Privacy Policy

This Privacy Policy explains how Individual Entrepreneur Yaroslav Volovyi, an individual entrepreneur registered in Georgia (“EvalLens,” “we,” “us”) handles personal information in connection with the EvalLens website and the EvalLens pitch‑deck evaluation service (the “Service”). It applies to organizers who use the Service and to participants whose materials are submitted to it.

The data controller responsible for your information is:

• Controller: Individual Entrepreneur Yaroslav Volovyi
• Legal form: Individual Entrepreneur, registered in Georgia
• Identification number: 305676649
• Registering authority: LEPL National Agency of Public Registry (registered February 12, 2024)
• Registered address: Gotua Street N26, Floor 10, Flat N37, Saburtalo District, Tbilisi, Georgia

EvalLens is operated from Georgiaand serves business customers internationally. By using the Service, you understand that your information may be processed in Georgia and in other countries where our service providers operate (see “How we share information”). Where we transfer personal data internationally, we rely on appropriate safeguards, such as standard contractual clauses.

We collect the following categories of information:

• Account information.Name, email address, company, and authentication data when an organizer creates an account. Passwords are stored only in hashed form by our authentication provider; we never store plain‑text passwords.
• Submitted content. Pitch decks (PDF, PPTX, or slide links), startup and project details, founder/team information, and any comments organizers or participants add. This content may contain personal information about founders and team members.
• Evaluation data. Scores, reports, reviewer notes, and decisions generated or recorded within the Service.
• OAuth profile data. Where you sign in with Google, we receive basic profile information (such as name and email) from that provider.
• Usage and device data. Log data, IP address, browser type, and similar technical information collected automatically when you use the Service.

We use personal information to:

• provide, operate, and maintain the Service;
• run AI‑assisted evaluation and generate evidence‑based reports (see “AI processing” below);
• authenticate users and secure accounts and workspaces;
• respond to support requests and communicate about the Service;
• monitor, troubleshoot, and improve the Service; and
• comply with legal obligations and enforce our Terms of Service.

Submitted content is processed by automated AI judges to produce structured, advisory evaluation reports. These outputs are decision‑support only: a human reviewer makes the final decision. AI inference is performed through third‑party AI infrastructure acting as our service provider (see “subprocessors”).

We do not use submitted pitch decks or participant materials to train third‑party foundation models, and we instruct our providers to process this content only to deliver the Service to you.

We share personal information only as described here:

• Service providers / subprocessors. We use trusted vendors to host data and run the Service, including cloud hosting and authentication (e.g., Supabase) and AI inference infrastructure (e.g., Vercel AI Gateway and the underlying model providers). They process information under contract and only on our instructions. The current list is on our Sub‑processors page.
• Within a program.Materials an organizer collects are visible to that organizer’s authorized workspace. Participant submissions are shared with the organizer running the program they applied to.
• Legal and safety. Where required by law, legal process, or to protect rights, safety, and the integrity of the Service.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell personal information, and we do not “share” it for cross‑context behavioral advertising as those terms are defined under California law.

EvalLens is operated from Georgiaand our service providers may process data in the European Union, the United States, and other countries. When we transfer personal data across borders, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses (and the UK addendum where relevant), or a transfer to a country recognized as providing an adequate level of protection.

Where we process personal data on an organizer’s behalf, those transfers are also governed by our Data Processing Addendum. You may request a copy of the relevant safeguards by emailing privacy@evallens.io.

We use strictly necessary cookies to keep you signed in and to operate the Service securely. We use only the cookies needed to provide the Service and any privacy‑respecting analytics required to maintain it; we do not use advertising cookies. You can control cookies through your browser settings, though disabling essential cookies may break sign‑in. For details, see our Cookie Policy.

We retain personal information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Unless a longer period is required by law or agreed in your order or statement of work, we apply these default periods:

• Account datais retained for the duration of your relationship with us and deleted or de‑identified within 90 days after the account is closed.
• Submitted content and evaluation data(pitch decks, reports, scores, notes) are deleted or de‑identified within 12 months after the relevant program or evaluation closes, unless you ask us to remove it sooner.
• Backups and logs are kept on a short rolling basis and purged within approximately 35 days, after which deleted data is overwritten in the ordinary course.

When information is no longer needed we delete or de‑identify it. You may request deletion as described below.

We use technical and organizational measures to protect personal information, including encryption in transit, access controls, row‑level data isolation between organizer workspaces, and server‑side handling of secrets. More detail is on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you are located, you may have rights under laws such as the EU and UK General Data Protection Regulation (GDPR) and the Law of Georgia on Personal Data Protection, including the right to access, correct, delete, restrict, or object to processing, the right to data portability, and the right to withdraw consent at any time. Where we rely on your consent we process on that basis; otherwise we process to perform our contract with you, to comply with legal obligations, or for our legitimate business interests. You may lodge a complaint with your local data‑protection authority — in Georgia, the Personal Data Protection Service.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to:

• Know / access the categories and specific pieces of personal information we have collected about you;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt outof the sale or sharing of personal information — though, as noted above, we do not sell or share personal information; and
• Non‑discrimination for exercising your rights.

To exercise these rights, email privacy@evallens.io. We will verify your request before responding. You may use an authorized agent where permitted by law.

Where we process content on behalf of an organizer (for example, participant materials), the organizer is the party responsible for that data; we will direct relevant requests to them.

The Service is intended for businesses and professionals and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate.

Questions about this policy or your information? Contact Individual Entrepreneur Yaroslav Volovyi at privacy@evallens.io or at Gotua Street N26, Floor 10, Flat N37, Saburtalo District, Tbilisi, Georgia.