Evylla Evylla remembers.

Privacy policy

Information on the processing of personal data when operating Evylla (SaaS) under the GDPR.

A higher plan gives you more features and additional mail accounts. Protection of your personal data stays the same on every plan.

Go to the privacy & security overview · Delete data or request deletion

1. Controller

URBAN
Friedensplatz 13
SAN-39164 Seehausen Börde
Deutschland

Represented by: Udo Urban

Email
…
Privacy email
…
Website
evylla.app

2. Scope

Evylla is an online service for managing and searching purchase/order information. This policy covers the website and account area. It does not cover third-party websites you may reach via links.

3. Hosting & server logs

The application runs on servers in Germany or the EU. When you visit, technically necessary server log data may be created (e.g. IP address, time, requested resource, user agent). These are used for operation, security and troubleshooting and are generally retained only briefly or as long as needed for those purposes.

4. User account

For registration and use we process the master data you provide (e.g. name, username, email, country, phone number) and authentication data (password hash, session). Phone or confirmation codes are used for verification. Legal basis: Art. 6(1)(b) GDPR (contract/pre-contract) and, where applicable, (f) (account security).

5. Email / IMAP

If you connect mail accounts, we store the credentials you provide (e.g. IMAP server, username; passwords encrypted) and retrieve emails or attachments on your behalf to detect order data and show them in your account. For verification, original emails (body/HTML) may be stored and displayed — scope and retention follow your plan limits. Processing is only for contract performance (Art. 6(1)(b) GDPR). You can remove connections in your account at any time. Prefer app passwords or restricted credentials from your mail provider where possible.

6. Payments (Stripe)

For paid plans we use Stripe as payment provider. Payment and billing data are transmitted to or processed by Stripe (e.g. payment status, customer and subscription IDs). Stripe may process data outside the EU based on appropriate safeguards (including contractual clauses). Details: https://stripe.com/privacy. Legal basis: Art. 6(1)(b) and (f) GDPR (contract and secure processing).

7. Cookies & consent

We use cookies and similar storage. You can choose categories in the banner. Currently:

  • Necessary: session/login, security (e.g. CSRF), storing cookie consent.
  • Preferences: e.g. theme and language (cookie/localStorage).
  • Analytics: Google Analytics (gtag) only after consent; Consent Mode controls storage. No analytics cookies without consent.
  • Marketing: no marketing scripts embedded; only a consent placeholder for possible future use.

Optional categories (Art. 6(1)(a) GDPR) are only enabled after your consent. Necessary storage relies on Art. 6(1)(f) or (b) GDPR. You can change your choice anytime via “Cookie settings” in the footer.

8. Legal bases (overview)

Depending on the process: contract or pre-contract (Art. 6(1)(b)), legitimate interest in secure operation (f), consent for optional technologies (a), and where applicable legal obligations (c), e.g. commercial/tax retention of payment records.

9. Retention

Account data is kept until the account is deleted or while the user relationship lasts. Order/mail-related data in the account is deleted with the account or earlier if you remove it — subject to statutory retention duties. Logs and consent records only as long as needed for purpose and evidence.

10. Recipients

Recipients may include hosting/infrastructure providers, Stripe (payments), Google (Analytics, only with consent) and — if you connect mail accounts — your email provider. We do not share data with third parties for their own advertising.

11. Your rights

Where legal requirements are met, you have rights including:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future

To exercise these rights, contact us at the address above. You also have the right to lodge a complaint with a supervisory authority.

12. Changes

We update this policy when features, law or processing change. The version published on this page applies.