Controller, scope and representatives
This Policy covers the public website and tools available at https://evomi.com. The controller is TeraShift GmbH, Hauptstr. 35A, 8272 Ermatingen, Switzerland. Contact legal@evomi.com.
Our EU representative is Prighter Germany GmbH, Heidestraße 40, 10557 Berlin, Germany. Our UK representative is Prighter Ltd, 20 Mortlake Mortlake High Street, London SW14 8JN, UK. Contact TeraShift, either representative or the Prighter privacy portal.
What we process and why
- Site delivery, security and fraud prevention — IP, device/browser, request and security-event data from your connection deliver and secure the site, prevent abuse and fraud, and support troubleshooting and investigations. Under GDPR/UK GDPR, we rely on legitimate interests in secure services and legal obligations.
- Requested tools and communications — we use an IP address submitted to a tool and provider responses to return its result. If you contact us, we use your contact details, message and support history to reply. GDPR/UK GDPR bases are requested contract steps, service performance and our interest in answering.
- Referral attribution — when a valid referral code is present, we keep it for up to 180 days to credit the referring customer or partner if registration occurs. Under GDPR/UK GDPR, we rely on legitimate interests in honoring referral relationships.
- Functional services — with your choice, support chat and live embeds receive device, browser, page and interaction data for their function. The basis for optional browser access is consent.
- Analytics, including session replay — with your Analytics choice, identifiers, full IP, approximate location, pages, referrals and interactions measure use and diagnose problems. PostHog analytics includes video-like session replay that may capture form text, request/response content and console or canvas diagnostics. The basis is consent.
- Marketing and advertising — with your choice, identifiers, campaign data, pages and interactions support attribution, advertising, conversions, Clarity replay/heatmaps and ad-fraud detection. The basis is consent.
- Business-contact matching — for eligible US visitors, activity and identifiers may be combined with professional contact or company data from GetEmails/Retention.com and its sources for campaign measurement and relevant business marketing. Consent covers the activity and US transfer.
Browser choices and information you provide
Our Cookie Policy explains services, browser durations and controls. Optional technologies can be refused or withdrawn through Privacy choices without losing the site. Request data are needed for the requested page, tool, embed or reply; without them that function may not work. Browser duration is separate from server retention.
Recipients and international transfers
Recipients are hosting/security, support/embed, analytics (including replay), advertising/fraud, IP-location and business-contact providers, plus authorities or advisers required for legal duties.
- European destinations — support and IP-tool disclosures may reach Ireland, Romania, France and Austria. Switzerland recognises these EEA states as adequate; EEA processing remains under GDPR. Applicable Swiss and EEA adequacy decisions cover the United Kingdom.
- United States under adequacy frameworks — PostHog, Google and Microsoft participate in the applicable Swiss-US and EU-US Data Privacy Frameworks for covered data. Ask legal@evomi.com for safeguard information.
- Requested IP tools — a lookup may disclose the submitted address to US or Australian providers when needed to return the result, under Article 17(1)(b) FADP and, where applicable, Article 49(1)(b) GDPR/UK GDPR.
- RB2B — GetEmails/Retention.com receives data in the United States under explicit consent and Article 17(1)(a) FADP; no Swiss adequacy decision or Article 16 safeguard covers it.
Routes for other US recipients and the Australian ad-fraud provider remain unverified; we claim no DPF or contract coverage.
Retention
We retain personal data only for as long as needed for its purpose, with session replays retained for up to 90 days and other PostHog data for up to seven years. Accounting records may be retained for ten years where required by Swiss law.
Your rights, withdrawal and complaints
Subject to applicable law, you may request access, correction, deletion, restriction or portability; object to legitimate-interest processing or direct marketing; and withdraw consent. Contact legal@evomi.com or use Prighter. We may verify identity. You may complain to the authority where you live or work, including the Swiss Federal Data Protection and Information Commissioner, your EEA authority or the UK Information Commissioner.
California online notice
Request review or correction through the contacts above. We post material changes here and request a new choice before a new optional purpose. We do not respond to browser Do Not Track. In the United States, Global Privacy Control keeps advertising and business-contact matching off. With Marketing, advertising providers may collect identifiers and activity over time on Evomi and other sites.
US business-contact matching
For eligible US visitors outside Connecticut, when Global Privacy Control is inactive and only after Marketing or Okay, GetEmails, LLC d/b/a Retention.com receives data in the United States. This optional transfer relies on your explicit consent under Article 17(1)(a) FADP because ordinary Swiss adequacy or Article 16 safeguards do not cover the recipient.
When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting the Retention.com advertising opt-out.
Effective date
Effective and last updated: 3 September 2026.