Privacy Policy

Who is responsible for your data

Eshap – Agence de communication Sàrl is the controller responsible for the processing described in this Privacy Policy.

Scope of this Policy

This Privacy Policy applies to the Evy mobile applications, the website at myevy.app, the browser version of Evy and related support services. It explains what personal data we process, why we process it, with whom it may be shared and the choices available to you.

Personal data we process

Account and profile data

Email address, password authentication data, name, username, profile image, date of birth and profile details you choose to provide.

Location and event activity

Approximate location or location selected by you, searches, filters, viewed events, favourites, participation status, events created or managed, and interactions with event pages.

Content and communications

Event descriptions, images, links, comments, messages, reports, support requests, notification preferences and other content you submit.

Device, log and security data

IP address, device and browser type, operating system, app version, language, timestamps, crash information, authentication events, security logs and similar technical data.

Analytics and website data

Where you consent, we may use Google Analytics or a comparable analytics service to understand website and product usage. This may involve online identifiers, approximate location, device information and interaction data. We do not currently use Evy for payments.

How we obtain data

We obtain data directly from you, automatically from your device when you use the Service, from other users who interact with or report content, and from service providers that support authentication, hosting, analytics, notifications, security and moderation.

Why we process personal data

• create and secure accounts;
• provide event discovery, publishing, favourites, participation, messaging and profile features;
• display approximate location-based results and relevant event information;
• send transactional emails, service messages and push notifications;
• answer support requests and communicate important changes;
• detect spam, abuse, fraud, harmful content and security incidents;
• moderate reported or potentially violating content;
• measure and improve performance, reliability and user experience;
• comply with law, enforce our terms and protect users and third parties.

Legal grounds

Depending on your location and the processing concerned, we rely on one or more of the following grounds:

• Contract: processing necessary to provide the Service you request and administer your account.
• Legitimate interests: operating, securing, improving and protecting Evy, preventing abuse and understanding service performance, balanced against your rights.
• Consent: for optional analytics, certain notifications, device permissions or other processing where consent is required. You may withdraw consent at any time.
• Legal obligations: processing needed to comply with applicable law, lawful requests or record-keeping duties.
• Protection of vital interests or legal claims: in exceptional safety, emergency or dispute situations.

Who may receive personal data

We do not sell personal data. We may disclose data to:

• Supabase: database, authentication, storage and backend infrastructure. The selected project region is Stockholm, Sweden (Northern Europe).
• Infomaniak: website hosting and related infrastructure in Switzerland.
• AI moderation providers: currently OpenAI services may be used to analyse content for safety and policy compliance when moderation features are enabled.
• Analytics providers: Google Analytics may be used on the website or product only where configured and, where required, after consent.
• Notification platforms: Apple Push Notification service and Google/Firebase services may process device tokens and delivery data to send push notifications.
• Professional advisers and authorities: where reasonably necessary for legal advice, audits, claims, safety or compliance with binding requests.
• Business transaction recipients: in connection with a merger, restructuring, financing or transfer, subject to appropriate safeguards.

Providers may only process data for defined purposes under contractual and legal obligations.

International data transfers

Data is primarily hosted in Switzerland and the European Economic Area, including Sweden. Some providers or their subprocessors may process data in other countries. Where required, we use recognised safeguards such as adequacy decisions, standard contractual clauses, contractual protections and supplementary technical or organisational measures.

AI-assisted moderation

Evy may submit text or other limited content to an AI service to help identify spam, harassment, illegal content, scams or other potential violations. Automated analysis may produce an alert or recommendation; it does not necessarily result in automatic enforcement. Cases may be reviewed manually, particularly where context or uncertainty matters.

We aim to minimise the information sent for moderation and avoid sending data that is not needed for the safety purpose. Do not include sensitive personal information in public event descriptions, messages or reports unless it is strictly necessary.

You may contact us to request review of a decision that significantly affects your account or content.

How long we keep data

We retain personal data only for as long as necessary for the purposes described above:

• account and profile data while your account remains active;
• User Content until you delete it, the account is deleted, or it is removed under our rules;
• support, moderation, security and legal records for a period reasonably necessary to investigate incidents, enforce rules, resolve disputes and meet legal obligations;
• analytics data according to the retention configuration of the relevant analytics service.

After an account-deletion request is verified, active account data is generally deleted or anonymised within 30 days. Residual copies may remain in encrypted backups for up to 90 days before normal rotation, unless longer retention is legally required or necessary for fraud prevention, safety, disputes or the protection of rights.

Data security

We use technical and organisational measures designed to protect personal data, including encrypted network connections, access controls, authentication safeguards, logging, backups and least-privilege practices. No online service can guarantee absolute security. You are responsible for choosing a strong password and protecting access to your email account and devices.

Your privacy rights

Depending on applicable law, you may have rights to:

• receive information about processing and obtain a copy of your data;
• correct inaccurate or incomplete data;
• request deletion or restriction;
• object to certain processing based on legitimate interests;
• withdraw consent without affecting earlier lawful processing;
• receive certain data in a portable format;
• request human review where a legally significant decision is based solely on automated processing;
• complain to a competent data-protection authority.

To exercise a right, email info@myevy.app. We may need to verify your identity. Rights may be limited where an exemption applies or retention is legally required.

Children and age

Evy is not specifically directed to children. If you are under the age required to enter into a legally binding agreement under the laws applicable to you, you should only use Evy with the permission and supervision of a parent or legal guardian. If we become aware that personal data has been collected from a child in circumstances where parental authorisation was legally required, we may remove the account and delete the associated data.

Event organisers remain responsible for setting and enforcing any event-specific age restrictions.

Account and data deletion

More information about account deletion, retention and recovery is available on our Account Deletion page.

Changes to this Policy

We may update this Privacy Policy to reflect changes to Evy, service providers, technology or law. The updated version will be posted here with a revised date. We will provide additional notice where a change materially affects your rights or is otherwise required.

Contact and complaints

For privacy questions or requests, contact:

You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner or, where the GDPR applies, with the supervisory authority in your country of residence or work.