Privacy notice

Who we are

Evgoras is a psychological and professional assessment platform used by organizations (clinics, HR teams and independent practitioners) to run standardized assessments with the people they invite.

For your account, organization and billing data, Evgoras decides how and why it is processed (controller role). For assessment data about invited participants, the organization that invited you decides the purposes and Evgoras processes it on their behalf (processor role).

What data we process

Account data: your name, email address, preferred language, avatar and role within an organization.

Participant assessment data: the name and email your organization registers for you, your consent decisions, your test answers, and the resulting scores and reports. Because these assessments concern psychological wellbeing, this is health-related data of a special category.

Technical records: security audit logs (who accessed what and when), consent records with timestamp, IP address and browser, and, only when you agree to it, session monitoring signals during a test. Billing details are handled by our payment provider and never stored on our servers.

Purposes and legal basis

We process account data to provide the service you signed up for (performance of a contract). We process security and audit logs to keep the platform and its data safe (legitimate interest and legal obligations).

We process participant assessment data only to run the assessment you were invited to, score it, and make the results available to the professionals managing it. This happens only with your explicit consent, collected before the test starts.

Special category (health) data

Assessment answers and results are treated as health data. We ask for explicit, granular consent for each purpose (assessment processing, health data processing and, separately, optional session monitoring) and record the notice version you consented to. You can withdraw consent at any time; withdrawal stops further processing and does not affect what was lawfully processed before.

How we protect it

Personal and assessment data is encrypted at rest with per-organization and per-session keys (AES-256-GCM envelope encryption) and in transit with TLS. Access is restricted by role within your organization, every access to personal data is audit-logged, and identifying details are removed from any text before it reaches an AI model.

Who receives data

We use a small set of infrastructure providers to run the service: Supabase (database, authentication and storage), OpenAI (AI features, receiving only de-identified text), Amazon Web Services (infrastructure for de-identification), Resend (transactional email), Polar (billing, as merchant of record) and Cloudflare (bot protection and networking).

Each provider only receives what its function requires. We do not sell personal data or share it for advertising.

International transfers

Some providers process data outside the European Economic Area, mainly in the United States. Where that happens we rely on recognized transfer mechanisms such as Standard Contractual Clauses, and assessment text is de-identified before any AI provider receives it.

How long we keep data

Each organization sets a retention window for participant assessment data (between 90 days and 3 years; 1 year by default); data older than the window is deleted automatically. Assistant conversations are kept up to 1 year, in-app notifications up to 180 days and security audit logs up to 24 months. You can request earlier deletion at any time.

Your rights

You have the right to access your data, correct it, have it deleted, restrict or object to its processing, receive a copy in a portable format, and withdraw any consent you gave, at any time and free of charge.

To exercise a right, contact the organization that invited you or write to hi@evgoras.com. We respond within one month. You can also lodge a complaint with your data protection authority.

A note for participants

If you were invited to take an assessment, the organization that invited you is responsible for that data and for answering your requests; Evgoras supports them with built-in tools for export, correction, restriction and deletion. Your individual answers are shared with the professionals managing your assessment, not with other participants.

Changes to this notice

This notice is versioned. If it changes in a way that matters, participants are asked to consent again before continuing and account holders are notified.

Contact

For any privacy question or request: hi@evgoras.com.