Privacy Policy

Effective November 9, 2026

This Privacy Policy explains how Velocinator LLC, a New Mexico limited liability company doing business as evolveAB ("Evolve", "we", "us"), collects, uses and shares personal information in connection with the evolveAB website at evolveab.com, the Evolve Cloud dashboard at app.evolveab.com, and the Evolve API at api.evolveab.com. It also explains the choices and rights you have.

#1. Who we are

Velocinator LLC is the controller of the personal information described in this policy. Our address is 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA. You can contact us about privacy at legal@evolveab.com.

We have not appointed a representative in the European Union or the United Kingdom. Please send all requests to legal@evolveab.com.

#2. Scope

This policy covers personal information about:

(a) Website visitors: people who visit evolveab.com, including its documentation.

(b) Prospects and contacts: people who contact us, ask to join the beta, or correspond with us on behalf of a business.

(c) Dashboard users: people who sign in to Evolve Cloud on behalf of one of our business customers, or who are invited to do so.

Data we process for customers. Our customers use Evolve to run experiments on their own websites. In that role we act as a processor (or "service provider") for our customer, not as a controller. The Data Processing Agreement at /legal/dpa governs that processing, not this policy.

Our customers' visitors. Evolve is designed so that data about the people who visit our customers' websites stays in the customer's own database. This includes visitor identifiers, cookies, events, page views, IP addresses and user agents. Evolve Cloud does not receive that data or connect to that database. If you visit a website that uses Evolve, that website's operator is responsible for your data, and its own privacy notice applies. The field-by-field list of what a customer's website sends to Evolve is at https://app.evolveab.com/privacy.

#3. Personal information we collect

#3.1 Information you give us

• Account details: your name and email address, and the organisation you belong to.
• Invitations: the email address of someone a customer invites to its organisation, and who sent the invitation.
• Feedback and support: the content of feedback, support requests and messages you send us, and your contact details.
• Business contact details: your name, email, employer and role when you correspond with us.

#3.2 Information collected when you use Evolve Cloud

• Sign-in and session data: the time of each sign-in, and the IP address and browser user agent of each session.
• GitHub sign-in: if you choose to sign in with GitHub, we receive your public GitHub profile information and your email address from GitHub. We do not receive your GitHub password or access to your repositories.
• Membership and roles: the organisations you belong to and your role in each.
• Activity and audit records: records of changes made in the dashboard, such as who started, edited, approved or deleted an experiment, a variant or a site, and when. These records include support-access records.
• Support-access records: if Evolve personnel access a customer's account to provide support, we record who accessed it, why, when and in what mode. The customer can see these records in its audit log.

#3.3 Information collected automatically

• Request logs: our hosting provider (Vercel) keeps standard request logs for a short period. These include the IP address, requested path, status code and time. This applies both to visitors of our websites and to the servers of customers' applications that call our API.
• Rate limiting: to protect the Service from abuse we use rate limits. These are keyed on hashed values, not raw IP addresses.
• Two first-party cookies on evolveab.com, which you can decline: described in Section 10.
• How you found us: when you create an account, we store the evolve_ft cookie's contents with your organisation. That is the campaign tags of the link you first arrived on (such as utm_source), an ad click identifier if there was one, the name of the referring website (not the full address of the page), the first page you opened and when.

We do not use third-party analytics, advertising trackers or social media pixels on evolveab.com or in Evolve Cloud.

#3.4 How we contact businesses

We sometimes email people at companies whose public website runs Next.js, about Evolve. We find them from public sources such as company websites and job posts, never from GitHub. We keep only their name, role, work email, company, where we found them and when we wrote. Every email lets you opt out with a one-word reply, and we stop the same day. To ask what we hold or have it deleted, email legal@evolveab.com.

#4. How we use personal information, and our legal bases

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we must have a legal basis for each use of your personal information. The table below lists each purpose and the legal basis we rely on for it.

Where we rely on legitimate interests, we have weighed those interests against your rights. You can object at any time (see Section 8).

We do not use personal information for automated decision-making that produces legal or similarly significant effects on you. We do not use your personal information, or our customers' data, to train AI models.

#5. How we share personal information

We do not sell personal information. We do not share it for cross-context behavioural advertising.

We share personal information only with:

(a) Sub-processors and service providers who help us run the Service, under written contracts that limit their use of the data. These include hosting, database, job scheduling, email delivery, sign-in and AI providers. The current list, with each provider's purpose and location, is at /legal/subprocessors. Our AI providers receive public page text, region schemas and aggregate statistics. They do not receive dashboard users' account details.

(b) The customer you work for. Members of your organisation can see your name, email, role and the changes you make, as recorded in its audit log.

(c) Authorities and others, where the law requires it, or where needed to protect the rights, property or safety of Evolve, our customers or others.

(d) A successor, if we are involved in a merger, acquisition, financing or sale of assets. We will notify you before your information becomes subject to a different privacy policy.

(e) Others with your consent or at your direction.

#6. International transfers

Evolve is based in the United States, and our Service is hosted in the United States. If you are outside the United States, your personal information will be transferred to and processed in the United States.

For transfers from the EEA, we rely on the European Commission's Standard Contractual Clauses. For transfers from the United Kingdom, we rely on those clauses together with the UK International Data Transfer Addendum. For transfers from Switzerland, we rely on those clauses as adapted for the Swiss Federal Act on Data Protection.

