The data controller responsible for your personal data is EVAFICY S.R.L., a company registered in Romania. If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@evaficy.com.

We collect the following categories of personal data:

• Account data: Your name and email address when you register or accept an invitation to the platform.
• Usage data: Information about how you interact with the platform, including pages visited, features used, test cases created, and session activity.
• Payment data: Billing information necessary to process subscriptions. Payment card details are handled exclusively by Stripe and are never stored on our servers.
• Technical data: IP address, browser type, operating system, and device information collected automatically when you access the platform.

We use your personal data for the following purposes:

• To create and manage your account on the platform
• To provide and operate the Evaficy Smart Test service
• To process subscription payments via Stripe
• To send transactional emails (account creation, password reset, billing notifications)
• To respond to your support requests
• To improve platform functionality and user experience
• To comply with legal obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract performance: Processing necessary to provide the service you have subscribed to.
• Legitimate interests: Processing for platform security, fraud prevention, and service improvement.
• Legal obligation: Processing required to comply with applicable laws and regulations.
• Consent: Where we rely on consent (e.g. optional communications), you may withdraw it at any time.

We use the following third-party services that may process your data:

• Stripe — Payment processing. Stripe collects and processes payment card information directly. Stripe's privacy policy is available at stripe.com/privacy.
• Google reCAPTCHA — Bot protection on our login and registration forms. Google may collect hardware and software information for this purpose. Google's privacy policy is available at policies.google.com/privacy.

Evaficy Smart Test uses essential cookies and local storage to maintain your session and authentication state. These are strictly necessary for the platform to function and do not require your consent.

We do not use advertising or tracking cookies. Google reCAPTCHA may set its own cookies for bot detection purposes.

We retain your personal data for as long as your account is active or as necessary to provide the service. If you delete your account, we will delete or anonymize your personal data within 30 days, unless we are required to retain it for legal or compliance purposes.

Payment records may be retained for up to 7 years to comply with Romanian and EU accounting regulations.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Opt-out (CCPA): California residents may opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, please contact us at support@evaficy.com. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS), access controls, and regular security reviews.

While we take all reasonable precautions, no internet-based service can guarantee absolute security. You are responsible for keeping your account credentials confidential.

Your data may be processed outside the European Economic Area by our third-party providers (Stripe, Google). These providers maintain appropriate safeguards in compliance with GDPR, including Standard Contractual Clauses and participation in applicable data transfer frameworks.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you by email or via an in-app notification. Continued use of the platform after changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

EVAFICY S.R.L.
Email: support@evaficy.com

You also have the right to lodge a complaint with the relevant data protection authority in your country. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).