/ Privacy

Privacy Policy

This explains what information Evara collects when you use evara.studio and our website service, where it is stored, who else processes it, and what you can ask us to do with it. It is written in plain language rather than legal language.

Last updated: 20 July 2026

1. Who we are

Evara Studio, digitalne storitve in poslovne rešitve, Eva Jereb s.p. provides a managed website service. We decide how and why the information described here is used, which makes us its controller. Tax number (davčna številka) 18493777, registration number (matična številka) 7546734000. For anything in this policy, write to info@evara.studio.

Evara Studio, digitalne storitve in poslovne rešitve, Eva Jereb s.p., Završje 27, Podmolnik, 1261 Ljubljana - Dobrunje, Slovenia. Registration number (matična številka) 7546734000, tax number (davčna številka) 18493777. Not VAT registered (ni zavezanec za DDV).

Your content stays yours. The material you give us - logos, branding, copy, images, videos, documents and business information - belongs to you, and the website content we create specifically for your business belongs to you too. The Evara platform, builder, CMS, AI workflows and reusable systems remain ours and are never transferred.

2. What we collect

Almost everything we hold is information you typed into one of our forms or uploaded to it.

• Contact and business details - your name, email address, phone number if you give one, and your business name and description.
• Your project brief - what the site is for, who it is for, how it should feel, which pages and sections you want, your scope signals and any notes you write.
• The content for your sections - the words, figures and details you supply for each section you choose: services and their prices, portfolio projects, questions and answers, pricing plans, opening hours, addresses and the contact details you want published.
• Information about other people - if you choose a team section you can give us names, roles, biographies and photographs of your team; if you choose testimonials you can give us quotes and the names and companies of the people who wrote them. Please read “Content about other people” below.
• Files you upload - logos, images, brand documents and PDFs, screenshots of sites you like, and any sketches, wireframes or design files for a client-led design.
• Whether you asked for placeholder content - for each section you choose we record whether you supplied real content or asked us to write clearly-marked placeholder text you can replace later.
• Your acceptance of our terms - the fact that you ticked the acknowledgements, and when.
• Enquiries and bookings - bespoke project enquiries, waiting-list signups and discovery-call bookings, with the details you enter there.
• Your project as it progresses - package choice, quote, approvals, feedback, change requests, messages and payment status.
• Editor and connection details - if your site has the content editor, the content you publish through it; and if a feature needs one of your own third-party keys, that key, stored encrypted.
• Website delivery diagnostics - public analytics and verification identifiers you provide, generated SEO configuration, deterministic verification results, and Lighthouse website-health snapshots including scores, audited URL, device mode and run status.

3. Where your files are stored

Your information is held in our database with our hosting provider. Uploaded files go to one of two places, and the difference matters:

4. Why we use it

• To prepare your quote and to design, build, deploy and maintain your site - because we need it to perform our contract with you, or to take steps before entering one.
• To contact you about your project and send you the checkpoint links you need in order to approve work - on the same basis.
• To take payment and keep billing records - to perform our contract, and because accounting law requires us to keep records.
• To measure how our own marketing pages are used - only if you accept analytics cookies. You give or refuse that consent in the cookie banner and can change it at any time.
• To keep a record of what was agreed and approved - our legitimate interest in being able to show what you signed off.

5. Who else processes it

We do not sell your information. These providers process it so that we can run the service:

• Supabase - our database and file storage. Everything described above is held there.
• Vercel - hosting for our site and yours; it runs the code that handles your requests.
• Resend - sends the emails we send you, and so receives your name, your email address and the contents of those emails.
• Stripe - takes payments, and so receives your name or business name, email address and payment details. We never see your full card details.
• Google Analytics - measures how our own marketing pages are used, and loads only if you accept analytics cookies. It is not loaded on your project pages, the client portal, the review pages or our admin area. Separately, if you connect the Search & Performance workspace we read figures from your own Google account - see section 12.
• Anthropic (Claude) - we use AI coding tools to build sites. Project briefs containing the business information and content you supply are used in those sessions. No AI makes automated decisions about you, your quote or your project.
• Workflow automation - when a new enquiry arrives, basic details such as your name, business, email address and the indicative price may be passed to our internal automation tool so that we can follow up.

