Privacy Policy

01Introduction and who we are

This Privacy Policy explains how EvlarSoft LLC (“EvlarSoft,” “we,” “us,” “our”) collects, uses, discloses, retains, and protects personal information in connection with our websites, applications, APIs, and related services (the “Products”), and describes the rights and choices available to you. It applies across all of our Products — the Verve family (APIVerve, VerveKit, VerveSheets, VerveContext), DigestYourFinances, and our applications. Because a single entity stands behind every Product, one policy governs them all; where a specific Product requires additional detail, it will point back to this document.

For personal information we collect about our own users, EvlarSoft acts as the “controller” (or “business”). Where we process personal data on behalf of a customer that uses our Products to process its own users' data, we act as a “processor” (or “service provider”) under our Data Processing Addendum, and that customer's privacy notice governs. By using the Products, you acknowledge the practices described here.

02Information we collect

We collect the following categories of personal information:

• Identity and account data — name, username, email address, password (stored in hashed form), and organization details you provide when registering or configuring an Account. For an EvlarSoft One account, password and email sign-in is handled by Google Firebase Authentication, and EvlarSoft never sees or stores your password.
• Contact data — email address and any information you include when you contact us for support, sales, or other requests.
• Billing and transaction data — plan, billing contact, transaction history, and limited payment details. Full payment-card numbers are handled by our payment processor and are not stored by us.
• Content you submit — the inputs, queries, prompts, files, and other data you send to a Product so it can return a result, together with the resulting Output.
• Usage and log data — API requests and request counts, feature usage, timestamps, referring pages, and diagnostic logs we generate as you use a Product. Request counts are used to meter usage against your plan.
• Device and technical data — IP address, browser type and version, operating system, device identifiers, language, and similar technical information.
• Cookies and similar technologies — as described in our Cookie Policy.

You are not required to provide all of this information, but some of it is necessary to create an Account or use certain Products; without it, those Products may be unavailable.

03How we collect it

We collect information: (a) directly from you, when you register, configure a Product, submit content, make a payment, or contact us; (b) automatically, through cookies, logs, and similar technologies as you interact with the Products; and (c) from third parties, such as our payment processor, analytics and infrastructure providers, and, where you sign in through a third-party identity provider, that provider — in each case as described in our Subprocessors page.

04How we use your information

We use personal information to:

• provide, operate, maintain, secure, and improve the Products;
• create and administer your Account and authenticate you;
• meter usage, process payments, and manage billing;
• respond to your requests and provide customer and technical support;
• send service and transactional messages, and, where permitted, product updates;
• monitor, detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Acceptable Use Policy;
• analyze usage to understand and improve reliability, performance, and features;
• comply with legal obligations and enforce our agreements.

We do not sell your personal information for money, and we do not use the content you submit to a Product to train machine-learning models except where you have explicitly opted in.

05Legal bases for processing

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases: performance of a contract, to provide the Products you request; legitimate interests, to secure, improve, and market our Products in ways that do not override your rights; consent, where required — for example, for non-essential cookies or certain communications, which you may withdraw at any time; and legal obligation, where processing is necessary to comply with the law.

06How we share your information

We disclose personal information only as described here:

• Service providers / subprocessors — trusted providers who process data on our behalf for hosting, infrastructure, payments, email, analytics, and support, under contracts requiring them to protect it and use it only for us. See Subprocessors.
• Legal and safety — where we believe disclosure is reasonably necessary to comply with a law, regulation, legal process, or governmental request, to enforce our terms, or to protect the rights, property, or safety of EvlarSoft, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case this policy will continue to govern the information transferred, or you will be notified of any materially different policy.
• With your direction — when you ask us to share information or integrate a Third-Party Service.

07International data transfers

EvlarSoft is based in the United States, and we and our providers may process personal information in the United States and other countries whose data-protection laws may differ from yours. Where we transfer personal data across borders in a manner requiring a safeguard, we rely on an appropriate legal mechanism, such as standard contractual clauses or an equivalent protection recognized under applicable law.

08Data retention

We keep personal information for as long as your Account is active or as needed to provide the Products, and thereafter only as necessary to comply with our legal obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. When information is no longer needed, we delete or anonymize it. Retention periods vary by the type of data and the purpose for which it was collected; log and diagnostic data are generally retained for a limited period.

