EVA
Customer login
Data Protection

Privacy Policy

How we collect, use and protect your information at evacc.cy

Effective Date: May 2026

At evacc.cy, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use and protect information when you visit our website.

1. Company Information

EVA Connect & Consult Ltd
Company Registration No.: HE488677
TIN: 60336336E

Registered Office:
Hellados Ave 12
8020 Pafos
Cyprus

E-Mail: e@evacc.cy

2. Information We Collect

When you visit our website, certain technical information may automatically be collected, including:

  • IP address
  • browser type
  • operating system
  • date and time of access
  • visited pages
  • referring website

If you contact us via e-mail or contact form, we may additionally collect:

  • name
  • e-mail address
  • phone number
  • any information you voluntarily provide

3. Purpose of Data Processing

We process personal data for the following purposes:

  • providing and maintaining the website
  • responding to inquiries
  • improving website functionality and user experience
  • ensuring website security
  • complying with legal obligations

4. Cookies and local browser storage

This website does not use advertising cookies, tracking pixels or web analytics tools, and therefore does not display a cookie consent banner.

Only technically necessary storage is used: if you sign in to the EVA Workspace, your authentication session (an access and refresh token issued by our authentication provider) is stored in your browser so that you stay signed in. Your language preference is also stored locally. This storage is removed when you log out. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract / provision of the requested service).

5. Service Providers We Actually Use

The following processors are used for the operation of this website:

  • Lovable (hosting and delivery of the website, managed backend infrastructure and transactional e-mail delivery from notify.evacc.cy)
  • Supabase (managed database and authentication service used by Lovable Cloud, hosted in the European Union, Ireland)
  • Google LLC / Google Ireland Ltd (only if you choose “Continue with Google” to sign in)
  • Apple Inc. / Apple Distribution International (only if you choose “Sign in with Apple”)
  • Lovable AI Gateway with the model google/gemini-3.8-flash (only for text analysis inside the GAEB Offer Merge application, see section 8)

These providers process technical data required to deliver their services. Server log data (such as IP address, browser type and time of access) is processed by our hosting provider for the secure operation of the website.

6. EVA Workspace (User Accounts)

The EVA Workspace is a protected area that requires registration. When you create an account, the following data is processed:

  • e-mail address (required, used as your login identifier)
  • password (stored only as a cryptographic hash by our authentication provider; we never see it)
  • name and company, if you enter them during registration
  • approval status (pending, approved or rejected) and your role (user or admin)
  • date of registration and of the last update to your account

This data is processed in order to create your account, verify your e-mail address, decide on your access request and protect the non-public area against unauthorised use (Art. 6 (1) (b) and (f) GDPR).

Access is not granted automatically. After registration you must confirm your e-mail address; your account is then set to “pending” and reviewed manually by an administrator, who can approve or reject it. Until approval you cannot open any application. When a new account is registered, an automatic notification containing your e-mail address, name, company and registration time is sent to our administrator address e@evacc.cy.

Account data (e-mail address, name, company, status, role, timestamps) is stored for as long as the account exists. It is not deleted automatically. You can request deletion of your account at any time at e@evacc.cy; the account and the associated records are then removed.

7. Sign-in with Google

Signing in with Google is offered as an optional alternative to e-mail and password. If you use it, you are redirected to Google, where you authenticate. Google processes this request and transmits your e-mail address, your name and your Google account identifier to our authentication provider, which creates or matches your Workspace account. We do not receive your Google password. Google may process data outside the EU under its own privacy policy (policies.google.com/privacy). The legal basis is your consent through your choice of this sign-in method, Art. 6 (1) (a) GDPR. You can avoid this by registering with e-mail and password instead.

8. GAEB Offer Merge / Document Processing

Approved Workspace users can voluntarily upload construction-related PDF documents (for example supplier offers or bills of quantities) to the GAEB Offer Merge application. These documents may contain personal data such as customer names, addresses, project details and prices. Please only upload documents you are entitled to process.

How the processing actually works:

  • The PDF file itself is never uploaded to a server. It is read and converted to text directly in your browser.
  • Extracted text excerpts of the document (document header and individual position texts) are transmitted to our server and forwarded to the Lovable AI Gateway, where the AI model google/gemini-3.8-flash converts them into structured position data. These excerpts can contain the personal data described above.
  • The structured result is returned to your browser. All further steps — review, editing, calculation of quantities and prices, and generation of the GAEB/X84 and CSV files — take place exclusively in your browser.
  • Uploaded PDFs are not stored permanently: neither the file nor the extracted document data is written to our database or to any file storage.
  • Session data exists only in your browser's working memory. It is lost as soon as you reload the page, close the tab, log out or use the reset function. There is no project history and no saved projects.
  • Generated GAEB/X84 and CSV files are created in your browser and saved only where you download them. We do not retain copies.
  • When you log out, the authentication session and all temporary application data are cleared and the application starts empty at the next login.

We do not control how long our AI provider retains request data for abuse prevention and operational purposes; this is governed by the provider's own terms. If you do not want document content to be transmitted for AI analysis, please do not use this application.

8a. EVA Team (crew scheduling, protocols)

Companies using EVA Team enter and manage the following data in the EVA Workspace: employees (first and last name, optional e-mail address and phone number, role and team), customer sites (order number, address, contact person and contact details), assignments (dates, times, assigned staff, work and acceptance status), as well as completion protocols with notes, photos, customer and employee signatures and generated PDF documents. If the company sets a report e-mail address, a completion report is sent to that address via notify.evacc.cy.

This data is stored in the managed database and in private file storage of Lovable Cloud (Supabase, EU region Ireland). Access is limited to members of the respective company according to their role; fitters only see their own assignments. The using company is responsible for the data it enters; EVA processes it on the company's behalf.

There is no automatic deletion. Company admins and office users can delete sites, assignments, employees and protocols (including stored versions, photos and signatures) in the Workspace. Retention periods and a data processing agreement are agreed with each company individually; on request we delete a company's data completely.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss or misuse.

10. Your Rights

You may have the right to:

  • request access to your personal data
  • request correction or deletion
  • object to certain processing activities
  • request restriction of processing

To exercise your rights, please contact us at: e@evacc.cy

11. External Links

Our website may contain links to external websites. We are not responsible for the privacy practices or content of third-party websites.

12. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time. The latest version will always be published on this website.

13. Contact

If you have any questions regarding this Privacy Policy, please contact:

EVA Connect & Consult Ltd
E-Mail: e@evacc.cy