Privacy information

Who is responsible

Published project identity for this beta: EVOPIEN · Spain. Use the app’s data controls for self-service or contact@evopien.com for a request. This is interim private-beta information; it does not claim complete commercial data-protection compliance or a designated data protection officer.

Information processed

We process your verified email and invitation status; the projects, tasks, goals, calendar entries, notes, approved memories and source text you save; capture Inbox drafts; conversation history and confirmation records; work preferences, estimates and completion information you provide; and technical access, error, usage and delivery records.

Linked Telegram adds your chat/user identifiers and messages to the bot. Optional mailbox/calendar connections add account identifiers, encrypted credentials or tokens, selected calendar entries and email metadata/summaries. Photographs and recordings can contain information about you or other people. Share only material you are entitled to provide; avoid unnecessary sensitive information.

Invitations and sign-in eligibility

The administrator can view the registered-user directory: email, active/revoked status, who invited the person, and invitation/acceptance dates when recorded. Missing historical information stays unknown. Active members can create and cancel their own pending invitations and view their own invitation records. This does not let members view another person’s projects, tasks, conversations or other workspace content. Only the administrator manages the full directory and reinstates revoked accounts.

The public sign-in eligibility check processes the email you enter against current membership and invitation status and explicitly reports whether that address is eligible. Eligibility is not proof of email ownership and does not grant workspace access. The application does not send one-time sign-in codes itself. Clerk performs sign-in and email-code verification on hub.evopien.com. Cloudflare Access continues to perform authentication and send its own codes on the older personal-ai-manager-evopien.lingering-salad-ba00.workers.dev address. A private policy-synchronisation component for that older address processes the email allowlist, invitation expiry/issuer eligibility, policy configuration and sync status. It does not return workspace content. Edge-policy updates depend on successful synchronisation and propagation; the app checks membership separately.

Invitation links expire after seven days and the server stores a code hash. Administrative invitation/member history has no automatic age-based deletion and is separate from workspace export/erase. A newly created private link is shown to its creator for copying; sharing it does not allow a different verified email to accept it. Importing workspace data never creates memberships, invitations or sign-in authority.

Private records and optional shared spaces

An app invitation and an accepted shared-space invitation are different permissions. Joining the app does not share your private tasks, calendar, email, memories, conversations or connected-account credentials. Shared spaces contain separately saved shared projects, tasks, events and notes. Only content you explicitly save there is published to participants allowed by the current space role; guests are limited to their invited project. Author identifiers, membership details, responsibility offers/responses, progress and activity can be visible to the participants allowed by those controls.

Finding, citing or linking a private source does not publish that source or grant another person permission to read it. If you copy private text into a shared note or task, that copied text becomes shared content. Private email, memory and AI context are not implicitly shared or fetched for other participants. Shared-space invitations are in-app only: those controls send no invitation email, Telegram notification or external-calendar write.

Revocation prevents subsequent shared access but cannot recall material already viewed, downloaded or copied. App revocation also deactivates non-owner space memberships and pending shared invitations; app readmission alone does not restore them. Owned-space ownership stays frozen behind the app gate and is not transferred. Shared Trash retains eligible content for 30 days; restoring content does not reactivate accepted responsibility. Shared activity and request receipts have a separate scheduled 90-day cleanup. Private workspace erasure does not remove shared content, shared membership or app-admission records. Use the separate shared-space leave, permission and reviewed content/Trash controls, or contact the operator about a broader erasure request. Other participants’ private workspaces are unaffected.

Account preferences and device drafts

Your selected interface language, appearance and welcome-completion preference are saved to your account and can be used on another signed-in device. These settings contain no task or source text. First-use progress and unsent recovery drafts also use browser storage scoped to the signed-in account; those drafts are not synchronised as account preferences.

Recoverable device drafts stop being offered 7 days after their last save. Expired entries are removed when read or when device data is cleared, rather than by a guaranteed background browser purge. Saving, discarding, changing accounts or using Clear saved device drafts clears the relevant local draft; signing out also attempts local draft clearing. A browser storage failure can prevent clearing or recovery, so follow the visible warning before sharing a device. Recovering a draft does not itself approve a change or turn it into a confirmed record. An explicitly saved Inbox capture remains an unapproved source until its separate conversion/review. Browser data, downloaded copies and provider copies need their own clearing controls.