6. Where it is processed

These providers operate internationally, and your information may be processed outside Slovenia and outside the European Economic Area. We have not published a data-residency guarantee, so please do not assume your information stays within the EU.

7. How long we keep it

• Enquiries, intake submissions, waiting-list signups and the files uploaded with them are kept until you ask us to delete them. They are not deleted automatically.
• When a client account is archived, that account and the media on its site are permanently deleted 365 days later.
• Billing records are kept for as long as accounting law requires.
• You can ask us to delete your information sooner - see “Your rights” below.
• Google Search Console and Analytics figures synced for the Search & Performance workspace are kept for about 70 days - roughly two reporting periods. Older figures are deleted automatically every time we sync.

8. Links we email you

Some links we email you - to review your brief, approve a checkpoint or open your portal - work for anyone who has the link, and they do not expire. Treat them like a password: do not forward them, and tell us if one has been exposed.

9. Content about other people

If you give us names, photographs, biographies or testimonials belonging to other people - your team, your customers - you are responsible for having their permission and for the material being accurate. The same applies to logos, photographs, fonts and any other material you upload: you confirm that you have the right to use it and to let us publish it on your site. If someone asks us to remove their details, we will tell you and take them down.

10. Cookies

A cookie called evara_consent records your choice about analytics and lasts one year. If you accept, Google Analytics sets its own cookies to measure visits to our marketing pages. If you decline, no analytics cookies are set and we clear the ones we can. You can change your mind at any time using the Cookies link in the footer. Cookies strictly needed to keep the admin area signed in are always set.

11. Your rights

You can ask us for a copy of what we hold about you, to correct it, to delete it, to receive it in a portable form, or to object to or restrict how we use it. Write to info@evara.studio and we will respond.

If you are unhappy with how we have handled your information, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, ip-rs.si).

12. Google Search Console & Analytics (Search & Performance)

If your plan includes the Search & Performance workspace and you choose to connect it, you grant us access to your own Google account so we can read the figures Google already holds about your site. You choose which property we read, and you can end it at any time. We ask for exactly two permissions:

• Search Console (read-only) - the searches your site appeared for, clicks, impressions and average position.
• Analytics (read-only) - visitor and session counts, and conversions if you have set up key events in Analytics.

Both permissions are read-only. We cannot change anything in your Google account, we cannot see any other Google service, and we do not request access to your email, files or calendar.

The permission Google gives us is stored encrypted on our servers and is never sent to a browser. It is used only to fetch your figures on a daily schedule and when you press refresh.

We store the figures Google reports - daily totals, top searches and top pages - for about 70 days, which is roughly two reporting periods. Older figures are deleted automatically on every sync. Disconnecting stops all further syncing and removes our permission, but leaves the figures already stored; there is a separate button in the workspace that deletes those permanently.

Nothing is connected unless you connect it. Deleting the synced figures on our side does not change anything inside your own Google account, and does not affect Google's own retention of your data.

These figures are not sent to any AI provider, are not used to train anything, and are not shared with anyone else. The workspace calculates everything from the numbers Google returns using fixed rules; nothing in it is generated or written automatically.

13. Changes to this policy

If we change how we handle information, we will update this page and the date at the top.

Partner Program

For partner applications we process account, registered-business, representative or contact, tax and VAT status, address, protected bank-detail, agreement, and internal-review data. Tax, registration, address, and bank details are not public.

Referral attribution uses an Evara code and, when storage consent is granted, a first-party cookie for up to 30 days. Without consent, the parameter is preserved only through the active journey where technically possible. No third-party tracker is loaded solely for referrals. For manual introductions, the partner must confirm that the contact expects the introduction or agreed to contact.

Partner invoices are stored privately. Commission statements, invoices, payouts, adjustments, and audit history are retained for operational, accounting, security, and legal obligations. Exact retention periods for rejected applications, referral contacts, financial records, and audit events require lawyer or accountant confirmation before launch.

Questions about your information? info@evara.studio.

Plain-language privacy notice. Provided by Evara Studio.