Privacy & security

Encrypted in storage and in transit

Communication with Evylla runs over HTTPS/TLS.

IMAP app and mailbox passwords and OAuth tokens are stored encrypted with AES-256-GCM. Your Evylla account password is stored only as a non-reversible hash.

As little data as possible

Evylla does not store your entire mailbox. From order and receipt emails we extract the information needed for your purchase history – merchant, date, amount, items and order number.

Anything not needed for the feature is not stored permanently. Less data means less risk – for you and for us.

How we protect the data

Technically and organisationally we rely on, among other things:

• TLS encryption for every connection to the application
• AES-256-GCM for stored credentials of connected accounts
• Password hashing according to the current state of the art
• CSRF protection, session hardening and server-side permission checks on every request
• Separate roles and permissions for regular accounts and administration
• Regular backups with limited retention
• Logging of security-relevant events with short retention

Nobody can promise absolute security. What we can promise is that security is considered with every change instead of being bolted on afterwards.

At Evylla, privacy is not a module you can add on; it is a design decision.

In practice that means:

Privacy by design
New features are designed from the outset to work with as little personal data as possible.

Privacy by default
The data-minimising setting is the default. Additional processing only happens when you actively trigger it.

Purpose limitation
Data collected for your purchase history is not reused for other purposes.

Deletability
Every kind of data that is created must also be removable – individually or completely.

Transparency
You should not have to guess what happens. That is why this page exists.

This follows the principle of “data protection by design and by default” in Art. 25 GDPR.

What gets stored depends on what you use. Without a connected source there is no order data either.

Account data

For registration, sign-in and billing we process:

• First and last name
• Username and email address
• Country and – if provided – phone number
• Password hash as well as session and security attributes
• Plan, payment status and billing identifiers
• Timestamps such as registration, last sign-in or verification

Data from connected mailboxes

If you connect a mailbox, we process the technical connection data as well as the content of order and receipt emails.

Typically this results in:

• IMAP server, port and username of the connection
• Encrypted app password used for retrieval
• Sender, subject, date and identifiers of the recognised emails
• Recognised order data: merchant, order number, items, amounts, currency, status
• Time and result of the last synchronisation

Emails that do not look like a purchase or receipt are not stored as an order.

Payment and billing data

If you book a pass or a subscription, we additionally process:

• Customer and subscription identifiers of the payment provider
• Status of payment and term
• References to invoices and receipts

We never see full card details – they stay solely with the payment service provider.

🤖 Automated detection and AI

To turn an email into a clean order entry, Evylla uses automated text and pattern recognition. The only goal is to correctly assign merchant, date, amount and items.

An example:

“Your order 1234 has shipped” becomes an entry with merchant, order number, date and amount.

This processing serves only your own purchase history. No profile of your shopping behaviour is built for advertising, and no assessment of you as a person takes place.

There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR.

Your email content is not used to train general AI models.

🎯 What we use data for

We process your data to provide the service: account and sign-in, retrieval of connected sources, detection and display of your purchases, search, export and billing.

On top of that come operations and security: error analysis, abuse prevention, stability and backups.

We do not use it for other purposes – in particular not for advertising, scoring or passing it to third parties for their own purposes.

🚫 We do not sell your data

Evylla does not sell personal data, does not rent it out and does not trade it for reach.

There are no ad networks, no third-party tracking pixels and no sharing of your purchase history with merchants or data brokers.

The business model is deliberately simple: Evylla is paid for by passes and subscriptions – not by your data.

You decide which sources Evylla may read. Every connection is established explicitly by you.

Currently available and planned:

• Email accounts via IMAP (active)
• Sign-in via OAuth without an app password (in preparation)
• PayPal receipts (in preparation)
• Bank and card transactions (in preparation)

For every connection your account shows since when it exists, which permission it has and how many orders were recognised from it.

Disconnect stops further retrieval; saved purchases stay. Removing a mailbox deletes the connection, emails and related purchases.

You can also delete only the imported data of a connection – the connection itself then remains.

🗑️ Deletion and control

In Privacy & security in your account you can control exactly what is deleted.

Deletions take effect immediately in the live system. There is no hidden recycle bin that keeps your data.

In backups, deleted data may persist for a short time until the backup in question is rotated out.