09How we protect your information

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction — including encryption in transit, access controls, and monitoring. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential; please notify us immediately through the contact page if you believe your Account has been compromised.

10Your rights and choices

Depending on where you live, you may have some or all of the following rights regarding your personal information: to access it; to correct inaccuracies; to delete it; to port a copy; to restrict or object to certain processing; to withdraw consent where processing is based on consent; and to be free from unlawful discrimination for exercising these rights. You can exercise many of these from your Account settings, or by contacting us. We will respond within the time required by applicable law and may need to verify your identity first.

You can also opt out of non-essential cookies through the controls described in our Cookie Policy, and you can unsubscribe from marketing emails using the link in those emails or, with an EvlarSoft One account, on the Profile page at my.evlarsoft.com; we may still send you service-related messages.

11Region-specific disclosures

European Economic Area / United Kingdom.You have the rights described above under the GDPR and may lodge a complaint with your local supervisory authority. Our legal bases are set out in the “Legal bases” section.

California.Under the CCPA/CPRA, California residents have rights to know, access, correct, and delete personal information, to opt out of “sale” or “sharing” of personal information (we do not sell personal information for money), and to limit use of sensitive personal information, without discriminatory treatment for exercising these rights. You may submit a request through the contact page.

Other U.S. states. Residents of states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of targeted advertising or profiling; contact us to exercise them.

12Do Not Track and automated decisions

Because there is no consistent industry standard for “Do Not Track” signals, our Products may not respond to them; we describe your cookie choices in the Cookie Policy. We do not use personal information to make decisions that produce legal or similarly significant effects about you solely by automated means without a lawful basis and appropriate safeguards.

13Children's privacy

The Products are intended for a general, adult audience and are not directed to children under the age required for consent in their jurisdiction (and in no event under 13). We do not knowingly collect personal information from such children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

14Google Workspace add-ons (VerveSheets, VerveKit)

Certain Products are distributed as Google Workspace add-ons for Google Sheets. When you run an add-on, it accesses the contents of the cell range you select in the spreadsheet you have open — and only that spreadsheet — using Google's spreadsheets.currentonly scope. Those input values are transmitted to the APIVerve API over an encrypted connection for the sole purpose of returning the data you requested, which is then written back into your sheet. We do not access spreadsheets you have not opened the add-on in, we do not use Google user data to train models or to serve advertising, and we do not sell it.

VerveSheets' and VerveKit's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15EvlarSoft Link (connecting your phone)

This section applies to every EvlarSoft application that offers EvlarSoft Link, which connects your phone to the application on your PC. To pair, you scan a QR code that the application shows on your PC, and your phone opens a page at link.evlarsoft.com in its browser. There is nothing to install and no account to create. EvlarSoft Link is free and is part of the application.

What travels between your devices. What an application exchanges with your phone depends on what that application does: for example controls and settings, live readings and levels, text, audio, or camera images. Whatever it is, it goes only between your phone and your PC, over the encrypted connection described below.

How your phone and PC connect. Everything between your phone and your PC is encrypted, whichever way they connect. They try three ways, in this order:

• Directly between the devices, on the same Wi-Fi or over the internet on most networks, including most mobile data. This uses WebRTC, which is always encrypted end to end. There is no relay server: your data goes straight from one device to the other and never passes through EvlarSoft's servers.
• Over the same Wi-Fi, through a small server inside the application on your PC. Messages are encrypted (XChaCha20-Poly1305) with a key carried only in the QR code's link. That key sits in the part of a link that browsers never send to any server.
• Through your PC's own Wi-Fi network, as a last resort. The PC creates a network (Wi-Fi Direct) with a new password each session, and sends that password to your phone encrypted. Your phone joins that network and has no internet access while it is on it. This works only if your PC's Wi-Fi adapter supports it.

If one connection drops, your phone switches between Wi-Fi and the internet on its own, and rejoins by itself after a short drop.