Export and file recovery

Account export is a readable snapshot, not a promise that every archival section can be replayed. Supported UTF-8 JSON recovery files are limited to 24 MiB and uploaded to temporary account-scoped server staging in bounded parts. Uploading, validation and preview do not restore workspace records. Review the supported categories, counts and omissions before explicitly approving an additive restore. Imported historical records use fresh identifiers and do not restore credentials, connected accounts, membership, old approval authority or notifications.

Upload and indexed-preview staging initially expire after 24 hours. Progress through an approved indexed restore can extend its recovery window to 7 days from that progress. Source upload parts are removed after successful validated staging; indexed units are removed after completion. Expired staging is excluded from use and removed by scheduled cleanup, which depends on successful processing. Cancellation or a paused batch does not roll back earlier batches you already approved and saved; inspect the recorded progress before resuming. Private workspace erasure includes its restore staging. A shared-space snapshot is separate from private account recovery and cannot grant shared access or restore membership.

Purposes and legal bases

Account access, requested organisation features and support are provided to operate the service you request, relying on contractual necessity where applicable. Security and abuse prevention rely on the operator’s legitimate interest in protecting accounts and the service. Optional features are activated by your request and relevant provider authorisation; marketing or non-essential tracking is not bundled with access. Legal obligations apply where required.

The operator must confirm and document the applicable basis for each processing activity before wider launch. Authorising an OAuth connection is not blanket consent to unrelated uses. The beta is not offered as a service for children or for processing special-category information.

AI and media

Using an AI feature sends the message and selected relevant workspace context to OpenAI. Image interpretation sends the image; voice transcription sends the recording, then its transcript is interpreted. The app does not save raw uploaded image/audio files in its database. Transcripts, extracted information, conversation text and approved source records can be retained. Mail summaries send selected message content for analysis; optional semantic memory sends selected approved note content for indexing.

Responses requests use store:false. That does not mean zero provider retention. OpenAI’s published endpoint policies distinguish application storage, abuse monitoring, caching and exceptions; this deployment does not claim Zero Data Retention or verified EU-only processing. See OpenAI API data controls.

AI suggestions and estimates can be wrong. They do not independently commit permanent memories or tasks. Review and confirmation are required for proposed changes; explicitly enabled automations can run under their saved settings.

Task-specific conversations

When you send a message in a task discussion, the selected task and its subtasks, source notes, linked project and goals, recent reported completion records and recent discussion text can be sent to OpenAI. The app keeps at most 20 recent discussion entries per task, together with the latest reply and follow-up questions. These task discussions currently have no automatic age-based expiry. Deleting the task or erasing the workspace removes its discussion in the app. Deleting a source memory also clears all retained task discussions and proposal caches in your workspace to prevent copies of the removed text remaining there. Moving a source memory to Trash also clears those discussions and proposal caches; restoring that memory does not restore those conversations. The general assistant-history cleanup described below does not apply to task discussions.

Account export includes retained task discussion text. Restoring it attaches historical conversation text to the copied task; it does not restore active proposals, provider request tokens or permission to change tasks or goals. A new change still requires current source checks, a fresh proposal and your approval. Task-development proposals expire after 15 minutes. Scheduled cleanup removes expired pending/cancelled proposals and strips private source/plan snapshots from applied proposals after expiry; it removes the remaining applied proposal receipts after 30 days from creation. Expiry does not itself erase these records, and cleanup depends on successful processing.

Completed-work references

Work history summarises reported task outcomes and project state; it can include partial project progress. It does not independently verify that work happened or that a project succeeded. Saving a reviewed work reference retains your edited summary, outcomes, lessons and useful references, plus a snapshot of the selected task/project context and completion notes. This snapshot can retain earlier text after its source changes. Saving a reference does not complete a task or project. Demo examples are fictional.

A recorded-source draft works without AI. Requesting an AI draft sends the selected source and your instructions to OpenAI. When you ask to recall saved references, relevant non-Demo references may be included in the assistant context and reply. Reviewed references have no automatic age-based expiry: they remain until you delete them, erase the workspace or permanently delete an approved source memory whose private notes they retain. A separate permanent reference deletion removes that reference and its associated previews; it does not delete the original task, project or completion records.

Reference previews expire after 15 minutes. Expired previews are removed by supported preparation or scheduled cleanup; physical removal depends on successful processing. The reference portion of an export contains reviewed text and limited historical source metadata, rather than the full private source snapshot, approval preview or source-validation hash. Restored references are labelled imported historical text with new identifiers; they do not reactivate approvals, current-source claims or execution authority.

