Privacy Policy

EVEXOS ("we", "our", "us") operates the EVEXOS exhibition management platform at evexos.com and associated subdomains. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. It applies to all users, including account administrators, team members, and visitors.

1. Information We Collect

1.1 Account Information

• Name, email address, and password when you create an account
• Company name, job title, department, and business contact details
• Subscription plan selection and billing preferences

1.2 Billing Information

• Payment card details are processed directly by Stripe and never stored on our servers
• We store Stripe customer IDs and subscription metadata (plan, status, billing cycle)
• Invoice records and transaction history

1.3 Usage Data

• Pages visited, features used, and actions taken within the platform
• Device information, browser type, operating system, and IP address
• Error reports, performance metrics, and session replay data (via Sentry)
• Authentication events and access logs

1.4 Exhibition and Business Data

• Exhibition details, floor plans, booth configurations, and schedules
• Vendor, exhibitor, and attendee information you enter
• Documents, images, files, and media you upload
• Financial records, budgets, and procurement data
• Email campaigns, social media content, and marketing materials

1.5 AI-Processed Data

• Prompts and instructions submitted to our AI assistant (eveXana)
• Exhibition context data used to generate AI responses (exhibition names, dates, vendor lists)
• AI-generated content: booth designs, email copy, social posts, analytics insights, and recommendations
• Image generation prompts and resulting images

2. Legal Basis for Processing (GDPR Art. 6)

We process your data under the following lawful bases:

• Contract performance (Art. 6(1)(b)): Account creation, service delivery, billing, and support
• Legitimate interest (Art. 6(1)(f)): Platform security, fraud prevention, usage analytics, and service improvement
• Consent (Art. 6(1)(a)): Marketing communications, cookie preferences, and optional AI features
• Legal obligation (Art. 6(1)(c)): Tax records, regulatory compliance, and lawful data requests

3. How We Use Your Information

• To provide, operate, and maintain the EVEXOS platform
• To process subscriptions, invoices, and billing transactions
• To send transactional emails (account verification, password reset, notifications, billing alerts)
• To provide AI-powered features including eveXana chat, booth design generation, content creation, and analytics
• To improve our platform through aggregated, anonymised usage analytics
• To detect and prevent fraud, abuse, unauthorised access, and security incidents
• To enforce our Terms of Service and acceptable use policies

4. AI Data Processing

EVEXOS uses third-party AI providers to power its intelligent features. When you use AI features, the following data processing occurs:

• Google (Gemini / Vertex AI): Chat prompts, exhibition context, and image generation requests are sent to Google's AI APIs. Google processes this data under its Cloud Data Processing Addendum. Data is not used to train Google's general models when accessed via API.
• OpenAI: Image generation prompts are sent to OpenAI's API. OpenAI does not use API data for model training. See OpenAI's enterprise privacy commitments.
• Other configured providers: If your organisation's administrator configures additional AI providers (e.g., Groq, OpenRouter), prompts may be routed to those providers under their respective data processing terms.

AI prompts may include exhibition names, vendor names, and other business context you provide. We recommend not including sensitive personal data (national ID numbers, health information) in AI prompts.

5. Data Sharing and Sub-Processors

We do not sell your personal data. We share data only with:

• Google Cloud Platform / Firebase: Authentication, database hosting, file storage, and Cloud Functions (data processing agreement in place)
• Stripe: Payment processing — Stripe is PCI DSS Level 1 certified (data processing agreement in place)
• Resend: Transactional email delivery
• Sentry: Error tracking, performance monitoring, and session replay (data processing agreement in place)
• AI providers: Google (Gemini/Vertex AI), OpenAI, and administrator-configured providers (see Section 4)
• Legal requirements: When required by law, court order, or governmental request

6. Multi-Tenant Data Isolation

EVEXOS is a multi-tenant platform. Each organisation's data is logically isolated using tenant-scoped database queries, role-based access control, and Firestore security rules. Your exhibition data, team members, documents, and AI conversations are not visible to or accessible by other tenants.

7. Data Security

• All data encrypted in transit (TLS 1.2+) and at rest (AES-256 via Google Cloud)
• API keys encrypted server-side before storage using AES-256-GCM
• Role-based access control with Firebase custom claims
• Tenant data isolation enforced at database, API, and Firestore security rules layers
• Authentication via Firebase Auth with support for email/password and OAuth providers
• Rate limiting on all API endpoints

8. Data Retention

• Active accounts: Data retained for the lifetime of the account
• Account deletion: Personal data removed within 30 days of deletion request
• Billing records: Retained for 7 years as required by tax regulations
• Security logs: Retained for 90 days for incident investigation
• AI conversation history: Retained while account is active; deleted with account
• Backups: Purged within 30 days of data deletion from production systems

9. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Correct inaccurate or incomplete data
• Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Restrict processing (Art. 18): Limit how we use your data
• Data portability (Art. 20): Receive your data in a structured, machine-readable format
• Object (Art. 21): Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw at any time

To exercise these rights, contact us at privacy@evexos.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

10. Automated Decision-Making

EVEXOS uses AI to generate recommendations, content suggestions, and analytics insights. These outputs are advisory and do not constitute automated decision-making with legal or similarly significant effects as defined under GDPR Art. 22. All AI outputs require human review and approval before taking effect.

11. Cookies and Tracking

Essential Cookies

• Session cookie: Maintains your authenticated session (strictly necessary)
• Theme preference: Stores your light/dark mode selection (localStorage)
• Cookie consent: Records your cookie preference (localStorage)

Analytics and Error Tracking

• Sentry: Error tracking and performance monitoring. May record session replays with all text masked and media blocked. Can be declined via the cookie consent banner.

We do not use advertising cookies or third-party tracking pixels. You can manage your preferences through the cookie consent banner.

12. International Transfers

Your data is primarily stored in Google Cloud regions. It may be processed in countries outside the EEA by our sub-processors (Stripe, Sentry, AI providers). We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs) with sub-processors
• Data processing agreements with all service providers
• Verification that sub-processors maintain adequate security certifications

13. Children's Privacy

EVEXOS is a business-to-business platform not directed at individuals under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@evexos.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to account administrators and through a notice on our platform at least 14 days before taking effect.

15. Contact

For privacy-related questions, data subject requests, or concerns, contact us at:

• Email: privacy@evexos.com
• Subject line: "Privacy Request — [Your Company Name]"