Privacy Policy
What data 
volvixOS collects, why, who processes it, where your prompts go, and the rights you have over it.
01Who is responsible for your data
The data controller is GOLAN EUROPE SL, Avenida Blai Bonet 8, Bloque 3, Apartamento 301, Santa Ponça, 07180 Calvià (Illes Balears), España, tax identification number B16546020
Email: support@evolvixos.com
Phone: +34 711 011 010,
Spain. We are responsible for the personal data described in this policy.
Questions, or to exercise any right below: info@evolvixos.com.
This policy covers the hosted volvixOS service at evolvixos.com. If you
self-host the open-source software, we receive no data from your instance and this
policy does not apply to it.
02What we collect
You give us
- Account data — email address, display name, password hash, and any organisation details you add.
- Content — prompts, files, code, project data, and generated outputs you create using the Service.
- Support correspondence — messages you send us.
- Optional messaging identifiers — your Telegram or WhatsApp identifier, only if you connect those channels.
We generate or observe
- Usage and metering — requests made, models selected, Credits consumed, timestamps, feature usage.
- Technical data — IP address, browser and device type, approximate location derived from IP, session and authentication tokens.
- Security logs — sign-in attempts, one-time-code verifications, rate-limit and abuse-detection events.
We receive from others
- Payment confirmations from Paddle — order reference, product, amount, billing country, and partial card details such as the last four digits and card brand. We never receive your full card number.
We do not deliberately collect special category data. Please do not submit health, biometric, or similar sensitive data unless you have satisfied yourself that doing so is lawful.
03Why we use it, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and operate your account, deliver the Service | Account, content, technical | Performance of a contract |
| Meter Credits and bill correctly | Usage, payment confirmations | Performance of a contract |
| Authenticate you, including email one-time codes | Account, security logs | Performance of a contract |
| Prevent fraud, abuse, and attacks; keep the platform stable | Technical, security logs, usage | Legitimate interests |
| Provide support and respond to you | Account, correspondence | Performance of a contract |
| Improve reliability and diagnose faults | Aggregated usage, error logs | Legitimate interests |
| Service and security announcements | Account | Legitimate interests |
| Marketing emails, if you opt in | Account | Consent |
| Meet accounting, tax, and legal obligations | Account, payment records | Legal obligation |
We do not sell your personal data, and we do not use your prompts or generated outputs to train our own models unless you explicitly opt in. We do not use your content for advertising.
04AI models and where your prompts go
This matters more than anything else in this policy, so it gets its own section.
When you send a request, volvixOS routes it to a model. Which model, and
therefore where your data goes, depends on the model you pick and your configured
privacy mode:
- Local models — run on infrastructure we control. Your prompt is not sent to any third-party model provider.
- Third-party models — your prompt and relevant context are transmitted to that provider so they can generate a response. They process it under their own terms and privacy policy.
Third-party model providers currently reachable through the Service include Groq, Google (Gemini), OpenRouter, and Moonshot AI (Kimi). The set may change as models are added or retired; the Studio shows which provider serves each model before you use it.
If you need prompts to stay off third-party infrastructure entirely, set your privacy mode to local-only. If you handle other people's personal data in prompts, choose your model accordingly and contact us for a data processing agreement.
05Who else processes your data
We use a small number of providers who process data on our behalf under contract:
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting and infrastructure | Germany (EU) |
| Paddle.com Market Ltd | Merchant of record, payments, invoicing, tax | United Kingdom |
| Brevo | Transactional email, including sign-in codes | France (EU) |
| AI model providers | Generating responses to your prompts (section 4) | Varies, including United States |
We may also disclose data where legally required, to establish or defend legal claims, or to a successor entity in a merger or acquisition — in which case we will tell you before your data becomes subject to a different policy.
06International transfers
Our core infrastructure is in the European Union. Some providers, particularly AI model providers, are outside the EEA, including in the United States.
Where data leaves the EEA we rely on an adequacy decision where one covers the provider, or otherwise on the European Commission's Standard Contractual Clauses together with additional safeguards such as encryption in transit and data minimisation. You can request details of the safeguards for a specific transfer.
07How long we keep it
| Data | Retention |
|---|---|
| Account data | While your Account is active, then up to 90 days after closure |
| Content (prompts, projects, outputs) | Until you delete it, or up to 30 days after Account closure |
| Usage and Credit metering records | 24 months, for billing accuracy and dispute resolution |
| Security and access logs | 12 months |
| Invoices and payment records | As required by Spanish tax law, generally 6 years |
| Support correspondence | 24 months after the case closes |
| Backups | Rolling, overwritten within 35 days |
08Your rights
Under the GDPR you can ask us to:
- Access — get a copy of your personal data.
- Rectify — correct data that is wrong or incomplete.
- Erase — delete your data, where no legal obligation requires us to keep it.
- Restrict — pause processing while a dispute is resolved.
- Port — receive your data in a machine-readable format, or have it sent to another provider.
- Object — to processing based on legitimate interests, and to marketing at any time.
- Withdraw consent — where consent is the basis, without affecting past processing.
Email info@evolvixos.com. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need longer. We may ask you to confirm your identity. Exercising these rights is free unless a request is manifestly excessive.
You can close your Account and delete your content yourself at any time from the Studio.
Complaints
Please raise concerns with us first. You also have the right to complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD, aepd.es), or to the authority in your EU country of residence.
09Cookies and similar technologies
We keep this minimal. We use:
- Strictly necessary cookies and local storage — to keep you signed in, hold session and authentication tokens, remember your interface preferences such as theme, and protect against cross-site request forgery. These are required for the Service to work and do not need consent.
We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that profile you across other websites. If we introduce non-essential cookies we will ask for your consent first and update this section.
You can clear cookies and local storage in your browser, but doing so will sign you out.
10Security
We protect your data with measures including encryption in transit over TLS, hashed passwords, scoped API keys, authentication on all platform endpoints, row-level access controls so users only reach their own records, rate limiting, input validation against injection and server-side request forgery, audit logging of privileged actions, and restricted administrative access.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the AEPD within 72 hours and inform you without undue delay where the risk to you is high.
Please report suspected vulnerabilities to info@evolvixos.com. We will not pursue good-faith security research that respects user privacy and avoids service disruption.
11Children
The Service is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a minor has created an Account, contact us and we will delete it.
12Changes to this policy
We may update this policy. For material changes we will notify you by email or in-product notice at least 30 days before they take effect. The effective date at the top always reflects the current version, and we keep prior versions available on request from info@evolvixos.com.