Privacy
What personal data this service holds, why it holds it, where it goes, how long it stays, and what you can ask us to do with it.
Who decides
Evidilo is operated by Zava Solutions LLC, a Wyoming limited liability company, whose registered address is 30 N Gould St Ste N, Sheridan, WY 82801, United States. It decides what happens to the data described here.
For a statement uploaded through a firm’s account, we read the statement on that firm’s instructions to produce the firm’s file, under the data processing terms, and we keep it and what was read from it under the licence in the terms. An upload made without an account has no firm behind it, so every decision about it is ours.
Evidilo is offered only to businesses established in the United States, and this notice is written for them and for the people named in what they upload. It is not offered to anyone in the European Economic Area, the United Kingdom or Switzerland.
What is held
Each row below is something the service holds, and where it came from. The list is the whole of it.
| Data | Where it came from |
|---|---|
| An account | The address a person signs in with, a name if they give one, the hash of a password if they set one, the address of the Google account they sign in with and Google’s identifier for it, the public key and the label of each passkey, an authenticator app’s secret, sealed, with the hashes of its recovery codes, and when they last signed in. |
| A session | The browser and the device a session was opened from, and the address its requests arrive from. |
| A firm and its members | The firm’s name and country, its plan and the pages it used, who accepted the data processing terms, when and which version, whether its owner said its clients agreed to training, its members with their roles, and the addresses its invitations were sent to. |
| A billing identity | Who pays for a firm’s plan. The card is typed on the payment provider’s own page and no card number reaches us. |
| The statement file | The file uploaded, whether by a person who is signed in or by a guest with no account. |
| The rows, the corrections and the export | The rows read from a statement, every correction a person makes to a row, and the export file produced from them. |
| The training record | Kept beside each statement file: what Evidilo read from it, each correction a person made to a row, the rows of the last download with its format, and whether the file is cleared for training. The record names no firm, account or browser; for a file uploaded without an account, the database keeps the browser’s cookie identifier beside the file. |
| The audit log | What each person did in a firm and when, such as who uploaded, viewed and downloaded which statement, with the address and the browser each request came from; and each acceptance of the terms, with the act, the version shown, the time, the address, and the account or, without one, the browser’s cookie identifier. |
| An address and a cookie | A browser that has not signed in carries a cookie and the address its requests arrive from. Together they count its free files for a day, and the cookie is what names the conversions this browser made without an account, so signing in from it takes those conversions over. |
| Analytics events and error reports | Sent to PostHog from two sides. The API sends one event per reading run: the run id, the bank, the page and row counts, the duration, an error kind, the output format, the status the run ended in, how many rows were corrected and which field of a row was corrected. The browser sends one event per step a visitor takes: the address of the page, the format and the size of the file they chose but not its name, the number of rows a result held and the code of a refusal. An error in the browser, the API or the worker is reported with its kind, where in the code it was raised, the product’s own code for it and the release, and with its message reduced to those. None of them carries the text of a statement, the rows read from it, an account number or the name of a file. |
The security page lists the same fields under what is recorded and what is never recorded.
Why it is held
Each purpose below is the only use made of the data in its row.
| Data | Used for |
|---|---|
| An account, a session, a firm, its members and its invitations | Providing the account the person or the firm asked for, and keeping it secure. |
| A statement, and its rows, corrections and export in the firm | Producing the file the firm or the guest asked for, and keeping it for the firm until the firm is deleted. |
| Every uploaded file and its training record, kept for good | Providing Evidilo. A file its firm cleared for training under the terms is also used to train and improve how Evidilo reads and converts statements. Any other file is used for nothing else, beyond protecting against a claim about the service and what a law requires. |
| A guest’s cookie and address | Running the free tool, and stopping a daily allowance from being reset by the same browser. |
| Analytics events and error reports | Knowing how a bank’s statements read, where a run breaks and which steps a visitor takes, and finding and fixing errors. |
| The audit log | Showing a firm who took which file, proving who accepted which terms, and protecting Evidilo against misuse. |
| Billing and tax records | Charging for a plan, and keeping the records tax and accounting law requires. |
Where it is processed, and who receives it
| Company | What it processes | Location |
|---|---|---|
| Railway | The application servers and the database, which holds the rows read from a statement. | Amsterdam, in the EU |
| Cloudflare | The upload in transit, as the TLS proxy for the domain, and the object store that holds every statement file and its training record, sealed under a key this service keeps apart from it. | The edge network; the stored files in Western Europe |
| DeepSeek | The page images of a statement whose layout needs a model. A statement that is a plain table or a CSV is read without it. Its terms for its API do not rule out training on what it receives; its privacy policy says it uses what users submit to train its models, and that it stores personal data in the People’s Republic of China. | China |
| PostHog | The analytics events and the error reports, from the API, the worker and the browser, which sends its own and so reveals the address the request comes from. No statement content. | United States |
| Stripe | Billing: the plan, the card and the invoices. The card is typed on Stripe’s own page and no card number reaches this service. | United States |
| Resend | The account mail: a sign-in link, an invitation, the confirmation of a new address. A message carries the address it is sent to and a link. | Sent from Ireland, in the EU. The account records Resend keeps about that mail, its metadata, logs and API records, are stored in the United States |
| When the sign-in screen offers Google, the browser loads Google’s own script from Google, which receives the address the request comes from and reads Google’s own cookies. A person who signs in with Google has Google send us the address of that Google account, whether Google verified it, and Google’s identifier for the account. | United States |
We do not sell personal data and do not share it for advertising. It reaches only the companies above, and whoever a law, a court order or a public authority requires us to give it to. If Evidilo’s business passes to a successor, the data passes with it under this notice.
