Privacy Policy
Evotech Software — operated by EVOTECHCORP LTD EOOD
Effective date: 1 September 2026
Last updated: 10 October 2026
This Privacy Policy explains how we collect, use and protect personal data when you visit https://evotechcorp.io (the "Website"), contact us, book a call, use our client portal, use our estimator app for iOS and Android (the "App"), or work with us. It is written to meet the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Bulgarian law.
1. Who we are (data controller)
The controller of your personal data is:
EVOTECHCORP LTD EOOD, trading as Evotech Software
ul. Maragidik No. 19, fl. 2, ap. office 1
Burgas 8000, Bulgaria
Email: [email protected]
For any privacy question or request, including to exercise your rights, contact us at [email protected].
2. What personal data we collect
We only collect the data described below.
2.1 Project intake and contact forms (Website)
When you submit the "Direct Project Intake" form in the contact section of the Website, or a plan intake form in the pricing section, we collect:
- full name;
- email address (the form asks for a corporate email);
- a link related to your project, depending on the service selected: a Figma file link (app development), an App Store or Google Play listing link (maintenance), or a website URL (security audits);
- estimated number of screens or scope;
- your message or project description;
- the service category, plan and price shown when you submitted the form;
- whether you chose the priority or standard queue, and the reference number generated for your request;
- the Website language you were using.
Your submission is sent to our server and delivered to us by email through Resend, an email delivery provider.
Do not include special categories of data (for example health data) or third parties' data in your message unless strictly necessary.
2.2 Booking calendar
The Website embeds a booking calendar operated by a third-party scheduling provider. When you book a call, the calendar collects only the date and time you select, your name and your email address. No other information is requested. The provider processes this data on our behalf so that the call can be scheduled and you receive a confirmation.
The calendar loads only when you click the button to open it in the contact section of the Website; until then, no data is sent to the provider. The scheduling provider may use cookies or similar technologies that are needed for the calendar to work. See section 9 (Cookies).
2.3 Language detection
To show the Website in your language, the Website:
- sends a request to our own server (api.evotechcorp.io), which receives your IP address and returns a suggested language;
- if that fails, sends a request from your browser to the third-party IP geolocation services ipapi.co and, if needed, ipwho.is, which receive your IP address and return your approximate country;
- otherwise uses your browser's language setting.
We use only the resulting country or language. If you select a language manually, your choice is saved in your browser's local storage (see section 9) and IP-based detection is not used again on that browser.
2.4 Client portal and team access
The Website includes a client portal and a team access area. Access is only for people we register manually; you cannot create an account yourself. When you use the portal we process:
- your email address;
- a one-time login code sent to your email, and an access key checked by our server;
- an account record with a user ID, your email address, the login method and the time of the last update;
- session information stored in your browser so you stay logged in;
- any project information, messages or files that you or we add to the portal.
Authentication and the portal database are provided by Supabase.
2.5 Technical data
- Hosting: our Website is hosted by Hostinger. When you visit, the hosting server processes technical data such as your IP address, browser type, requested page and time of the request. These server logs are used only for security and troubleshooting and are kept for a limited period (see section 6).
- Fonts: the Website loads the "Inter" font from Google Fonts (Google). Your browser therefore sends your IP address to Google's servers when the page loads.
- No analytics on the Website: we do not use analytics, advertising, heatmap or tracking tools on the Website. If we add analytics in the future, we will ask for your consent first and update this Policy.
2.6 Communications
If you email us or reply to our emails, we process your email address, name, the content of your messages and any attachments you send.
2.7 Calls and meetings
We hold calls and meetings with prospective and existing clients. The Website states that we use real-time AI translation during meetings. Calls are held through third-party video-conferencing and translation tools, which process the participants' names, email addresses, voice and image only to provide the call and the translation. We do not record calls unless we tell you in advance and, where required, ask for your consent.