We put the same safeguards in place with our sub-processors. Evolve is not currently certified under the EU-U.S. Data Privacy Framework and does not rely on it. You can ask us for a copy of the relevant safeguards at legal@evolveab.com.

#7. Retention

We keep personal information only for as long as we need it for the purposes in this policy:

• Account, membership and session data: kept while your account is active. Deleted within 30 days after your account is deleted, or after the customer's agreement with us ends.
• Audit and support-access records: kept for as long as the customer's organisation exists. Deleted with the organisation's data, unless we need them longer to resolve a dispute or comply with law.
• Site data: when a customer deletes a site, the site's data in Evolve Cloud is deleted within 7 days. A minimal record that the deletion took place is kept with the organisation.
• Request logs: kept by our hosting provider for a short period.
• Business contact records (Section 3.4): deleted 6 months after our last email, unless the person replied. If someone opts out, we keep only their email address on a do-not-contact list so we never write again.
• Feedback, support and correspondence: kept for as long as needed to handle the matter and for a reasonable period afterwards for record-keeping.
• The evolve_site_v cookie: expires after one year (see Section 10).
• The evolve_ft cookie: expires after 90 days. The copy stored with an account is kept for as long as the account exists.

We may keep information for longer where the law requires it, or to establish, exercise or defend legal claims.

#8. Your rights

#8.1 EEA, UK and Switzerland

You have the right to:

• access your personal information;
• have it corrected;
• have it deleted;
• restrict its processing;
• receive it in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent.

You also have the right to complain to your local data protection authority. In the UK, this is the Information Commissioner's Office. In Switzerland, it is the Federal Data Protection and Information Commissioner.

#8.2 California and other US states

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you rights over your personal information. Similar rights apply in other US states.

Your rights:

• Right to know: you can ask what personal information we have collected about you, its sources, why we collected it, and with whom we share it.
• Rights to delete and correct: you can ask us to delete or correct your personal information.
• No sale or sharing: we do not sell or share personal information, as those terms are defined in the CCPA, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.
• Sensitive personal information: we do not use or disclose it for purposes that would give you a right to limit its use.
• Non-discrimination: we will not discriminate against you for exercising your rights.

Categories of personal information. In the past 12 months we have collected the categories below. All of them come from you, from your organisation, from GitHub (if you use it to sign in), or automatically from your device. We disclose each category for a business purpose to the service providers listed at /legal/subprocessors.

Global Privacy Control. We honour Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, no further action is needed. We do not respond differently to "Do Not Track" signals, because no industry standard for them exists.

#8.3 How to exercise your rights

Email legal@evolveab.com. Many details can also be updated in the dashboard.

We may need to verify your identity, for example by confirming your request from the email address on your account. You may use an authorised agent, who must provide proof of their authority. We will respond within the time the law requires: one month under the GDPR and UK GDPR, and 45 days under the CCPA, each extendable where the law allows.

If your request concerns data we hold as a processor for a customer, we will pass it to that customer and help them respond.

#9. Security

We protect personal information with measures that include:

• encryption in transit (TLS);
• hashed or encrypted storage of secret keys and single-use links;
• signed configuration and signed server-to-server requests;
• isolation between customer organisations;
• least-privilege access to production systems;
• logging of support access.

Annex II of the DPA at /legal/dpa describes these measures in more detail. No method of transmission or storage is completely secure. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities where the law requires it.

#10. Cookies

evolveab.com. Our marketing website sets two first-party cookies unless you decline them (see "Your choice" below).

evolve_site_v records which version of the homepage headline you were shown, so that you see the same version on later visits and we can compare versions in aggregate.

• It contains only the version label, not personal information.
• It lasts one year.

evolve_ft records how you first arrived: the campaign tags of the link (such as utm_source), an ad click identifier if there was one, the name of the referring website, the first page you opened and when. It is set on evolveab.com and its subdomains, so that if you later create an account at app.evolveab.com we can count which channels bring us customers.

• It is set once and not updated on later visits.
• It lasts 90 days.
• If you create an account, its contents are stored with your organisation (Section 3.3).

Neither cookie is shared with anyone, used for advertising or used to track you across other sites.

Your choice. A notice on evolveab.com lets you decline both cookies, and the "Cookie settings" link at the bottom of every page lets you change your mind later. Declining deletes them and stops us setting them again; we remember the choice in a third cookie, evolve_consent, which holds only "ok" or "no" and lasts one year. If your browser sends a Global Privacy Control signal, we treat it as declining.

Our fonts are hosted on our own servers, so loading the site does not contact a third-party font service. You can also delete or block cookies in your browser settings. If you do, the website still works: you may simply see a different headline, and we won't know how you found us.

Evolve Cloud. The dashboard uses strictly necessary cookies to keep you signed in and secure your session.

Customers' websites. The SDK that our customers install on their own websites sets its own cookies on those websites. Those cookies are under the control of the website operator, and its notices apply.

#11. Children

Evolve is a business service. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact legal@evolveab.com and we will delete it.

#12. Changes to this policy

We may update this policy from time to time. We will post the new version at /legal/privacy and update the effective date. If a change is material, we will notify dashboard users by email or in the dashboard before it takes effect.

#13. Contact

Velocinator LLC 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA legal@evolveab.com