The handshake server. link.evlarsoft.com runs on Cloudflare Workers, so Cloudflare processes it on our behalf (see Subprocessors). It only introduces your phone to your PC by passing along connection-setup messages, which include the devices' network addresses. It never sees what you send, and it stores nothing about you:

• each session room is deleted when it ends: after 2 hours at most, or 10 minutes idle;
• no request logs are kept;
• to limit abuse, it counts requests against a scrambled code that changes daily, not against your address itself;
• it logs only how many requests it turned away, with no addresses;
• it keeps only a hash of each code's key, never the key;
• it keeps daily totals for each app: codes made, pages opened, phones connected and how, and problems shown. Nothing in them identifies a phone, a PC or a person.

Bot check. On the phone page, Cloudflare Turnstile checks in the background that the visitor is not a bot.

Your IP address.Your phone's and your PC's IP addresses are seen in passing while they connect, and are never stored with anything you send. The handshake server sees them to pass along connection-setup messages and to limit abuse, as described above. Cloudflare Turnstile sees your phone's address for the bot check. To find each other, each device also asks a public STUN server, run by Cloudflare or by Google, for its own internet address; that server sees the device's address and nothing else.

Codes and control. A code expires after 2 hours at most. If a phone is connected when that happens, the connection carries on and your PC quietly issues a new code. Only one phone connects at a time, and a new scan takes over. Your PC shows what is connected, by name, and can disconnect it at any time.

Camera images and other captured content. If an application streams camera images, audio or anything else it captures to your phone, it travels over the same encrypted connection directly between your devices, only while the phone page is open. It is never sent to or stored by EvlarSoft: the handshake server accepts only small connection-setup messages and cannot carry it.

What is kept, and where.No content is stored online. What you record or type is saved on your PC. The phone page uses no tracking cookies. It reports how it connected, or which problem it hit, to add to those daily totals, and sends nothing else with it. It remembers only your theme, screen-on and phone-name choices, in your phone's own browser storage. See also EvlarSoft Link.

16EvlarSoft One (your EvlarSoft account)

EvlarSoft One is a free account you can use with our Windows applications from the Microsoft Store and with our websites and services, such as APIVerve, VerveKit, VerveSheets and VerveContext. You manage it at my.evlarsoft.com. Using One is optional: the applications work without an account.

Signing in.You sign in in your web browser with Google or with your email address. Sign-in is handled by Google Firebase Authentication. When you sign in from a Windows application, the browser hands the application a one-time code over a local connection on your PC, which the application exchanges for a session. That session is stored on your PC, encrypted with Windows' own data protection (DPAPI), and is shared by the EvlarSoft applications on that PC so you sign in once.

What we store. Your account data is kept in Google Firebase Realtime Database. Our Windows applications reach it only through our API at api.evlarsoft.com, which runs on Cloudflare Workers, and never contact Firebase directly (see Subprocessors). It holds:

• your profile: your name, your email address, whether you want marketing emails and when you set that, and when the account was created and last updated;
• the EvlarSoft applications you have signed in to, with when each was first and last seen. This is recorded when you sign in, and at most every few hours when an application starts;
• settings backups: each application's settings, up to 256 KB each, with the time they were saved, so a new PC can bring them back. Window positions are not included.

Your choices.Backups can be turned off for each application on each PC, and turning them off offers to delete the saved copy. You can also delete a backup on the Backups page. Marketing emails are optional, and you can turn them off at any time on your account's Profile page.

Links. Links from the account pages carry tags that tell us which page and placement was used: UTM parameters on web links, and a Microsoft Store campaign ID on Store links. One adds no third-party advertising trackers.

Deleting your account. You can delete your account yourself at my.evlarsoft.com, under Profile, by typing your email address to confirm. This permanently deletes your backups, your application list, your profile and your sign-in account at once, and applications on your PCs sign out the next time they check in. Deletion is immediate; copies may remain in our providers' backups for their standard retention periods.

17Third-party links and services

The Products may link to or integrate with Third-Party Services that we do not control. This policy does not apply to those services, and we are not responsible for their privacy practices. We encourage you to read the privacy notices of any third party you interact with. See also our Affiliate Disclosure.

18Changes to this policy; contact

We may update this Privacy Policy as our Products and legal obligations evolve. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Products after changes take effect means you accept the revised policy. For any privacy question or to exercise your rights, please reach us through the contact page.