2.8 Clients and service delivery
If you become a client, we process the data needed to perform the contract: contact details of your representatives, project information, Figma files, delegated access to your developer accounts (for example Apple Developer, Google Play Console, Supabase or Firebase roles), repositories, and invoicing data. We do not ask for your master passwords. During maintenance or security audit work we may have access to personal data held in your systems; in that case we act as your processor under a data processing agreement in accordance with Article 28 GDPR.
2.9 Payments
The Website mentions a refundable evaluation deposit for app builds. If a deposit or other payment is made, it is processed by bank transfer or by a third-party payment provider, and we receive only the information needed to confirm and record the payment (for example payer name, amount and date). We do not store full card numbers.
2.10 VIP forensics
Our VIP forensics service is not currently offered, and the Website does not accept forensics requests. If it is offered again, we will update this Policy before collecting any data for it.
3. Why we use your data and our legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answer your enquiry and assess your project | Intake/contact form data, emails | Steps at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Schedule and hold calls | Booking data, meeting data | Steps before a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Provide contracted services (development, maintenance, security audits) | Client and project data | Performance of a contract (Art. 6(1)(b)) |
| Give clients access to the client portal | Portal account data | Performance of a contract (Art. 6(1)(b)) |
| Show the Website in your language | IP address, browser language, saved language choice | Legitimate interest in providing the Website in a suitable language (Art. 6(1)(f)) |
| Operate, secure and display the Website (hosting, fonts) | Technical data | Legitimate interest in a functioning and secure website (Art. 6(1)(f)) |
| Invoicing, accounting and tax | Client and payment data | Legal obligation (Art. 6(1)(c)) |
| Establish, exercise or defend legal claims | Relevant data | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can object at any time (section 8). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
We do not sell your personal data, and we do not use it for advertising. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Price estimates from the App or the Website are rule-based indications only and are not binding.
Providing your name, email and project details is necessary for us to answer your enquiry; without them we cannot respond.
4. Who receives your data
We share personal data only with the providers we need to run our business, under contracts that require them to protect it:
| Recipient | Role | Location |
|---|---|---|
| Resend | Delivers form submissions and emails to us | Inside or outside the EEA (see section 5) |
| Third-party scheduling provider | Booking calendar | Inside or outside the EEA (see section 5) |
| Supabase | Authentication and database for the client portal | United States (the portal project is hosted in the AWS us-east-2 region) |
| Hostinger | Website hosting | Inside or outside the EEA (see section 5) |
| Google (Google Fonts) | Delivers the Website font | Inside or outside the EEA (see section 5) |
| ipapi.co, ipwho.is | IP-based country lookup for language selection (fallback only) | Inside or outside the EEA (see section 5) |
| Email service provider | Business email for [email protected] | Inside or outside the EEA (see section 5) |
| Video-conferencing and translation tools | Calls and real-time translation | Inside or outside the EEA (see section 5) |
| Bank or payment provider (only if a payment is made) | Payments | Inside or outside the EEA (see section 5) |
| Accountants and professional advisers | Accounting, tax and legal compliance | European Union |
We may also disclose data to professional advisers (lawyers, accountants), to public authorities or courts where required by law, or to a buyer or successor if our business is reorganised or sold.
Apple (App Store) and Google (Google Play) distribute the App and process data under their own privacy policies as independent controllers.
5. International transfers
Some of our providers may process personal data outside the European Economic Area (EEA), in particular in the United States (Supabase, and possibly other providers listed in section 4). When data is transferred outside the EEA, we rely on an adequacy decision of the European Commission (for the United States, the EU-U.S. Data Privacy Framework where the recipient is certified) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. We only use providers outside the EEA when one of these safeguards is in place.
You can ask us for more information about these safeguards at [email protected].
