Privacy Policy

Evnora is an AI business advisory service for small Greek businesses. The service runs on Anthropic's Claude API. The data controller is the owner of the service — contact us at support@evnora.gr.

• Account details: Email and name at sign-up.
• Business profile: The type, location, products, competitors and challenges you enter yourself.
• Conversation history: Your questions and the AI's answers.
• Usage data: The number of messages per month, to manage your plan.
• Payment data: Processed exclusively by Stripe — we do not store card details.
• Technical data: Session cookies used to keep you signed in to your account.

• Performance of a contract (Article 6(1)(b)): We process your data to provide the service you requested.
• Legitimate interests (Article 6(1)(f)): To improve the service and keep it secure.
• Compliance with a legal obligation (Article 6(1)(c)): Where tax law requires it.

• To provide personalised business advice through the AI.
• To manage your subscription through Stripe.
• To send transactional emails (welcome messages, account notifications).
• To improve our service.

We never sell your data to third parties. We do not use your data for advertising targeting.

Your messages are sent to Anthropic's API for processing. Under Anthropic's policy, API data is not used to train models without explicit permission. Anthropic acts as a data processor on our behalf. Processing takes place on servers in the USA. Anthropic deletes API data within 30 days, except data it flags for a possible breach of its usage policy, which it may keep for up to 2 years.

• Supabase: Data storage on servers within the EU.
• Stripe: Payment processing — PCI DSS Level 1 certified.
• Anthropic: AI processing — servers outside the EU (USA). Transfers are based on Standard Contractual Clauses (SCCs).
• Resend: Delivery of transactional email.

Strictly necessary cookies (keeping you signed in and remembering your cookie choice) are always on. Analytics cookies (Google Analytics or Plausible) and advertising cookies (e.g. Google Ads, through Google Tag Manager) load only if you agree in the cookie notice. You can change your choice at any time from the “Cookie settings” link at the bottom of the page.

• Active account: For as long as the account is active.
• After account deletion: All data is deleted immediately.
• Stripe data: Retained in line with tax obligations (7 years).

Your data is stored in Supabase with database-level encryption. All data transfers use HTTPS/TLS. Access to data is controlled with Row Level Security (RLS) — only you can see your data.

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Access: To know what data of yours we process.
• Rectification: To correct inaccurate data through Settings.
• Erasure ("right to be forgotten"): To delete your account and data from Settings.
• Portability: To receive your data in a machine-readable format.
• Restriction of processing: To request that processing be suspended under certain conditions.
• Objection: To object to processing based on legitimate interests.

For any GDPR request, contact us at support@evnora.gr. We reply within 30 days.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) — www.dpa.gr.

For questions about this privacy policy or to exercise your rights, contact us at support@evnora.gr.