Last updated: June 20, 2025

Responsible entity for data processing:
Evoya AI GmbH
Brunnenstrasse 27
8610 Uster
Switzerland
[email protected]

Data Protection Officer (DPO):
Steven Chareonbood
Tel.: +41 (0)44 520 16 48

Your data will only be processed for clearly defined, lawful purposes:

• Provision, operation, and technical assurance of the platform, its modules, and interfaces
• Enabling access to various AI models and providers (including Swiss, European, and international providers)
• Contract processing, billing, and accounting
• Support, user communication, and care
• Analysis and further development of the platform and services (pseudonymized/anonymized)
• Marketing, information about new features, product information, and events
• Compliance with legal obligations and regulatory requirements
• Protection of legitimate interests (e.g., prevention of abuse, IT security, enforcement of rights)

Your data is generally stored in Switzerland, in an ISO-certified data center.

Unless otherwise instructed by the customer, no storage occurs outside of Switzerland.

Customers can, upon request, also store their data on their own servers (On-Premise) or with a cloud provider of their choice; in this case, the responsibility for data security and compliance with data protection requirements lies with the customer.

We implement modern technical and organizational protective measures, such as encrypted transmission, role-based authorization concepts, access restrictions, and ongoing reviews of data security.

We only share data with authorized persons and contractually bound service providers, as far as necessary and a data protection-compliant contract exists.

For the transfer of personal data to AI providers in countries outside of Switzerland, the EU, or the EEA, we ensure, where possible, that an adequate level of data protection is guaranteed through appropriate safeguards such as EU Commission Standard Contractual Clauses (SCC) or an adequacy decision.

On our platform, it is transparently visible for each AI model and service in which country the server of the respective provider is located. The selection and use of a specific AI model is your own responsibility as a customer.

Please note that there may be AI providers from so-called unsafe third countries that do not provide such guarantees – however, this only affects a very small part of all models available on our platform (over 95% of the models are not affected). As part of the data processing agreement (DPA), you will receive a complete list of all providers used and their server locations upon request.

The data you enter when using the AI models integrated into our platform will not be used for training purposes according to the respective providers. We rely on the official interfaces (APIs) of the providers and adhere to their communicated data usage policies.

You have the following rights under the DSG and GDPR at any time:

• Information about the data stored about you
• Correction of inaccurate or incomplete data
• Deletion of your data, provided that no legal retention obligations oppose it
• Restriction of the processing of your data
• Data portability (provision of your data in a machine-readable format)
• Objection to the processing for reasons arising from your particular situation
• Withdrawal of granted consents with effect for the future
• Right to lodge a complaint with a data protection supervisory authority (Switzerland: FDPIC, EU: national supervisory authority)

Please direct your inquiries to [email protected]. We will process your request promptly, at the latest within one month.

Our services are primarily aimed at individuals aged 16 and older or at individuals for whom appropriate consent has been obtained by a responsible person (e.g., school authority, school management, administration).

If schools use our platform, the use occurs within the framework of a contract with the respective institution, which is responsible for compliance with data protection requirements and obtaining the necessary consents.

This privacy policy applies to all digital offerings and services of Evoya AI GmbH, including our platform, website, APIs, and subdomains. We take no responsibility for linked offerings or services of third parties – their own privacy policies apply.

If individual provisions of this declaration are or become ineffective, the effectiveness of the remaining provisions shall remain unaffected.