Privacy Policy

evo7 ("we", "us") is an all-in-one business operations platform operated by Evo7 Software Services. This policy covers the evo7 marketing website.

General privacy enquiries: evo7@evoplc.com.

Under section 13 of the Digital Personal Data Protection Act, 2023, you may raise any question or complaint about how we handle your personal data with our Grievance Officer.

Please note: we have not yet appointed a named individual to this role. Grievances are currently handled by the office of the Grievance Officer, and a named officer is in the process of being appointed; this page will be updated with their name when the appointment is made. Until then the contact below is monitored and is the correct address for all section 13 grievances.

Contact: privacy@evoplc.com. We acknowledge every request and aim to resolve it within 30 days.

If you have an evo7 account, you can also raise a grievance directly inside the product under Account → Privacy requests; it is tracked against the same 30-day timeline.

Demo and contact requests: your name, business email, phone number, company name, and any message you include. Phone number is required so our team can schedule your demo call.

Chat assistant conversations: the query you type plus the same contact details above, collected step-by-step in the chat.

Lead magnet downloads (GST checklist, ROI calculator): the same four contact fields, plus the inputs you enter into the calculator.

Campaign attribution: UTM parameters (source, medium, campaign) and the page you submitted from, so we know which campaigns work.

Analytics (only with your consent): usage data via Google Analytics 4 with IP anonymisation, loaded only after you accept the cookie banner. If you decline, no analytics scripts load at all.

Anti-spam: when you submit a form, Cloudflare Turnstile receives your IP address and browser signals to distinguish humans from bots.

Responding to your demo, contact or download request: processing is necessary to take steps at your request prior to entering into a contract, and is based on the consent you give when submitting the form (DPDP Act s.6).

Anti-spam and site security (Cloudflare Turnstile): our legitimate interest in protecting the site and our team from automated abuse.

Analytics: your explicit, opt-in consent, which you may withdraw at any time.

We do not sell your personal data, we do not share it with data brokers, and we do not use it for automated decision-making or profiling.

Lead details submitted on this website are transmitted over HTTPS to the evo7 platform, where they are stored as sales leads in our CRM. If that system is temporarily unavailable, your request is routed to an internal alert channel so we can still respond.

Cloudflare, Inc. receives your IP address and browser signals for bot protection (Turnstile) on every form submission, including before any cookie decision, as this is strictly necessary to keep the forms usable.

Google LLC processes website analytics under Google data processing terms, only if you accept analytics cookies. Advertising and personalisation signals are explicitly disabled.

Both Cloudflare and Google may process data outside India, including in the United States and the EEA, under their standard contractual terms.

Platform data (data held inside the evo7 product, as opposed to this website) is hosted on infrastructure located in India.

Beyond the website recipients above, the evo7 product platform uses the sub-processors listed below. Several of them process personal data outside India, under their own standard contractual terms. The authoritative, dated register — including data categories and current status — is published at /sub-processors.

Hostinger — cloud hosting for all platform services and databases (all platform data). Located in India.

Meta Platforms — WhatsApp Business, Facebook and Instagram messaging and Meta lead ads, for tenants that enable those channels (phone numbers, names, message content, lead details). United States / global.

Google — RCS and Business Messages, Ads lead forms, Gmail OAuth mailbox sync and consent-gated website analytics (phone numbers, message content, lead details, mailbox tokens, pseudonymous analytics). United States / global.

Microsoft — Outlook OAuth mailbox sync for tenants that enable it (mailbox tokens and synced email content). United States / global.

Mapbox — map rendering for proposals and solar designs (site coordinates and addresses). United States.

Cloudflare — Turnstile anti-abuse on forms plus TLS and DNS services (IP addresses and browser signals). Global anycast network.

Let's Encrypt — TLS certificate issuance (administrator contact email only). United States.

Upstash — website rate limiting (IP-derived request keys). United States. This vendor is currently under review and may be replaced.

Cashfree Payments — payment collection and payouts (payer name, contact and bank/UPI details). India. Not currently active; payments are in sandbox mode.

AWS (Amazon Bedrock, ap-south-1, India) — optional AI model fallback. Not currently enabled; no personal data is sent to it today. If we activate it we will update this page and the register first.

We do not have executed data-processing agreements in place with every vendor above yet; that work is in progress and tracked internally. Where a vendor processes data outside India we rely on that vendor’s standard contractual terms in the meantime.

We store one functional item in your browser to remember your cookie choice; it is not used for tracking. Analytics cookies are set only after you accept them.

You can change or withdraw your choice at any time using the "Cookie settings" link in the site footer, so withdrawing is as easy as giving consent. Your stored choice is re-requested after twelve months.

Lead and enquiry records are retained for 24 months from our last contact with you, after which they are deleted or irreversibly anonymised. Records we are required to keep for tax or statutory reasons are retained for the period the law requires.

Analytics data is retained according to the retention window configured in Google Analytics (14 months by default).

In line with the Digital Personal Data Protection Act, 2023 (India), and the GDPR where it applies to you, you may request access to, correction of, or erasure of your personal data; withdraw consent for analytics; and nominate another person to exercise your rights in the event of death or incapacity.

Email privacy@evoplc.com and we will act on verified requests within 30 days. If you are unhappy with our response, you may complain to the Data Protection Board of India, or to your local supervisory authority if you are in the EEA or the UK.

Traffic between your browser and our systems is encrypted with TLS at the platform edge. Encryption of internal service-to-service and database traffic inside our own network is in progress and not yet complete; we do not currently claim end-to-end encryption in transit. Encryption at rest for the underlying disks and databases is also on our roadmap rather than in place today.

Access to lead data inside the evo7 platform is restricted by role-based access control and covered by audit logging. Website form submissions are rate-limited and bot-filtered.

evo7 holds no SOC 2, ISO 27001 or equivalent third-party security certification, and we make no such claim.

We will update this page when our practices change and revise the "Last updated" date below. Material changes will be highlighted on this page.