Privacy policy

1. Roles and contact

Evrani determines how account, support and service-security information is used. Nathaniel David Barrett trading as Evrani is the controller for this information. Our business correspondence address appears in the Contact section below. For client information entered by a business, that business normally decides the purpose and lawful basis; Evrani processes the information to provide the requested workflow. See Data Protection for the current processing scope and outstanding production arrangements.

2. Information we process

• Account email, authentication identifiers, password authentication handled by Supabase, verification and recovery events, and session cookies.
• Your name, business name, registration date and last workspace visit.
• Client names and email addresses, invoice references, currencies, amounts, due dates, recorded payment totals, opt-ins, pause status, notes, reminder wording and activity history.
• Email payloads, recipient information, provider identifiers, sending attempts, failure information and verified delivery events. Webhook event records store a hash of the recipient address; email payload records can contain the original address and message.
• Agreement version, time, source, an email hash and, for verified workspace setup, the account identifier. A signup submission record is not proof that the submitted email belongs to the person submitting it.
• Support messages and technical information handled by hosting and authentication providers, which may include IP addresses, browser information, access and error logs. Do not send credentials in support messages.

CSV files are read in your browser for column matching and preview. The original file is not uploaded or retained by Evrani; only the invoice records you confirm are sent to your workspace. Account and invoice fields come from you or the business using Evrani; delivery events come from the email provider. Required account information is needed to create and secure a workspace. If you do not supply invoice information, that invoice workflow cannot run.

3. Why information is used

For individuals contracting directly, account setup and the requested service are processed to perform the agreement. For business representatives and operational security, the intended basis is legitimate interests in running a secure business service, preventing misuse and resolving support issues. Records needed to meet a specific legal duty are processed on that basis. These bases and the operator’s assessment must be confirmed before production launch.

Client reminders are sent under the business customer’s instructions; that customer must establish its own lawful basis and give required notices. Agreeing to terms or acknowledging this policy is not blanket consent to all processing, and is not marketing consent. No marketing opt-in is collected by the current signup form. Invoice rules do not make credit, employment or other similarly significant eligibility decisions.

Right to object: you may object to processing based on legitimate interests by contacting us. We will consider the request and explain any compelling grounds or legal reasons that require continued processing.

4. Who receives information

The current service uses OpenAI Sites and Cloudflare for hosting and application data, Supabase for authentication, and Resend for account and invoice email delivery. Email content is also sent to the intended recipient and handled by their email provider. The platform owner can see customer registration and service-health information and may access operational records when necessary for support, security or legal duties. Customer workspaces are separated by account.

Information may also be disclosed to advisers or authorities where legally necessary. The app has no advertising network or sale-of-data feature. Supplier contracts, exact legal entities, locations and onward-processing arrangements still need confirmation before production use.

5. Locations and international transfers

The current Supabase project is configured in London. Resend routes our email from Ireland but stores message content, delivery logs, webhook payloads and account records in the United States. Resend publishes a Data Processing Addendum incorporating Standard Contractual Clauses and the UK Addendum. Those settings do not mean all information stays in the UK or EEA: hosting, support, logs and email recipients may involve other countries. The complete transfer map and applicable adequacy decisions or contractual safeguards have not yet been verified. This is an outstanding launch requirement; contact us for the confirmed safeguards before providing real client data.

6. Retention and closure

Support conversations and feedback are stored with your account and included in account export and deletion. Support replies appear in the app, without automatic email notifications. A submitted review stays private unless you give explicit permission for landing-page display and the owner approves that version. Public display includes the review text, rating, recommendation and chosen name/business; your email is not published. You may withdraw permission in Help at any time, which removes the review from current public display. Editing removes approval until the new version is reviewed. Previously copied public material cannot be recalled. Account and workspace records remain while your account is active and needed to provide the service. Activity history in the workspace is capped at the latest 2,000 entries. Stored reminder and payment-confirmation message content, including recipient addresses in those payloads, is removed after 90 days by subsequent scheduled runs, in bounded batches. This cleanup also runs when email sending is disabled. Delivery identifiers, invoice references, payment totals, status and recipient suppression hashes remain to prevent duplicate sends and respect delivery failures. This does not remove the underlying invoice or copies held by email providers. Delivery events and agreement records are reviewed as part of a verified closure or erasure request. Their retention must be limited to what is necessary for service operation, security, legal duties or resolving a specific dispute. Scheduler records older than 30 days are removed on subsequent successful runs.

Settings provides a JSON account export and permanent account deletion for verified email/password customer accounts. The export includes your profile, workspace, recorded payment totals, reminder preferences, email history, support conversations, feedback, any test billing records and agreement records. Deletion requires your current password inside the app and the exact confirmation DELETE MY ACCOUNT. Never send your password to support or in chat. Closure switches reminders off, blocks workspace access and removes application records and your login. Interrupted deletion can be retried on the account closure page. Legacy sign-ins and platform-owner closure require support assistance. A minimal account-identifier closure record is retained to prevent stale sessions or requests recreating erased data. Email identifiers are held for 30 days to ignore late delivery events, then removed when the webhook next runs. Emails already sent, recipient copies and provider backups or logs are not immediately erased by this control. Provider backup/log expiry and final retention periods still need confirmation. Contact us about further requests or exceptions.

7. Cookies and security

Essential session cookies keep you signed in and support secure authentication. The current app does not add advertising or analytics cookies. Blocking essential cookies can prevent sign-in. Supabase manages password authentication; sending keys and webhook secrets are encrypted server-side. Access checks separate customer workspaces. These controls reduce risk but do not guarantee absolute security. No security certification or completed independent audit is claimed.

8. Your rights and complaints

Depending on the applicable law and processing basis, you can request access, correction, erasure, restriction, portability and object to processing. Where processing is based on consent, you can withdraw it without affecting prior lawful processing. Contact us to exercise a right or raise a complaint. We aim to respond promptly within applicable statutory deadlines and explain any lawful extension or refusal. If your information was entered by a customer business, contact that business first; we will assist it as appropriate.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or your applicable local supervisory authority. You do not have to give up that right by contacting us first.

9. Children and changes

Evrani is intended for adult business users and is not directed at children. Tell us if a child’s information has been entered. Material policy changes will be communicated through the service or account contact where appropriate. Each published policy is dated and its source version retained.

Contact

For account support, privacy requests or complaints, email evrani.global@gmail.com. Do not send passwords, API keys or unnecessary client information. Business correspondence address: Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom.