Privacy
Privacy Policy
Effective September 24, 2026. This policy covers the Evriq product (app.evriq.ai, customer workspaces, the mobile and command-line clients) and the evriq.ai website.
Evriq, Inc., a Delaware corporation ("Evriq", "we"), provides a multi-model, multi-agent workspace for teams. This policy explains what personal information we collect, how we use and share it, and the choices available to you.
1. Two roles
- Processor / service provider. When a business ("Customer") uses Evriq, the content its users put into its Workspace (repositories, prompts, agent transcripts, files, decisions, secrets) is Customer Data. We process it on the Customer's behalf and under its instructions, as described in our Terms of Service. If you use Evriq through your employer, direct privacy requests about Customer Data to your employer; we will help them respond.
- Controller / business. We decide how to process the account, billing, website, support and security information described below.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account and identity | Name, email address, organization, role, sign-in method, whether a second factor was used | You, your workspace administrator, Evriq's embedded identity service |
| Authentication records | Session identifiers, sign-in and sign-out times, IP address, user agent | Automatically, when you sign in |
| Customer Data | Repositories and files, prompts and agent transcripts, decisions and notes, vault secrets, uploaded attachments | You and your team (processed for the Customer) |
| AI provider credentials | API keys or cloud credentials your administrator supplies for the model providers your Workspace connects (for example Anthropic, OpenAI, Google, Mistral, DeepSeek, Ollama Cloud, Azure or an OpenAI-compatible endpoint) | Your administrator (stored encrypted, never shown again after saving) |
| Secrets and git host credentials | Values your administrators and project members add as Workspace or project secrets, and the tokens or keys you supply so agents can reach a git host | You (stored encrypted per Workspace, write-only: never displayed after saving; exposed only to agent runs in that Workspace, or in that project for a project secret, where an agent receives it as a plain environment variable; the exact value and its base64 and percent-encoded forms are masked out of stored output on a best-effort basis, and values shorter than four characters cannot be masked; each use is recorded by name, never by value) |
| Usage and metering | Agent turns, token counts and cost estimates reported by providers, feature usage, errors | Automatically |
| Audit records | Security-relevant actions such as sign-ins, permission changes, agent starts and refusals | Automatically |
| Notification endpoints | Browser push subscriptions and mobile device tokens | You or your administrator |
| Communications | Support requests, early-access requests, feedback | You |
| Billing | Billing contact, plan, payment status. Card details are handled by our payment processor, not stored by us, once card billing is enabled | You, our payment processor |
| Website | Aggregate page views and browser performance, collected by Cloudflare Web Analytics without analytics cookies | Automatically on evriq.ai |
We do not sell personal information and we do not use Customer Data to train machine-learning models.
3. How we use information
- To provide the Service: authenticate users, run agent sessions, route decisions, store and sync Workspace data, and send notifications you enable.
- To run agent turns: send prompts and the relevant repository context to the AI providers your Workspace has configured, using your organization's own credentials.
- To secure the Service: enforce access controls and multi-factor requirements, detect abuse, investigate incidents, and keep tamper-evident audit records.
- To meter and bill usage, and to provide support.
- To maintain and improve the Service, using aggregated or de-identified usage data.
- To communicate about the Service, including security and policy notices. We send marketing email only where permitted, and you can opt out at any time.
- To comply with law and enforce our terms.
Legal bases (EEA and UK users). Performance of a contract (providing the Service), legitimate interests (security, service improvement, business communications), consent (where we ask for it), and legal obligation.
4. AI providers
Evriq does not supply AI models. When your Workspace runs an agent turn, the prompt and the context the agent needs are sent to the provider your organization selected (for example Anthropic, OpenAI, Google, Mistral, DeepSeek, Ollama Cloud or xAI, or one of those models through Azure, Google Vertex AI or another gateway your administrator connected) under your organization's own agreement with that provider, using its own credential. That provider's privacy terms and data-retention settings govern what it does with the content. Evriq never runs customer workloads on shared or consumer subscription accounts. (Evriq's own internal workspace, which is not a customer workspace, runs on the company's own accounts and subscriptions.)
5. How we share information
- Subprocessors that host, secure, back up, authenticate and deliver the Service, bound by written obligations. The current list, with what each does, is at evriq.ai/subprocessors.
- Your organization. Workspace administrators can see account, membership and audit information for their Workspace.
- Providers you choose. AI providers and other services (for example git hosts or package registries) your users direct agents to use.
- Legal and safety. Where required by law, or to protect the rights, property or safety of Evriq, our customers or others.
- Business transfers. In a merger, acquisition or asset sale, subject to this policy.
6. Security
Each customer Workspace runs as a separate application instance under its own operating-system identity, with its own data directory and network restrictions. Stored secrets, provider credentials and backups are encrypted with AES-256-GCM. Traffic is encrypted in transit. Security-relevant actions are written to a hash-chained audit log. Workspaces can require multi-factor authentication. See the Evriq security overview for more detail.
7. Retention
| Data | Retention |
|---|---|
| Customer Data | For the life of the Workspace. Deleted within 30 days of a verified deletion request or of the post-termination export window |
| Encrypted backups | Rotated: all snapshots from the last 48 hours, daily for 14 days, weekly for 8 weeks |
| Sign-in sessions | Workspace sessions expire after 7 days without use. Core account and application sessions expire after 30 days. Privileged administrator sessions expire after 12 hours. Sessions may be revoked earlier |
| Audit records | For the life of the Workspace |
| Account information | For as long as the account is active, then 90 days |
| Billing records | As required by tax and accounting law |
| Support communications | 2 years |
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or port your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have the rights described in the CCPA and CPRA, including to know, delete and correct, and not to be discriminated against for exercising them. We do not sell or "share" personal information for cross-context behavioral advertising.
To exercise a right, email [email protected] with "Privacy request" in the subject. We will verify your request and respond within the time the law requires. If your information is Customer Data, we will refer your request to the Customer and assist it. You may also complain to your local data-protection authority.
9. International transfers
Evriq is based in the United States and the Service is operated from the United States. Where we transfer personal information from the EEA, UK or Switzerland, we rely on the Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.
10. Children
The Service is for business use by adults. We do not knowingly collect information from anyone under 18.
11. This website (evriq.ai)
The public marketing site at evriq.ai has no contact form, user account system, advertising tracker or newsletter signup. It uses Cloudflare Web Analytics to understand aggregate traffic and browser performance. The analytics script does not set analytics cookies and is not used for advertising or cross-site tracking.
If you email us about the product, we receive what you choose to send, including your email address, the message and any business context, and we use it to reply and to evaluate product fit. Please do not send secrets, production credentials, private repository contents, regulated data or customer data by email.
12. Changes
We will post changes here and update the date above. We will notify account holders of material changes by email or in the Service before they take effect.
13. Contact
Evriq, Inc. Privacy questions and requests: [email protected]. Security reports: [email protected].