The short version
Evatin holds your business records: your leads and clients, your notes and tasks, your files, the bookings people make through your booking page, the progress your clients log if you are a health or nutrition coach, and the transcripts of calls you chose to record. It lives on servers in Sydney, Australia. A small number of companies help run it, and every one of them is named below along with exactly what it sees. We don't sell any of your data, we don't share it with anyone else, and we don't use it to train Eva or anything else.
You can take a copy of everything at any time, and you can delete your account yourself. When you do, it's gone.
Who we are
Evatin is based in Australia. In this policy, "Evatin", "we", "us" and "our" all mean Evatin: the app at app.evatin.com, the website at evatin.com, and the team that runs them. "Eva" is the assistant inside the app.
Contact: hello@evatin.com
What Evatin collects
Your account
- Your email address and sign-in credentials. Passwords are stored hashed by the sign-in service, never in plain text, and never where we can read them.
- Your name, your timezone, and a profile photo if you add one.
- A record of which version of the terms and the points shown at sign-in you agreed to, and when.
- Your plan, and how much of its allowance you've used this month.
Your business records
Everything you put in, and the things Eva works out from it:
- Leads and clients: names, email addresses, phone numbers, pipeline stage, and the notes you keep against each of them.
- Notes, tasks and reminders, including the ones Eva creates from your calls.
- Files you upload: proposals, worksheets, pricing sheets, programme outlines. Private to you, never shared with the client they relate to.
- Bookings made through your booking page: the name, email address and answers the person gave, the time they chose, and their time zone.
- Calls you chose to record: the transcript, the meeting link, when it happened, how long it ran, what Eva concluded from it, and when you paused her.
- Client progress, for health and nutrition coaches only: if your account is set up for health and nutrition coaching, what your clients log on their own page or what you enter for them, such as their weight, what they ate and photos of their meals, how they're feeling, notes to you, and progress photos, which can show their body. Also the plan you set for them: goals, targets, a meal plan file, and health notes, which are never shown to the client. Some of this is health information, which the law treats as sensitive. See Your client's own page.
- Your conversations with Eva, and the small set of durable things she remembers about how you like to work. She remembers preferences and corrections, not a running log of your day.
- Your business profile: what your business does, who you work with, how you price.
Collected on its own
- Ordinary server logs: the time of a request, the page asked for, the IP address it came from, and any error that happened. These are kept by the hosting provider for a short period and we read them only to fix things.
- When you last opened the app, so Eva knows if you have been away. Only the most recent time is kept, not a history of visits.
- If you turn on notifications, a push subscription: an address your browser hands out so it can be reached, and the keys needed to encrypt what is sent to it. It identifies a browser, not a person, and it is deleted when you turn notifications off or the browser revokes it.
- When you sign up, sign in or ask for a password reset, a check by Cloudflare Turnstile that you are a person and not a bot. It looks at signals from your browser for that one purpose, sets no tracking cookies, and is not used for advertising.
There is no analytics in the app, no advertising pixel, and no other tracking of any kind. The website is different; the This website tab says what it uses.
How we use it
- To run Evatin for you. Storing your records, showing them back to you, and letting Eva read them so she can answer questions, write your briefing, and fill in what a call produced.
- To reach you about your account. Emails about using Evatin: sign-in and password emails, a welcome and the occasional check-in, a note from Eva if setup is unfinished or you have been away for a while (which you can stop from the email itself), notices about your plan, and the reminders and briefings you asked for. Nothing promotional is sent to an app account.
- To email the people who book with you, on your behalf. Emails about their booking only, such as a confirmation, a reminder before the call, or a note if it’s cancelled. See Your booking page.
- To keep Evatin running. Enforcing plan limits, taking payment for a paid plan, and reading logs when something breaks.
That's the list. Your data isn't used for advertising, isn't sold, isn't shared for anyone else's purposes, and isn't used to train any model.
