EVY Privacy Policy

Effective date: May 8, 2026 Last updated: May 13, 2026

1. Introduction

This Privacy Policy (“Policy”) explains how Evestar Group LLC (“Evestar,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use the EVY application (“EVY” or “the App”) for Shopify and our related services available at evestar.com (collectively, “the Service”).

EVY is a Creative Intelligence application that helps Shopify merchants and advertising agencies build and execute creative strategy. EVY analyzes competitive advertising creative, identifies the patterns that drive winning ads, generates ad copy and visual concepts, and supports the execution of advertising campaigns across connected platforms — drawing on a merchant’s product catalog, advertising data from connected platforms, design files from Figma when connected, and publicly available competitor advertising data.

Evestar Group LLC is registered at: 8625 Twin Lake Drive, Boca Raton, FL 33496, United States.

By installing or using EVY, you acknowledge that you have read and understood this Policy.

2. Scope

This Policy applies to all data Evestar processes through EVY, including:

Data accessed from Shopify stores via the Shopify Admin API when a merchant installs EVY
Data accessed from connected advertising and analytics platforms (Meta Ads, TikTok Ads, Triple Whale) when a user authorizes those connections
Data accessed from Figma via our Figma plugin when you connect Figma and authorize file access
Publicly available competitor advertising data accessed from public ad libraries (such as the Meta Ad Library and TikTok Creative Center) used to inform creative analyses
Data you submit when interacting with EVY directly (account information, settings, support communications)

3. Our Role

For data accessed from Shopify merchant stores and connected advertising platforms, the Shopify merchant (or the agency operating on the merchant’s behalf) is the data controller, and Evestar acts as a data processor. We process this data only as needed to deliver the Service to the merchant or the merchant’s authorized agency.

For data about you as a direct user of EVY — your account, billing, support communications, and usage telemetry — Evestar is the data controller.

4. Information We Collect

4.1 From Shopify

When EVY is installed on a Shopify store, we access only product catalog data via the Shopify Admin API, using the read_products scope.

Product data:

Product titles, descriptions, prices, currency, variants, SKUs, vendor, product type, tags
Product images and image URLs
Inventory levels and availability

EVY does not request any of the following Shopify access scopes and does not read or store any data made available through them:

read_orders or read_all_orders — no order history, no sales data, no order-level information of any kind
read_customers — no customer names, email addresses, phone numbers, addresses, or customer identifiers
read_draft_orders, read_checkouts, read_fulfillments, or any other scope unrelated to the product catalog

Product data is used to give EVY’s creative analyses awareness of what the merchant sells, so that recommendations, ad copy, and visual concepts can be generated in the context of the actual product catalog.

4.2 From Connected Advertising and Analytics Platforms

When a user connects Meta Ads, TikTok Ads, or Triple Whale, we access the data made available through those platforms’ APIs, including:

Account, campaign, ad set, ad, and creative performance metrics (spend, impressions, clicks, conversions, ROAS, CPM, CTR)
Creative assets (images and videos) and their metadata
Aggregated attribution data and new-customer metrics from Triple Whale, where connected

With your authorization, EVY may also create, update, and manage advertising campaigns, ad sets, and creative assets on your behalf within the connected advertising platforms. You can revoke this authorization at any time by disconnecting the platform within EVY or by revoking the connection from the platform itself.

These platforms typically expose aggregated, account-scoped metrics rather than end-customer personal data, but where personal data does flow through these connections, this Policy governs how we handle it.

4.3 From Figma

When you connect EVY to Figma via our Figma plugin, we read the following from any Figma file you authorize the plugin to access:

File key — the unique identifier Figma assigns to the file
File name — the name of the file as it appears in Figma
Node list — the list of nodes within the file, including their identifiers, names, and hierarchy used to map the file’s structure

Where this data goes:

It is transmitted from the Figma plugin to the EVY backend over an authenticated, encrypted connection
On our backend, it is stored in our managed Postgres database, encrypted at rest, and subject to the same security and retention controls described elsewhere in this Policy
Lightweight plugin state — for example, your connection preferences and the most recent file context — is also stored locally inside your Figma client using Figma’s figma.clientStorage API. Data stored in figma.clientStorage is scoped to your Figma user and is not transmitted to Evestar

You can revoke EVY’s access to your Figma files at any time by uninstalling the Figma plugin or by disconnecting Figma from within your EVY account.

