the Cookie Policy and obtain consent before those technologies run where required.
11. Private-content training
EVELI does not train generalized AI models on private Inputs, references or Outputs by default. An optional contribution program, if offered, will:
- use a separate, affirmative and asset-specific choice;
- identify the content, purpose and withdrawal effect;
- exclude identifiable third parties, minors and confidential client work; and
- preserve proof of consent.
EVELI may use independently generated synthetic R&D assets and aggregated or de-identified operational statistics that do not identify a user or reveal private content.
12. Security and incidents
The reviewed implementation keeps Stripe, Supabase service-role and fal.ai credentials on server routes; verifies Stripe webhook signatures; fails closed when payment or generation safety switches are not enabled; stores live generated assets in a private Supabase bucket; issues time-limited signed asset URLs; and enforces user-scoped asset paths. Authentication tokens and local casting state are stored in the user's browser local storage, so users should sign out and protect access to their device. EVELI also uses transport encryption supplied by its hosting and service providers. No system is completely secure.
The review also identified two controls that must precede live customer generation: fal.ai payload non-retention and short-lived, restricted provider media. Until those controls pass an end-to-end test, EVELI will keep live customer generation disabled.
If a personal-data breach creates a notification duty, EVELI will notify authorities, affected customers or data subjects within legally required periods and provide information reasonably available at the time.
13. Children
The Service is for adults aged 18 or older. EVELI does not knowingly create accounts for children. Do not upload a minor's identifiable image. EVELI may block or remove such content, preserve legally required evidence and make reports required by child-safety law.
14. U.S. state privacy disclosures
Residents of certain U.S. states may have access, correction, deletion, portability, opt-out, sensitive-data limitation/consent and appeal rights. Authorized agents may submit requests where law permits. EVELI will honor legally recognized browser-based opt-out signals, including Global Privacy Control, when applicable.
EVELI will not discriminate against a person for exercising a privacy right. Submit requests through the process in Section 8.
The table below describes the customer application and repository reviewed on August 11, 2026. EVELI is below the California Consumer Privacy Act business thresholds based on its current pre-launch scale, but uses this disclosure as a transparent baseline and will reassess coverage as the business grows.
| U.S. disclosure | Verified production entry |
|---|---|
| Categories collected and sources | Identifiers and account data; subscription, transaction and credit-ledger data; browser/device and security data; casting briefs, prompts, references and generated images; product events, diagnostics, support and legal communications. Sources are the user, the user's browser and device, EVELI product activity, Stripe, Supabase, Cloudflare and fal.ai. |
| Business/commercial purposes | Account authentication, service delivery, generation, private storage, billing, subscription administration, support, security, fraud prevention, legal compliance and reliability improvement. |
| Categories disclosed for business purposes and recipient categories | Identifiers, transaction and device data to Stripe; identifiers, account and application data to Supabase; request and security data to Cloudflare; prompts, permitted reference images, generation parameters and temporary Outputs to fal.ai; support/legal communications to EVELI's email provider. |
| Categories sold or shared | None identified in the reviewed customer application. EVELI does not sell personal information for money and does not use customer data for cross-context behavioral advertising. |
| Sensitive personal information | The launch product prohibits identifiable real-person and minor images and does not use face data to identify or authenticate anyone. Credentials and payment information are used only for authentication, security and payment administration. |
| Retention criteria | The purpose-based schedule in Section 7, provider defaults disclosed there, user deletion requests, legal holds and statutory accounting duties. |
| Opt-out methods and browser signals | Because the reviewed product does not sell, share or use personal information for targeted advertising, no sale/share event is currently generated for Global Privacy Control to suppress. EVELI will treat a recognized signal as an opt-out before enabling any activity to which it legally applies. |
| Privacy-request appeal route | legal@eveli.ai with “Privacy Appeal” in the subject |
EVELI does not knowingly sell or share personal information of consumers under 16. The Service does not support accounts for anyone under 18.
14A. EU Data Act exports
Contractual switching and export rights for covered data-processing services are described in the Terms. They are separate from, and do not reduce, GDPR/UK GDPR access and portability rights.
15. Changes
EVELI may update this Notice. It will display the effective date and give advance notice of material changes where required. EVELI will not use a policy update to retroactively authorize generalized training on private content. New processing based on consent will require new consent.
16. Contact
Privacy questions and requests: legal@eveli.ai
Support: support@eveli.ai
Eveli, Inc., Attn: Privacy, 16192 Coastal Highway, Lewes, Delaware 19958, United States.