Who else touches it
The app is built on a handful of services. They are infrastructure: none of them are advertisers, none are data brokers, and none get your data for their own use. Here is each one, what it holds, and where.
| Service | What it does | What it sees | Where |
|---|---|---|---|
| Supabase | The database, file storage and sign-in | Everything listed above. Also sends the sign-in and password emails. | Sydney, Australia |
| Vercel | Runs the app | Your data passes through as pages are built; nothing is stored beyond ordinary server logs. | Sydney, Australia |
| Cloudflare | Checks that a sign-up or sign-in comes from a person rather than a bot | Signals from your browser, used only for that check. No tracking cookies, and nothing that identifies you. | Worldwide (Cloudflare’s network) |
| Stripe | Takes payment for paid plans | Your name, email address, card details and subscription. You enter your card with Stripe directly; Evatin never sees or stores it. | United States and elsewhere (Stripe’s network) |
| Zoho Mail | Sends Evatin's own emails: about your account and about bookings | Who the email is to and what it says: for a booking, the person's name and email address, the time, your name and the meeting link. | Australia |
| Recall.ai | Joins and records the calls you ask Eva to join, and produces the transcript | The audio and video of a recorded call, for 48 hours, then deleted. See Call recording. | Frankfurt, Germany (EU) |
| Anthropic | Runs the model behind Eva | The part of your data Eva needs for the answer in front of her. See Where Eva thinks. | United States |
| Push services | Deliver notifications to your browser, if you turn them on | An opaque delivery address and an encrypted message. The service (Apple, Google or Mozilla, depending on your browser) cannot read the contents. | Depends on your browser |
If any other service is ever added, this page changes first.
Where Eva thinks
Eva is built on Anthropic's Claude models. When you talk to her, when she writes your morning briefing, when she reads a call, or when she summarises a file you uploaded, the relevant part of your data is sent to Anthropic to produce the answer. She's sent what she needs for the task in front of her: your open tasks, your pipeline, the names on your list, the transcript being read. Not your whole account.
Anthropic deletes what it receives within 30 days, and does not train its models on it. Both of those are Anthropic's published commercial terms for the kind of account Evatin runs on, checked at the source on 31 August 2026, and checked again whenever this page is reviewed.
Anthropic processes in the United States. There is no European processing option at the time of writing. That matters if you have a client whose contract requires their data to stay in Europe; see Data residency.
Call recording
This is the part that involves someone other than you, so it gets its own section.
Eva only joins a call when you ask her to. She appears as a visible participant with a name, so everyone can see she's there. Tell the other person before she joins. In most Australian states every party to a private conversation has to agree to it being recorded, not just the person doing the recording, and the law where the other person is may say the same. Eva showing up in the participant list is a backstop, not consent. Getting that agreement is your responsibility, and the terms say so.
What happens to a recording:
- Recall.ai records the call and produces a transcript. Recall deletes the recording, audio, video and its own copy of the transcript, 48 hours after the call.
- Evatin downloads the transcript when the call ends and keeps it in your account. That's the copy you read on the Calls page. Evatin does not keep the audio or the video.
- Eva reads the transcript once to work out what happened and what was agreed. That reading goes to Anthropic, under the terms above.
- You can pause Eva during a call. While she is paused, nothing is recorded or transcribed, and she says so in the meeting's chat so everyone can see it. The transcript shows that the call went off the record and for how long, and nothing of what was said.
How long the transcript is kept is up to you. A new account keeps transcripts until you delete them. In Settings you can instead choose a window, from 7 days to a year, after which transcripts clear on their own. And you can delete any single transcript at any time, with the option of downloading a copy first.
Deleting a transcript removes the words. The record that the call happened, when, how long it ran and who it was with, stays in your account until the account is deleted, along with anything Eva wrote from it. That is deliberate: it is what lets Evatin count calls against your plan without keeping what was said.
Your booking page
This is the other part that involves someone other than you.
If you turn bookings on, you get a public page at an address you choose, where people can book a call with you. Anyone with the link can open it. It shows your name, your business name, your photo if you added one, the call's title, description, length and where it happens, and the times you're open. Nothing else from your account is on it, and search engines are asked not to list it. When bookings are off, it shows only the message you wrote for that.
The page reads the visitor's time zone from their browser so it can show your times in theirs. That isn't stored unless they book.
