Privacy Notice

1. Scope and roles

This Privacy Notice explains how Evidenso Ltd handles personal data when you visit our website, contact us, request access, use our services, or receive support.

If you use Evidenso under a pilot agreement, order form, data processing agreement, or other written customer agreement, that agreement may include additional privacy terms and controls where it conflicts with this notice.

Evidenso is usually the controller for website, prospect, customer account, billing, and service contact data. Where a customer submits or connects content to a workspace, Evidenso usually acts as processor and handles that content on the customer’s instructions.

2. Information we collect

The information we collect depends on how you interact with Evidenso. It may include:

• Contact and enquiry data, such as name, email address, role, company, message contents, and related communications.
• Account and service data, such as authorised user details, workspace information, billing records, usage events, support requests, and security logs.
• Website and device data, such as IP address, browser and device information, referring pages, log data, cookies, and website interactions.
• Customer content, such as the materials a customer chooses to upload, connect, or approve for processing in its workspace.
• Public, professional, or other lawfully sourced business information where it is relevant to providing or improving our services.
• Outputs and derived information created by the services, such as summaries, analysis, recommendations, and audit records.

3. How we use information

We use information to:

• Provide, operate, secure, debug, and support the website, platform, and related services.
• Create and deliver AI-enabled research, analysis, and decision-support outputs requested by customers.
• Manage customer relationships, accounts, billing, onboarding, support, and service communications.
• Improve service reliability, safety, quality, and user experience.
• Monitor and prevent fraud, abuse, unauthorised access, and security issues.
• Comply with legal obligations, enforce agreements, and establish, exercise, or defend legal claims.
• Send marketing communications where permitted by law, with the ability to opt out at any time.

4. Customer data and AI use

Customer-provided content remains the customer’s data. Evidenso uses customer data to provide the services, fulfil customer instructions, support users, maintain security, and meet legal or contractual obligations.

Evidenso does not sell personal data or customer data and does not share it with third parties for their advertising purposes.

Evidenso does not use customer confidential information or identifiable customer content to train general-purpose models. Customer content is not used to train third-party foundation models. We may use aggregated or de-identified learnings to improve the service, provided no customer is identified and no customer confidential information is disclosed.

5. Research and analysis outputs

Some services may use customer-approved content, public information, professional information, or other lawful sources to produce research and analysis outputs. These outputs are decision-support materials and should be reviewed before use.

Evidenso is not designed to make automated decisions about individuals that produce legal or similarly significant effects. Customers must not use outputs to target, contact, impersonate, make eligibility decisions about, or take adverse action against identifiable individuals unless separately agreed in writing with appropriate safeguards.

Where practical, Evidenso reduces direct identification in generated outputs. Customers are responsible for selecting the materials they provide and for ensuring they have the required rights, notices, permissions, and lawful basis.

• We do not intentionally collect private messages or non-public third-party content unless a customer lawfully provides or connects it for its own workspace.
• We do not intentionally process children’s data for the services.
• We do not intentionally process special category data, such as health, biometric, religious, political, or trade union data, unless expressly agreed in writing with an appropriate lawful basis and safeguards.

6. Legal bases

Where Evidenso acts as controller, our legal bases under applicable UK data protection law may include:

• Contract, where processing is needed to provide services, manage accounts, respond to requests, or administer customer relationships.
• Legitimate interests, such as service improvement, business communications, analytics, support, security, fraud prevention, and responsible product development, provided those interests are not overridden by individual rights.
• Consent, where we ask for consent for a specific activity, such as optional cookies or certain marketing communications.
• Legal obligation, where processing is needed for tax, accounting, regulatory, corporate, or other legal requirements.
• Customer instructions, where Evidenso acts as processor for customer-provided content. In that case, the customer is responsible for determining the lawful basis.

7. Sharing information

We may share information only where needed for the purposes described in this notice or where required by law. Recipients may include:

• Service providers and subprocessors, such as hosting, infrastructure, storage, authentication, analytics, security, communications, support, payment, and AI infrastructure providers.
• Authorised customer administrators and workspace users, where information belongs to or is made available within that customer workspace.
• Professional advisers, such as lawyers, accountants, auditors, insurers, and other advisers.
• Authorities, regulators, courts, law enforcement, or other third parties where required by law or needed to protect rights, safety, property, or security.
• Successors or prospective successors in connection with a merger, acquisition, financing, restructuring, reorganisation, sale of assets, or similar corporate transaction.