Retention periods at a glance

• Account data: until the account is deleted
• Order and mail data: until you delete it or remove the account
• Server logs: as a rule up to 14 days
• Administrative SQL backups: a maximum of 20 versions, older ones are pruned automatically – with regular backups typically up to about 90 days
• Invoices and payment records: as long as statutory retention obligations apply

📤 Exporting your data

You can download your stored data yourself at any time – as JSON for the full structure or as CSV for spreadsheets.

The export contains your account master data, recognised orders and the metadata of your connections.

This lets you exercise your right to data portability yourself, without waiting for a reply.

The GDPR grants you a number of rights. Most of them you can exercise directly inside Evylla.

Access (Art. 15 GDPR)

You can find out which data we process about you. The export in your account gives you that overview instantly.

Rectification (Art. 16 GDPR)

You can correct incorrect details in your profile yourself, and recognised orders can be edited.

Erasure (Art. 17 GDPR)

You can delete individual data or your entire account. Excluded is data we are legally required to retain.

Restriction of processing (Art. 18 GDPR)

You can ask us to only store data for the time being and not process it further – for example while an objection is being clarified.

Objection (Art. 21 GDPR)

You can object to processing that is based on a legitimate interest.

Data portability (Art. 20 GDPR)

You receive your data in a structured, commonly used and machine-readable format – JSON or CSV, right in your account.

Withdrawal of consent (Art. 7(3) GDPR)

You can withdraw any consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

📚 Legal bases

Every processing activity needs a legal basis. At Evylla there are essentially four.

In detail:

Art. 6(1)(a) GDPR – consent
For optional cookies and technologies that would only be loaded after your approval.

Art. 6(1)(b) GDPR – contract
For account, sign-in, retrieval of connected sources, purchase history, search, export and billing.

Art. 6(1)(c) GDPR – legal obligation
For the retention of payment records under commercial and tax law.

Art. 6(1)(f) GDPR – legitimate interest
For secure operation, abuse prevention, error analysis and backups.

Which basis applies depends on the specific activity; the privacy policy maps this out in detail.

🏢 Controller

The controller for processing within the meaning of the GDPR is:

URBAN
Friedensplatz 13
SAN-39164 Seehausen Börde
Deutschland

Represented by: Udo Urban

Email

…

👤 Data protection officer

No data protection officer has been appointed at present because the legal requirements for doing so are not met.

🤝 Processors

For operations and billing we use carefully selected service providers that work exclusively on our instructions.

These include in particular:

• Hosting and infrastructure providers for servers, database and backups
• Stripe as payment service provider for passes and subscriptions
• Mail delivery service for system emails such as confirmations and password links

Data processing agreements under Art. 28 GDPR are in place with these providers.

If you connect your own mailbox, your email provider is involved as well – but as an independent provider of your choosing.

🌍 Storage location

We deliberately run Evylla in Europe.

Where data is stored also determines which law applies – so this is not a side note.

Current operation
Application, database and backups run on servers in Germany or within the EU.

Transfers to third countries
Processing outside the EU essentially takes place at Stripe (USA) for payments. The basis for this are the European Commission’s standard contractual clauses together with supplementary safeguards.

💳 Payments

Paid plans are processed via Stripe.

Card numbers, bank details and similar payment credentials are entered directly at Stripe and are not transmitted to Evylla. We only store identifiers, status and references to receipts.

You can view and download invoices and payment receipts in the customer portal.

Payment service provider used
Stripe Payments Europe, Ltd. and affiliated group companies; details at stripe.com/privacy.

🛡️ Technical and organisational measures

We protect your data with measures appropriate to the risk.

These include, among others:

• Encryption in transit (TLS) and for sensitive stored values (AES-256-GCM)
• Role and permission model with server-side checks on every access
• Protection against CSRF, brute-force attempts and session hijacking
• Separation of development and production environments
• Regular backups with a limited number of versions
• Updates of the components and dependencies in use
• Logging of security-relevant events with short retention

These measures are reviewed and adjusted whenever technology, risk or the feature set changes.

The basis for this is Art. 32 GDPR – security of processing.

🚨 Handling security incidents

Should a personal data breach occur despite all precautions, we investigate the incident without delay and limit its impact.

If there is a risk to your rights and freedoms, we report the incident to the competent supervisory authority within 72 hours (Art. 33 GDPR).

If the risk is high, we also inform the affected individuals directly and in clear language (Art. 34 GDPR).