When someone books:
- What they entered (their name, email address, what they'd like help with, and the answer to your question if you asked one) is kept in your account, with the time they chose and their time zone. It becomes a lead, or is added to the lead or client who already has that email address.
- We send them emails about their booking only: a confirmation with a calendar invite (and the meeting link if you added one), a reminder before the call, and a short note if it’s cancelled. They are sent through Zoho Mail on your behalf, and a reply goes to you, not to us. They don't get an Evatin account.
- If you've set Eva to join booked calls, the call is recorded on the same terms as any other. See Call recording.
The people who book with you are your contacts, the same as any other lead. See About the people in your records.
Your client's own page
This is only for accounts set up for health and nutrition coaching; other accounts don't have it. If you give a client their own page, this is a third part that involves someone other than you, and it can hold health information, so it gets its own section too.
- The page has an address and a four-digit PIN that you give the client. Anyone with both can open it, so they should keep them to themselves. Ten wrong PINs lock it for fifteen minutes. You can change the PIN at any time, which locks out the old one.
- Once the PIN is right, a cookie on the client's device keeps them signed in to that page. It identifies the page, not the person, and holds nothing else.
- On it, the client sees their progress, their plan, the meal plan file if you added one, and your replies to what they logged. They never see your health notes, your other records, or anything about anyone else.
- What they log (their weight, meals and meal photos, how they feel, notes, progress photos) is stored in your account in Sydney, the same as everything else. It is your record of your client, and they don't get an Evatin account.
- Eva may read it, under the terms in Where Eva thinks, when it is relevant to something you've asked her.
Health information and photos of someone's body are sensitive. Before a client uses their page, tell them what it collects, that you can see it, and how long you keep it, and get their agreement. The terms say this is your responsibility. Deleting a client deletes what they logged.
Showing Evatin in your own calendar
If you connect your calendar (Settings, Integrations), Evatin gives you a private link that your calendar app reads, such as Apple Calendar, Google Calendar or Outlook. It carries your calls, bookings, events, reminders, check-ins and follow-ups: their times, titles, the names of the people they're with, meeting links, and links back into Evatin. Your calendar provider then holds a copy of those events under its own privacy terms. It only goes one way: Evatin never reads your calendar. Anyone who has the link can see these events, so keep it to yourself. You can reset it at any time, and the old link stops working straight away.
Files you upload
When you attach a file to a client or your business profile, the text inside it is extracted and Eva writes a short summary, so that she knows the file exists and what it's for. That summary is produced by Anthropic under the terms above. Day to day Eva is shown only the file's name and that summary; she opens the full contents only when a question you've asked needs them.
Files are stored in Sydney alongside your other records and are never shared with the client they relate to. The one exception is a meal plan you choose to put on a client's own page: a copy is kept with the page so that the client can open it.
Files you hand to Eva in a chat, or to bring clients in with Import, are different. They go to Anthropic for that one answer and are not stored by Evatin: the conversation keeps only a line saying a file was attached, and Import keeps only the client details you chose to add.
How long it is kept
| What | Kept for |
|---|---|
| Recordings held by Recall.ai | 48 hours after the call. |
| Call transcripts in Evatin | Until you delete one, or until the retention window you set in Settings runs out. With no window set, until your account is deleted. |
| Leads, clients, notes, tasks, reminders, files | Until you delete them, or your account is deleted. |
| What clients log on their page, and their progress photos | Until you delete it or the client, or your account is deleted. |
| Files you give Eva in a chat or for Import | Not stored by Evatin. Anthropic deletes its copy within 30 days. |
| Bookings | Until your account is deleted. Cancelling a booking keeps the record that it was made; deleting the lead it created does not remove it either. |
| Conversations with Eva, and what she remembers | Until your account is deleted. |
| Data sent to Anthropic | Deleted by Anthropic within 30 days. |
| Server logs | A short period, set by the hosting provider, then gone. |
| Record of the terms you agreed to | Kept while your account exists, on purpose: it's the record of what you were told and when. |
| Everything, after you delete your account | Removed straight away from the live database and file storage, including your sign-in. The hosting provider's daily encrypted backups of the whole database roll over within a couple of weeks and take the last copy with them. |
What you can do
All of these are controls in the app, not requests you have to email us for:
- Correct anything. Every record is editable, including what Eva wrote.
