Privacy Policy

Who we are

Evonx ("Evonx", "we", "us") operates the Evonx platform at evonx.ai, an AI-assisted software development service. This policy explains what personal data we collect, why, and the choices you have. For questions, contact [email protected].

For the account and usage data you give us directly, Evonx is the data controller. For personal data that sits inside the repositories, stores, and content you connect, we act as a processor on your instructions — you decide what is connected, and you can revoke that access at any time.

Data we collect

Account data. Your name, email address, and authentication details when you create an account or sign in with a supported provider (such as Google or GitHub).

Connected code and repositories. When you connect a repository or paste a repository link, we access its contents to provide the service: analysis, planning, code generation, previews, and pull requests. Repository access is granted through your Git provider and can be revoked by you at any time.

Content you provide. Prompts, messages, uploaded images, and other material you submit while using the platform.

Usage and technical data. Log data such as IP address, browser type, pages visited, and actions taken, used for security, debugging, and improving the service.

Session analytics. On our public website and inside the signed-in product we use Google Analytics and Microsoft Clarity to understand how people move through pages — clicks, scrolling, and anonymised session replays in which typed text is masked. Inside the signed-in product all text and images are masked in these replays, so your prompts, code and data are not part of them. This runs on our legitimate interest in improving the site and the product and, until you accept cookies, works without setting any analytics cookie: each page view gets a random identifier that is not linked to you or to your other visits. Accepting cookies lets these tools recognise returning visits; declining removes their cookies and stops session recording for your browser.

Billing data. Payments are handled by our payment processors; we do not store your full card details on our systems.

Connected Shopify stores

If you connect a Shopify store — through the Evonx app in the Shopify App Store or with a Theme Access password — we access the themes of that store so you can work on them in Evonx. We read the files of the theme you select (Liquid, CSS, JavaScript, images, and your own theme settings) and keep them in a private repository inside your workspace. When you choose to publish, we write the files you changed back to the theme you selected.

Evonx requests theme permissions only — read_themes and write_themes. We do not request or receive product, order, customer, or payment data from your store. The access token for your store is encrypted at rest on our servers, is never shown in the Evonx interface, and is never shared with a third party.

You can disconnect a store at any time from Evonx, or by uninstalling the app in your Shopify admin. Either action revokes the token. The data we hold for that store is deleted when Shopify sends the shop redaction request that follows an uninstall.

How we use data

We use your data to operate and provide the platform, to secure it, to communicate with you about your account and the service, to comply with legal obligations, and to improve the product. We do not sell your personal data.

AI processing

Evonx is built on large language models. To fulfil your requests, relevant portions of your prompts and connected code are processed by the AI model providers we work with, under agreements that restrict use of that data to providing the service.

Sharing

We share data only with service providers that help us run the platform — such as cloud hosting, AI model providers, and payment processors — and where required by law. Your source code stays in your repositories; changes we produce are delivered to you as pull requests.

Retention and deletion

We keep personal data for as long as your account is active or as needed to provide the service and meet legal obligations. Preview environments and their databases are short-lived and are removed when no longer needed. You can request deletion of your account and associated personal data by contacting us.

Your rights

Wherever you live, you can ask us to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Email [email protected] and we will respond within one month, or sooner where local law requires it. Exercising a right is free of charge; we may ask you to confirm your identity before we act on a request, and an authorised agent may make a request on your behalf.

EEA and United Kingdom (GDPR and UK GDPR). You have the rights of access, rectification, erasure, restriction, portability, and objection, and you can withdraw consent at any time without affecting processing carried out before the withdrawal. We process personal data to perform our contract with you (running the platform), on our legitimate interests (securing, debugging, and improving the service), on your consent (non-essential cookies), and to meet legal obligations. If you believe we have handled your data improperly, you can lodge a complaint with your local supervisory authority — in the United Kingdom, the Information Commissioner's Office.

International transfers. The infrastructure that stores your data runs in the European Union. Some of the providers we rely on — the AI model, payment, email, and analytics services listed at /subprocessors — process personal data in the United States. Where personal data leaves the EEA or the United Kingdom, we rely on a transfer mechanism recognised under the GDPR: an adequacy decision where one applies, and otherwise the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum.

California (CCPA and CPRA). California residents have the right to know what personal information we collect and how it is used, and to have it deleted or corrected. We do not sell or share personal information as those terms are defined under California law, and we do not use it for cross-context behavioural advertising, so there is no opt-out to make. We will not discriminate against you for exercising any of these rights.

Türkiye (KVKK). Residents of Türkiye hold the rights set out in Article 11 of the KVKK. The Turkish-language disclosure is at /tr/kvkk.

Security

Traffic is encrypted in transit with TLS, credentials for connected services are stored server-side, and preview environments run isolated per customer. Read more on our Security & Trust page.

Changes

We may update this policy from time to time. Material changes will be announced on this page with an updated date.