6. How long we keep your data
| Data | Retention |
|---|---|
| Enquiries and intake forms that do not lead to a contract | 12 months after our last contact |
| Booking data | 12 months after the booked call, unless it leads to a contract |
| Client and project data | For the duration of the contract and then up to 5 years (the general limitation period for claims under Bulgarian law) |
| Invoicing and accounting records | For the periods required by the Bulgarian Accountancy Act and tax legislation (generally up to 10 years) |
| Client portal accounts | Until the account is closed, then deleted within 90 days unless we must keep data longer for the reasons above |
| Server logs | Only as long as needed for security and troubleshooting, normally no more than 12 months |
| Language preference (your browser) | Until you clear your browser's storage |
After these periods we delete or anonymise the data.
7. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), restricted access to client systems through delegated accounts instead of shared passwords, access to the client portal limited to registered users with one-time codes, and access to our own systems limited to authorised staff. No system is completely secure; if a personal data breach affects you, we will notify you and the authorities where the law requires.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten"), where the law allows;
- restrict processing;
- data portability for data you gave us, processed by automated means on the basis of contract or consent;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent.
To exercise your rights, email [email protected]. We will reply within one month; this can be extended by two further months for complex requests, in which case we will tell you. We may ask you to confirm your identity.
Right to complain: you can lodge a complaint with the Bulgarian supervisory authority:
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Website: https://www.cpdp.bg
You can also complain to the supervisory authority in the EU country where you live or work, or where the alleged infringement took place. We would appreciate the chance to address your concern first.
9. Cookies and similar technologies
Our Website: the Website uses only essential (strictly necessary) and technical cookies and similar technologies that are needed for it to work. We do not use analytics or advertising cookies. If we add analytics in the future, we will ask for your consent before using them. We use your browser's storage for these functional purposes:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| evotech_lang | Local storage | Remembers your Website language | Until you clear it |
| evotech_lang_manual | Local storage | Records that you chose the language manually | Until you clear it |
| Supabase session (e.g. sb-…-auth-token) | Local storage | Keeps you logged in to the client portal (portal users only) | Until logout or expiry |
| evotech_client_unlock / evotech_team_unlock | Session storage | Remembers that the portal access key was entered | Until you close the browser tab |
Third parties:
- Booking calendar: the third-party scheduling provider loads only if you click to open the calendar, and may then set its own cookies that are needed to display the calendar and process your booking. See the provider's privacy policy.
- Google Fonts receives your IP address when the font loads.
- ipapi.co / ipwho.is receive your IP address if our own language detection fails.
Because the Website uses only essential and technical cookies and storage, no consent is needed for them. If we ever add non-essential cookies, such as analytics, we will ask for your consent first.
You can delete local storage and cookies, and block third-party cookies, in your browser settings.
10. Children
Our Website, App and services are intended for businesses and adults. They are not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
11. Mobile app (Evotech estimator app)
This section applies to our estimator app for iOS and Android, which lets you describe the screens and modules of your project and receive a rule-based, non-binding price estimate.
- Data collected by the App: the App processes the information you enter about your project (such as screens, modules and design details) to calculate your estimate.
- Submitting a project: if you choose to send your project to us, we receive the project details and the contact details you provide, and handle them in the same way as the Website intake form (section 2.1).
- Account: the App does not require you to create an account.
- Third-party SDKs: the App does not include advertising SDKs.
- Tracking: the App does not track you across apps or websites owned by other companies and does not use the advertising identifier.
- Permissions: the App does not request access to device features such as your camera, contacts or location.
- Purposes and legal bases: data submitted through the App is used to prepare your estimate and answer your request, on the basis of steps taken at your request before a contract (Art. 6(1)(b) GDPR).
- Retention and rights: the retention periods in section 6 and your rights in section 8 apply. You can request deletion of any data sent through the App by emailing [email protected].
The App is distributed through the Apple App Store and Google Play. Apple and Google process data (for example downloads and purchases) under their own privacy policies.
12. Changes to this Policy
We may update this Policy when our services or the law change. We will publish the new version on this page with a new "Last updated" date and, for significant changes, inform clients and portal users by email.
13. Contact
EVOTECHCORP LTD EOOD (Evotech Software)
ul. Maragidik No. 19, fl. 2, ap. office 1, Burgas 8000, Bulgaria
[email protected]