- Delete a lead or client, and choose whether their notes and files go with them.
- Delete any note, task, reminder or file, at any time.
- Delete a call transcript, with the option of downloading a copy first, or set a retention window so transcripts clear on their own.
- Get a copy of everything. Settings exports your whole account as a single file: every record, every field, with download links for your files.
- Turn notifications off, which removes the push subscription.
- Delete your account. Settings deletes everything, including your sign-in, immediately. There is no waiting period and no one to convince.
For anything not on this list, email us.
Your rights
Evatin is run from Australia and this policy is written to follow the Australian Privacy Principles. Under them you can ask us what personal information we hold about you, ask for it to be corrected, and complain if you think we've handled it badly. The controls above cover almost all of that without needing to ask.
If you are in the United Kingdom or the European Economic Area, you also have rights under the UK GDPR and the GDPR: to access, correct, delete and receive a copy of your personal data, to restrict or object to its processing, and to complain to your local supervisory authority. The export and delete controls above are how the first four are done; for the rest, email us.
About the people in your records. Your leads and clients are your contacts, not ours, and so are the people who book a call through your booking page and the clients who log on their own page. You decide what goes into Evatin about them and you are responsible for having the right to keep it there. We hold that information only to run Evatin for you, and we act on it only on your instructions. If one of them asks you what you hold about them, the export gives you the answer.
Data residency
Some people have clients whose contracts require their data stay in a particular place, most often inside Europe. Evatin can't currently promise that, and we'd rather say so plainly than leave it vague.
Your records sit in Sydney. Call recording runs in the EU. The part that can't move yet is Eva: Anthropic processes in the United States, with no European option available at the time of writing.
So if you're under a strict EU-residency obligation for a particular client, the honest advice is not to record those calls and to keep that client's details out of Evatin for now. Ask us if you're unsure. We'd rather talk it through than have you find out later.
Security
- Every account's data is isolated at the database level, not just in the app's code. Even if the app had a bug, one account's queries cannot return another account's rows.
- The credential the app runs on can only read and write ordinary data. It can't change the database's structure and it can't bypass the isolation above.
- Everything travels encrypted, and everything is stored encrypted at rest by the providers above.
- The accounts on every service that touches Evatin have multi-factor authentication turned on.
What we can't promise yet. Direct access to the database is not yet logged, so we can't currently show you a record of who looked at what. That is on the list, and this paragraph will change when it's done rather than before.
If you find a security problem, please tell us at the address below before telling anyone else, and we'll fix it and thank you.
Cookies and your browser
The app sets the cookies needed to keep you signed in, and nothing else. A client's own page sets one cookie to keep them signed in to it once their PIN is right. There are no analytics or advertising cookies in the app. The app also keeps a few small settings in your browser, such as light or dark theme, whether the sidebar is collapsed, or when you last put away one of Eva's messages; they hold no client data. If you turn on notifications, your browser holds the push subscription described above. If you install Evatin to your home screen, nothing is cached on your device: every page is fetched fresh, so no client data sits in your browser between visits.
What we don't do
- We don't sell your data. There's no advertising in the app and no plan for any.
- We don't share it with anyone beyond the services named above.
- We don't use it to train Eva or any other model, and neither does Anthropic.
- We don't look at your data unless you've asked us to look at something, or something is broken and fixing it requires it.
- We don't knowingly hold data from anyone under 18. Evatin is a tool for running a business.
Changes
Evatin changes over time, and sometimes this page does too. Small clarifications get made quietly and the date at the top moves. If anything changes in a way that matters, particularly a new service that sees your data or a change to how long something is kept, we'll tell you in the app or by email before it takes effect, rather than quietly updating the page.
Questions and complaints
Email hello@evatin.com. You'll get a real answer, usually within a few days.
If you're not happy with how we've handled a complaint about your personal information, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au. If you're in the UK or EU, your local data protection authority can hear it too.