8. Subprocessors and third-party providers

Where Evidenso acts as processor, customers generally authorise Evidenso to use subprocessors needed to provide the services. We require subprocessors to protect personal data using data protection obligations that are materially no less protective than those in the applicable customer agreement.

Reasonable information about subprocessors is available to customers on request or as otherwise set out in the applicable customer agreement.

9. International transfers

Evidenso is based in the United Kingdom, but personal data may be processed in other countries by us or our service providers. Where required, we use appropriate safeguards for international transfers, such as adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum, or other lawful transfer mechanisms.

10. Retention and deletion

We keep personal data only for as long as reasonably needed for the purposes described in this notice, the applicable customer agreement, or legal, accounting, audit, security, dispute, and reporting requirements.

• Customer content is returned or deleted as set out in the applicable customer agreement, subject to legal, security, backup, audit, and reasonable technical retention requirements.
• Account, billing, contract, support, and service records are kept for as long as needed to manage the relationship and meet legal or business recordkeeping needs.
• Website, analytics, usage, and log data are kept for a reasonable period for analytics, troubleshooting, security, and service improvement.
• Public, professional, and derived information is deleted, refreshed, anonymised, or restricted when it is no longer needed or when required following a valid request.

11. Security

Evidenso uses reasonable technical and organisational measures designed to protect personal data and customer data against unauthorised access, loss, misuse, disclosure, alteration, and destruction. These measures evolve over time and may vary by plan, deployment, environment, and customer agreement.

No service can be guaranteed completely secure. If you believe your account or data may be at risk, please contact us promptly.

12. Your rights and complaints

Depending on your location and the processing activity, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, request portability, and withdraw consent where processing is based on consent.

Where Evidenso acts as processor for customer-provided content, we may need to refer your request to the relevant customer or ask you to contact that customer directly.

You may also make a data protection complaint to Evidenso using the contact details below. You have the right to complain to the UK Information Commissioner’s Office or another competent supervisory authority.

13. Cookies and marketing

Evidenso uses Google Analytics and PostHog to understand visits, navigation, and selected interactions with this website. These services may process page information, browser and device details, approximate location, and network information such as an IP address. IP anonymisation is enabled for our PostHog Production project. After a newsletter or access form is saved successfully, we associate the submitted email address with that conversion in our EU PostHog project so we can attribute and manage the request. We do not send submitted email addresses to Google Analytics or intentionally send free-text form content to either analytics service.

We use Google Consent Mode in its advanced configuration. When you have not made a choice, or when you decline or withdraw analytics-cookie consent, analytics storage and all advertising-related storage remain denied. Google may still receive cookieless measurement signals from your visit in those cases, but analytics cookies are not set or read. If you accept analytics cookies, Google Analytics may set or read them. Advertising storage, advertising user data, and advertising personalisation remain denied regardless of your choice.

PostHog receives cookieless usage events before you make a choice and after you decline or withdraw consent. In this mode, PostHog does not use cookies, local storage, or session storage to identify your browser. Instead, its EU service creates a privacy-preserving server-side hash for audience measurement. If you accept analytics, PostHog may use first-party cookies and browser storage so visits to evidenso.com and app.evidenso.com can be connected.

PostHog Session Replay runs only after you accept analytics and records all eligible sessions on the public website. All form inputs are masked, canvas pixels are not captured, URL query strings are removed from replay data, and console logs are not included. Public page text remains visible so we can understand navigation and usability. Session replays are retained for 30 days in our EU PostHog project.

We store your analytics-cookie preference in your browser’s local storage so it can be applied on later visits. You can accept, decline, or withdraw consent at any time using the Cookie settings control shown on the website. Withdrawing consent stops Session Replay, removes analytics persistence accessible to this website, and returns PostHog to cookieless measurement; it does not stop the cookieless signals described above. Google may process analytics information outside the United Kingdom, subject to the transfer safeguards described in section 9.

If you receive marketing communications from Evidenso, you can opt out at any time by using the unsubscribe mechanism in the message or by contacting us. We may still send service, security, legal, or administrative messages where needed.

14. Children’s privacy

Evidenso is intended for business use and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to Evidenso, please contact us and we will take appropriate steps to delete it.

15. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. When we make material changes, we will update the Last updated date and may provide additional notice where appropriate.

16. Contact us

Company: Evidenso Ltd, company number 16913847.

Registered office: 32-38 Leman Street, Techspace C/O Antler, London, United Kingdom, E1 8EW.

Privacy contact: vazgen@evidenso.com.

Version 1.2.