Language and first-time help

Your selected English/Spanish interface language and whether you completed the welcome are saved in your account. They have no automatic age-based expiry. A small browser preference, evopien-language, also caches the interface language until you change it or clear site data. Changing language does not translate or rewrite your saved notes, task names or original messages. Export can preserve your language preference; restoring it does not mark the welcome completed or grant access.

Offered actions and daily briefings

A short-lived typed offer can retain the proposed idea and its conversation/project context so that a relevant “yes” prepares the intended review instead of losing the follow-up. Offers expire after 15 minutes and scheduled cleanup removes expired offer records when it runs successfully. The original conversation can remain under its separate history rules. An offer or a reply to it does not itself import or restore permission to execute a change.

Briefing settings can retain your chosen local time, weekday choice, declared daily/weekly focus capacity and meeting-preparation preference. A daily briefing uses relevant owned tasks, calendar entries and selected approved context; a requested meeting-preparation view can show related notes, work and open questions. These summaries do not verify availability or completed work. Automatic morning briefings require your linked Telegram chat and enabled settings; they use existing notification controls, including quiet hours and current-source checks. The summary and selected context can be delivered to that private chat. Native calendar events retain their configured alert leads; defaults can be copied to new events and overridden or disabled individually. Provider acceptance, delivery and user acknowledgement are different states.

Learning from recorded effort

Effort learning is off until you enable it. While enabled, new real leaf-task completion reports can capture the estimate at completion, its source/project context and your optional actual minutes. Legacy estimates are not reconstructed from a task’s current duration. The comparison uses at least three eligible same-project reports, a current 180-day window and at most the latest 100 candidate records; it excludes Demo, unavailable, reopened, untrusted imported and incomparable records. These are self-reported comparisons, not independent measurements or a guarantee of improved accuracy. The lookback window does not delete older completion records.

When enabled, AI effort suggestions can receive an aggregate comparison summary rather than past completion notes. A separate history-based review can propose a provisional adjustment without an AI request; applying it still requires current task/source checks and your explicit approval. Previously history-adjusted or history-informed outputs do not train the same correction again. Disabling learning stops further capture and use but does not erase earlier comparisons. Clearing comparison history removes captured estimate baselines, internal calibration metadata and learning preview records; it preserves completion notes, recorded actual time and user-approved task estimates. It does not roll back an approved decision.

Learning previews expire after 15 minutes; scheduled cleanup removes expired preview records, including their applied review record, when it runs successfully. Source-memory deletion also clears related cached offers/comparison previews and removes completion records belonging to its deleted tasks. If you explicitly chose Memory Trash, its separately disclosed recovery snapshot can retain those completion reports until Trash expiry. Account export includes retained completion comparison data. Restored comparison data is historical and untrusted: it cannot enable learning or reactivate calibration/approval authority, and restore does not overwrite an existing preference.

Operational quality views

The private quality view calculates observed counts and available provider timings from retained request, notification and completion metadata for a selected seven- or thirty-day window. It does not add advertising or behavioural analytics. Missing or expired observations limit the result. These counters are not a validated product-quality score, intent-accuracy study, wrong-target rate, measure of notification usefulness or proof of time saved. They do not independently establish long-term reliability or verified work progress.

Optional One account authorization

If you connect through One, One stores provider credentials and processes requests for the accounts you grant. EVOPIEN keeps an encrypted reference. You choose which granted accounts to use for mail or calendar reading. Email summaries and appointment proposals require separate activation; calendar imports are manual. Provider calendars are read-only through One in this beta. Disconnecting in EVOPIEN removes its saved access reference. Revoke the grant and provider connections in your One dashboard to remove them there too. See One privacy information.

Providers and recipients

• Cloudflare: hosting, database, legacy-address authentication and technical service/security processing.
• Clerk: email verification, sign-in identifiers, sessions and authentication/security processing for hub.evopien.com.
• OpenAI: AI interpretation, planning, summaries, transcription and optional embeddings when used.
• Telegram: messages you send to the bot and replies/reminders delivered to your linked private chat when enabled.
• Google, Microsoft or Namecheap Private Email: only the accounts and permissions you separately connect. Connected inboxes are read-only: they do not provide general outgoing email. External-calendar reading is separate from optional publishing: changing external events requires stronger permission separately granted by you and review of each proposed change. A separately configured invitation-email service can send app invitations after an authorized member explicitly requests them; it does not gain access to connected inboxes.

The operator may access information when necessary to operate, support or secure the service or meet legal obligations. No advertising or data-sale feature is implemented. Invite administration does not give members access to one another’s workspace.

