Privacy Policy

1. Who we are

Evolvium is operated by Evolvium LLC. In this policy, "Evolvium", "we" and "us" mean Evolvium LLC.

It covers two things:

• The public website at evolvium.ai.
• The Vista platform at vista.evolvium.ai, which we use to deliver AI Strategy Diagnostic engagements.

For questions about this policy, or to exercise any of the rights described in section 11, contact privacy@evolvium.ai.

2. Two different relationships, two different roles

The distinction below matters, because it determines who you should contact about your data.

On the website, we decide what to collect and why. In European terms we are the controller. Contact us directly.

Inside Vista, we run a diagnostic on behalf of a client organization, usually your employer or a company owned by an investor. That client decides who is invited and what the engagement is for. In European terms the client is generally the controller and we act as a processor on their instructions. If you took part in a Vista survey or interview and want your information removed, tell us and we will help, but the client may also need to be involved.

3. What the website collects

When you use the contact form

We collect what you type: your name, work email, company, phone number if you choose to give one, which type of organization you selected, and your message.

Alongside the message we record the IP address the submission came from and the time it was sent. Both appear in the notification email we receive. We keep them so we can investigate abuse of the form.

The submission is delivered to us by email through our mail provider. It is not added to a marketing list, a drip sequence, or any list we share or sell.

The contact form requires your name, work email and message so we can respond. Company, phone number and organization type are optional. If you prefer not to use the form, you can email info@evolvium.ai.

Spam prevention

To stop automated abuse we apply a simple hourly limit per IP address. To do that we store a one-way hash of the IP address and a short list of submission times in a temporary file on our web server. That record expires within about an hour and is not linked to your message.

We use Cloudflare Turnstile on the contact form to help distinguish people from automated bots. When the verification widget loads and runs, Cloudflare processes your IP address and browser and device signals. See the Cloudflare Turnstile Privacy Addendum for details about this processing.

Cookies, analytics and fonts

We do not use analytics or advertising cookies or pixels on this website. Security services such as Turnstile process technical information to prevent abuse, as described above. This statement concerns the public website; Vista authentication and session handling are separate.

The site loads its typefaces from Google Fonts. That means your browser makes a request to Google's servers, and Google receives your IP address and basic request information in order to serve the font files. Google states that it does not use these requests to build advertising profiles.

Server logs

Our hosting provider keeps standard web server logs, which typically include IP address, timestamp, requested page, and browser user agent. These are retained for up to 90 days and are used for security and troubleshooting only.

4. What Vista collects

Vista is invitation-only. You reach it through a link sent to you by us or by your organization. There is no public sign-up.

Sources of information

We receive information directly from you through your responses and use of Vista. Your client organization may provide the participant and organization details used to invite you and administer the engagement, such as your name, work email, role and department. Sign-in and activity records are generated when you use the platform.

If you are a leader taking part in an EVO interview

• Identity and access: your name, work email, job title and role, and the sign-in records created when you use a magic link.
• Your answers, typed or spoken. If you answer by voice, the audio is transcribed to text and the recording is then discarded. You review the transcript before it is saved.
• Progress information, such as which questions you have completed.

Leadership responses are attributable. They are recorded against you as a named participant, because the diagnostic compares how different leaders see the same organization. They may be visible to your organization's engagement administrator. If that is not what you expected, stop and ask your administrator before you answer.

If you are an employee taking part in an EVA survey

• Your answers, and coarse grouping information such as department or function where your organization has asked for it.
• An invitation token so the survey can tell that a link has been used, and so the same person is not counted twice.

This is covered in its own section below, because it is the part people most want to be sure about.

If you administer an engagement

Name, work email, organization, role, sign-in records, and the actions you take in the platform.

Company information you give us

Whatever you choose to describe about your organization during the engagement: structure, systems, processes, priorities and constraints. Please do not upload or dictate personal information about third parties, customer records, or regulated data. Vista does not need it and is not designed to hold it.

5. Employee survey privacy

Employee survey responses are handled separately from named leadership interviews.

