Who we are
Eveses Inc. (Wilmington, DE, USA) is the data controller for personal data processed through this site and the Eveses API. EU representative: Eveses EU OÜ, Tallinn, Estonia. Reach us at [email protected] or via contact.
What we collect
- Account: email, hashed password, optional name, language preference, 2FA secret if enabled.
- Billing: wallet balance, transactions, deposits, refunds. Card data is held by Stripe — we never see PANs.
- Usage: orders (country, service, mode, price), API keys (hashed), audit log of security-sensitive actions.
- Technical: IP, user-agent, timestamps, request IDs — for abuse prevention and rate limiting.
- Cookies / localStorage: see the cookies page for the full list.
Why we process it
- Service delivery (contract, GDPR Art. 6(1)(b)): running activations, billing, sending you the SMS you paid for.
- Security & fraud (legitimate interests, Art. 6(1)(f)): blocking abuse, rate-limiting, audit trails.
- Compliance (legal obligation, Art. 6(1)(c)): tax records, AML where applicable.
- Communication (consent, Art. 6(1)(a)): only when you opt in to product updates.
We do not sell your data. We do not use it to train AI models.
How long we keep it
- Account & orders: for the lifetime of your account, plus 12 months after deletion for dispute resolution.
- Billing records: 7 years (tax-law requirement in most jurisdictions).
- SMS bodies: 30 days, then permanently scrubbed.
- Audit log: 13 months.
- Server logs: 30 days hot, then aggregated.
Your rights (GDPR / CCPA)
- Access — get a copy of everything we hold about you. Export available in Profile → Export.
- Rectification — fix anything that's wrong, in your account settings.
- Erasure — delete your account from Security → Delete account. Tax-law records are retained for the legal minimum.
- Portability — your export is JSON, machine-readable.
- Objection — opt out of any non-essential processing at any time.
- Lodge a complaint with your supervisory authority (e.g. Estonian AKI for EU users).
We respond to verified requests within 30 days, free of charge.
Who we share with
Sub-processors only, listed in our DPA: AWS (hosting), Stripe (cards), Heleket (crypto), Postmark (email), Cloudflare (CDN/WAF), self-hosted Sentry (errors), Google Analytics and PostHog (analytics), plus our own self-hosted support chat (US) and telemetry collector (Canada). International transfers use SCCs or an adequacy decision, as applicable.
Security
TLS 1.3 in transit, bcrypt for passwords, scoped API keys, optional 2FA, immutable audit log, least-privilege IAM, quarterly third-party penetration tests. Incident notification within 72 hours per GDPR Art. 33.
Children
Eveses is not intended for under-16s. We don't knowingly collect data from children.
Changes
We'll email account holders before any material change and post the updated date at the top. Previous versions are available on request.
Contact
Privacy: [email protected]
Data Protection Officer: [email protected]
Postal: Eveses Inc., 1209 N Orange St, Wilmington, DE 19801, USA
See also: Cookies · Terms of Service