Provider processing may involve countries outside the EEA. EU-only residency, signed processing agreements and the applicable transfer safeguards have not been independently qualified for this deployment. Contact us for the current arrangements before placing business or sensitive data here.

Decision comparisons and daily experience reports

Reviewed decision comparisons keep your options, criteria, tradeoffs, unknowns, chosen reasoning and optional source links. They do not prove that an option succeeded or execute the decision. Daily experience reports store the ratings, reviewed-correctness counts, wrong-target changes, notification usefulness, time saved and notes you explicitly confirm. These are your reports, not independent measurements. Reliability views use saved provider-attempt and delivery statuses; Telegram acceptance does not prove device arrival.

Comparisons and experience reports remain until deleted or workspace erasure. Exports include them. Restore creates labelled historical copies with new identifiers and detached source authority; imported reports do not count as current pilot measurements. Meeting preparation and workload snapshots read existing records without automatically saving changes or sending notifications.

Progress, recovery and invitations

Task percentages and completion notes are user reports, checklist results or derived totals; they do not independently prove completed work. Moving a task, project or other supported record to Trash retains a recovery copy for 30 days. Recovery uses newer record versions and restores event alerts switched off; old approvals and scheduled placements are not reactivated. Copies that expire are purged by scheduled cleanup. Private workspace erasure includes its retained copies; shared-space content and membership follow the separate controls below.

App admission requires the exact verified email of the administrator or an accepted member. A pending invitation must be activated by its intended verified email. The separate public sign-in eligibility and private policy-synchronisation controls are described above. Administrators can inspect registered and invited accounts and revoke access. If invitation email sending is configured, Resend receives the intended email address, the invitation message and its expiring activation link. Delivery status distinguishes sending-service acceptance from confirmed inbox arrival.

Retention and deletion

Ideas are future possibilities kept separately from approved factual memory and user-reported completion records. Saved workspace records and Inbox drafts remain until you change or delete them. Inbox captures are drafts, separate from approved memory; processing one can prepare a proposal, but approval is required to commit its proposed memory, task or event. Archiving keeps data; it is not erasure. Account data controls export your records and provide an explicit workspace-erasure action. Membership/invitation administration and shared provider configuration are separate from workspace content. Copies you download or send to Telegram or another provider are not deleted by an app erase.

Supported task and calendar edits retain before/after recovery snapshots for 30 days. Undo is limited to supported changes with a reviewable current version; it does not overwrite later edits. Choosing Move to Trash explicitly retains an approved memory and its linked tasks, with limited related work context, for 30 days. Modern Trash restore requires a preview and confirmation, keeps the original record IDs with newer versions and preserves supported links within the reviewed group. Event alerts remain off; old approvals and scheduled placements are not reactivated. The separate legacy memory-copy history explicitly creates new IDs with detached old links; it is not the modern same-ID Trash workflow. Permanent Delete is a separate immediate-erasure action that purges the associated memory/task edit history and Trash recovery copies in the app; it does not create a 30-day recovery copy. Expired snapshots/Trash are excluded from recovery and removed by scheduled cleanup, which depends on successful processing.

General assistant conversation display is bounded to 20 turns per channel. Cleanup removes general assistant conversation records older than 30 days on supported history/background runs. Task-specific discussions follow the separate retention described above. Pending assistant previews expire after 15 minutes; expiry does not immediately delete the stored preview. Scheduled Telegram housekeeping removes assistant action and selected delivery/update records older than 30 days. Cleanup depends on successful processing; it is not an instantaneous deletion guarantee.

Email summary retention can be set to 7, 30, 90 or 365 days; the current default 0 means keep until deletion. Cleanup is incremental. Other audit/usage/automation records do not all have a fixed automatic expiry. Hosting backups, provider logs and legal retention have separate lifecycles; an immediate purge of every copy is not claimed.

Your choices and rights

You can edit records, disconnect integrations, disable future summaries/reminders and use workspace export/erase controls. Revoking provider authorisation stops future authorised access but does not erase copies already held by that provider. Browser drafts and downloads require separate local clearing.

Contact contact@evopien.com to request access, correction, erasure, restriction, portability or objection, and to withdraw consent where consent is the applicable basis. Rights depend on the circumstances and applicable law; necessary identity checks may apply. You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority. Statutory rights are not waived by using the beta.

The app proposes plans and priorities; it is not intended to make decisions producing legal or similarly significant effects about you. No access to professional, emergency or regulated services is promised.