• We do not disclose individual employee survey responses to your employer. We use access controls to support this separation.
• Results are reported in aggregate. Where a group is too small for aggregation to protect the people in it, the result is suppressed rather than shown. Our floor is five respondents.
• Free-text answers are handled with the same care as scores. They contribute to aggregate findings and themes. Please avoid names and other identifying details in comments. Free-text responses can identify you or someone else even when a name is not requested. If you have included personal information by mistake, contact privacy@evolvium.ai so we can assess your request.
• Evolvium staff can access the underlying data in order to operate the platform, investigate faults and generate the Blueprint. We do not disclose individual responses to your employer.

We will not weaken this without saying so. If we ever add an option for employees to identify themselves voluntarily, it will be an explicit opt-in with its own consent step, and this policy will be updated before it ships.

6. Why we use your information

We do not use your information for automated decisions that produce legal or similarly significant effects about you as an individual. The Transformation Blueprint is an assessment of an organization, not of a person, and a human reviews it before it is delivered.

7. Service providers we use

We use service providers for website and application hosting, storage, email, security, and AI-assisted analysis or transcription. The providers and information involved are listed below.

We may also disclose information where the law requires it, to enforce our agreements, or to a successor entity in connection with a merger or acquisition. A change in ownership does not by itself remove the protections applicable to information already collected.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

8. Where your information is stored

Vista is hosted in the United States. Using the service may involve processing information outside the country where you live.

If you are outside the United States, the data protection rules that apply there may differ from those in your country. To ask about the locations and safeguards relevant to your information, including any applicable transfer arrangements, contact privacy@evolvium.ai.

9. How long we keep it

We keep personal information for the purposes described in this policy, taking account of the engagement, legal obligations and requests to exercise privacy rights. The existing retention commitments below continue to apply.

Note that the ninety-day dashboard window controls access to the delivered Blueprint. It is not the same as deletion of the underlying engagement data, which follows the client agreement.

10. How we protect it

We use technical and organizational safeguards intended to reduce the risk of unauthorized access, loss or misuse, including:

• Encryption to help protect information during transmission and storage.
• Access controls to limit access to information according to a person's role and responsibilities.
• Sign-in protection. Treat account access and sign-in links as confidential and do not share them with others.
• Least privilege. Access to production data is limited to the people who need it to run the service.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your information and the law requires us to tell you, we will, without undue delay.

11. Your rights

Depending on where you live, you may have the right to:

• Know and access what personal information we hold about you.
• Correct information that is wrong or incomplete.
• Delete your information, subject to records we are required to keep.
• Receive a copy in a portable format, or ask us to send it to someone else.
• Object to or restrict processing we carry out on the basis of legitimate interests.
• Withdraw consent where we relied on consent, without affecting what happened before you withdrew it.
• Not be discriminated against for exercising any of these rights.

To exercise any of them, write to privacy@evolvium.ai. We may ask for information reasonably necessary to verify your identity or an agent's authority, depending on the request. Please do not send identity documents unless we request them. We will respond within the deadline required by applicable law and explain any permitted extension. You may use an authorized agent where the law permits.

Requests about anonymous responses. Where a response is genuinely anonymous and we cannot identify which response is yours, we may be unable to retrieve or delete that particular response. We will explain any such limitation. This does not prevent you from making a request about identifiable information we hold about you, such as account or invitation records.

You may raise a concern with us at privacy@evolvium.ai. You also have the right to complain to the relevant data protection authority where applicable; you do not need to complain to us first. In the UK, you can contact the Information Commissioner's Office. In the EEA, you can contact the supervisory authority where you live or work, or where an alleged infringement occurred.

12. Children

Evolvium is a business service. It is not directed at children, and we do not knowingly collect information from anyone under sixteen. If you believe a child has given us information, write to privacy@evolvium.ai and we will delete it.

13. Changes to this policy

We will update this page when our practices change, and we will move the "last updated" date at the top. If a change materially reduces the protection of information we already hold, we will make a reasonable effort to tell affected people directly rather than relying on you to notice.

14. How to reach us

Evolvium LLC
Privacy: privacy@evolvium.ai
General: info@evolvium.ai

A postal address for formal notices is available on request from privacy@evolvium.ai.