Evidilo is operated by a United States company, and its data is held in the places above, the European Union and China among them. Copies of the files cleared for training are kept on a computer of ours whose disk is encrypted, to train and test how Evidilo reads statements, and are given to no AI assistant and no other company. Evidilo is offered only to businesses established in the United States, and not to anyone in the European Economic Area, the United Kingdom or Switzerland. A business established elsewhere, or acting for a client in those places, may not use Evidilo.
How long it is kept
Each row below is what the deployment holds today: the window recorded for it, and what deletes it, where anything does. The security page states the same.
| Data | Window recorded | What deletes it |
|---|---|---|
| A statement file, whoever uploaded it | For good | Nothing. Deleting a firm or an account leaves the file in the encrypted archive, detached from the firm, under the licence in the terms. Copies of a file cleared for training, made on a computer of ours to train and test the reading, are not deleted either. |
| The training record beside it | For good | Nothing; it stays with the file. |
| The cookie and address counting a guest’s free files | The count to the end of the UTC day, and the cookie for 24 hours from the upload that set it | The count expires with the day, and the cookie deletes itself. The cookie holds a random identifier and never the address; the address is what the day’s count is keyed on, so it goes when the count does. |
| The audit log, with the address of each upload, view and download and of each acceptance of the terms | None | Each entry carries the address the request arrived from, and nothing deletes the log on a schedule or when a firm or an account is deleted. |
| The rows, the corrections and the export file, in the firm | None | Deleting the firm removes the rows read from its conversions, the corrections made to them and its export files, and a new download deletes the export file of the same format it replaces; nothing deletes them on a schedule. What the training record holds of them stays. |
| The rows, the corrections and the export file of a statement uploaded without an account | None | Nothing, unless someone signs in from the same browser while its cookie lasts and takes the conversion into a firm, which then deletes them with the firm. The statement’s row in the database keeps the browser’s cookie identifier beside the file, and the audit log keeps the address the upload came from. |
| An account and its sessions | The account until it is deleted, and a session until it ends | Deleting the account removes its ways of signing in, its sessions, its memberships and the invitations sent to it, and the account itself. |
| Database backups | Six days, one copy a day | The platform deletes each copy when its six days are up. There is no point-in-time restore, so a restore returns the state of the last copy. |
| Analytics events and error reports | None set by us | Nothing in Evidilo deletes them; PostHog keeps them under its own terms for the project. |
| Billing and tax records | Seven years after the end of the tax year they belong to, and longer while a tax law, an audit or a legal claim needs them | Nothing deletes them on a schedule. Stripe keeps the invoices and the customer under its own terms, and a deleted firm’s row keeps its plan and its Stripe references with its name and details removed. |
If data is reached without authorisation
If someone without authorisation reaches data we hold, we give the notices the law of each affected person’s state requires of us, and tell a firm as the data processing terms say.
What you can ask for
You can ask for a copy of the personal data we hold about you, for a correction to it or for its deletion.
Deleting a firm or an account in the app removes what How long it is kept says it removes. A request for anything less is carried out manually. An uploaded statement file and its training record are kept under the licence in the terms, so a request to delete one is carried out only where a law that binds us requires it. Once its firm is deleted, nothing ties a kept file to a firm or an account, so we find it by what it contains, which the request has to describe.
Where a statement came from a firm’s client, the request belongs to the firm, and we pass it on and help the firm answer it. The firm is the party that answers its own client.
Send a request to [email protected]. It reaches the operator’s own mailbox, and the operator answers it.
Children
Evidilo is for businesses and not for anyone under 18. We do not knowingly collect personal data from a child, beyond what a statement a business uploads may name.
Changes to this notice
We post every change here with its date. We do not use data we already hold in a way this notice did not describe when we collected it, unless the firm or the person it came from agrees to that use.