Privacy

What we collect, why, and how your evidence is handled.

Effective July 2, 2026 · Last updated July 2, 2026. Data controller: Nutavix LLC, a North Carolina limited liability company (USA) — [email protected].

Your evidence stays private

The claims, documents, and files you submit are held privately, used only to produce your report, and not used to build public datasets, benchmarks, or model factors; not shown to other clients; and not sold.

What we collect

What you submit: the claim wording, evidence details, and any documents you submit through the private intake process.
Contact details you give us (your email) — used only to respond and deliver your report.
Analytics. We use Cloudflare Web Analytics to measure aggregate website traffic and performance. It provides information such as pages viewed, referring website, approximate country, browser, device type, and performance metrics. It does not use analytics cookies or local-storage identifiers, and we do not use it to identify individual visitors, build advertising profiles, or track people across websites. Separately, our CDN and hosting providers (Cloudflare, Render) keep short-lived operational request logs (IP, timestamp, path) necessary for security, abuse prevention, and service delivery; these are not marketing analytics and are not used to profile you. (The private, invite-only administration area uses a single secure session cookie for owner login; it is never set for public browsing.)

Documents you submit

After scope confirmation and deposit, Evisentra sends a private, expiring upload link by email. Confidential evidence is uploaded through that link and is not attached to ordinary email. (Or another private channel you prefer.) Files travel encrypted (HTTPS) and are stored in a private, access-controlled storage bucket, encrypted at rest; they pass through the web application but are not retained on it. Each file's SHA-256 fingerprint is recorded so both sides can confirm integrity. Files are accessed only to prepare your review; not shared with other clients. Please do not submit third-party confidential documents you are not authorised to share, or any personal or sensitive data (health, financial, or special-category personal information). Evisentra is built for product, materials, and claim evidence — not personal data.

AI & your documents

A reviewer classifies the evidence, sets the claim scope, and records the assumptions — that part is professional judgment. Once those reviewed inputs and the method version are finalized, the scoring calculation is deterministic: it is computed from public rules and the published rubric, never from an AI model. Any AI assistance is optional and limited to helping organize or classify the evidence you submit; it runs inside Evisentra-controlled infrastructure, is never sent to a third-party AI provider, and never decides the outcome. Your documents are not used to train AI models.

No third-party AI provider currently receives client evidence — the free tools apply public rules to what you type, and the assessment engine calculates from a reviewer's finalized classifications. If AI-assisted organization is ever used for a paid engagement, the provider will be named in the processor list below first.

Retention & deletion

Free draft submissions are deleted no more than 14 days after they are made, and you can delete yours immediately from the result screen. No documents are accepted here. You can delete a free draft immediately from its result screen — no account needed. Paid-review files and reports are kept for the engagement and up to 12 months afterward (so we can answer follow-ups), unless you ask us to delete sooner. We process deletion requests within 30 days. Email [email protected] to access, correct, or delete your data.

Deletion removes the record from the live store immediately. Encrypted backups roll over on their own schedule and are not individually editable, so a deleted record may persist in a backup until that backup expires; backups are never used to restore deleted records into service.

Confidentiality limits

We treat your evidence as confidential. We may disclose only where required by law, or to an independent reviewer you have agreed to — under the same confidentiality terms.

Where data is processed & DPA

Data is stored privately and accessed only to prepare your review. Our service providers are Render (site hosting, United States), Google Workspace (email), and Cloudflare (DNS / content delivery, and private client evidence storage — R2). Where applicable for EU / UK client evidence, we can support a data-processing agreement (DPA) before paid evidence intake.

Evisentra is operated from the United States and evidence you submit is processed there. Where a restricted international transfer applies to your engagement, the applicable transfer safeguards are identified in the relevant data-processing or service agreement rather than asserted here. Contact Evisentra for the currently applicable data-transfer terms before submitting personal data from the EU or UK.

Reviewer applications

If you apply to the Expert Reviewer Network, the information you submit is used to evaluate reviewer fit, contact you, verify credentials, and manage onboarding. The public application form does not collect payment, bank, tax, or government-ID details. Application data is retained while your application is under evaluation and is deleted on request within 30 days.

Legal bases & your rights

We process data to perform the review you request (contract) and to operate and secure the site (legitimate interests). You can ask what we hold, correct it, export it, or have it deleted — contact [email protected]. If you are in the EU or UK, these rights are provided under the GDPR / UK GDPR.

Whether or not the CCPA/CPRA legally applies to Nutavix LLC, we voluntarily honor requests to access, correct, and delete personal information on the same terms set out above. We do not sell or share personal information, and we do not discriminate against anyone for making a request.

Rights described as provided under the GDPR / UK GDPR apply because that law applies. Rights described as honored voluntarily are company policy: we provide them whether or not the underlying statute is triggered, and we do not make a determination here about which statutes apply to us.

How we verify a request

Before acting on a request we take reasonable steps to verify who is making it, usually by replying to the address the request came from and asking for enough detail to locate the records. Where an authorized agent submits a request on someone's behalf, we ask for evidence of that authority. We do not require an account, and we do not ask for more identifying information than the request needs.