4.4 Public Competitor Advertising Data

To inform creative analyses, EVY ingests publicly available competitor advertising data from public ad libraries, including the Meta Ad Library and the TikTok Creative Center. This data typically includes:

The ad creative (image or video) and on-screen text
The advertiser (page or account) name as shown publicly
Ad metadata such as run dates, regions, and platforms

We use this data only to identify creative patterns and trends that inform recommendations. We do not use it to identify individuals appearing in ad creative. To the extent that ad creative depicts identifiable individuals (for example, founders or talent appearing in their own ads), Evestar relies on the public availability of that creative through the platform’s official ad library.

4.5 From You as a User

When you create or use an EVY account, we collect:

Name, business email address, business phone number, and password (passwords stored only as salted hashes; we do not retain plaintext passwords)
Billing information, processed by our payment provider; we do not store full payment card numbers
Support communications you send to us
Usage telemetry (pages viewed, features used, error logs) used to maintain and improve the Service

We do not use third-party advertising trackers within the EVY application.

5. How We Use the Information

We use the information described above to:

Operate EVY for you — analyze competitor advertising, diagnose your own creative performance, generate creative strategy recommendations, write ad copy, design ad creatives, and support campaign execution on connected advertising platforms
Power AI-driven analyses based on aggregated patterns derived from your data and public competitor advertising data
Provide customer support and respond to your requests
Maintain, secure, monitor, and improve the Service
Comply with our legal obligations (tax, accounting, lawful requests from authorities)
Detect, prevent, and respond to fraud, abuse, or violations of our terms

We do not use personal data for any purpose materially different from what is described in this Policy without first obtaining your consent or providing notice.

6. Legal Bases (GDPR)

For users covered by the GDPR, we process personal data on the following legal bases:

Performance of a contract — to deliver the Service to you and to merchants who have engaged us
Legitimate interests — to operate, secure, and improve the Service, in a manner that does not override your rights or freedoms
Consent — where you provide consent for a specific purpose, such as connecting an additional platform
Legal obligation — to comply with applicable laws and regulatory requirements

You may withdraw consent at any time where consent is the legal basis for processing.

7. How We Share Information — Sub-processors

We do not sell personal data, and we do not “sell” or “share” personal data within the meaning of the California Consumer Privacy Act (“CCPA”) or the California Privacy Rights Act (“CPRA”).

To deliver the Service, we engage the following sub-processors:

7.1 Infrastructure Providers

Provider	Role	Location
DigitalOcean, LLC	Application hosting	New York, USA (NYC1)
Supabase, Inc.	Database and authentication	United States
Cloudflare, Inc.	Content delivery, DNS, and DDoS protection	Global edge network

7.2 AI Providers

EVY’s analyses are generated using large language models and AI services from:

OpenAI, L.L.C.
Google LLC (Gemini)
Anthropic, PBC (Claude)
Perplexity AI, Inc.

What we send. We send only aggregated patterns and creative taxonomy tags to these providers — for example, structured descriptions such as “ad uses founder-story theme, female creator, percent-off offer, ROAS at 2.1x.” Because EVY does not collect customer personal data from Shopify stores, no such data is included in any prompt sent to an AI provider.

Retention by AI providers. Evestar does not currently maintain enterprise zero-retention agreements with the AI providers listed above. Under those providers’ default policies, prompts and outputs may be retained for periods specified in their own terms (commonly up to 30 days for abuse-monitoring purposes) before deletion. Because the prompts we send contain aggregated, non-personal data, no personal data is exposed in those prompts.

No model training. We do not authorize any AI provider to use data submitted via EVY to train its models, where that option is available under the provider’s API terms.

7.3 Other Disclosures

We may disclose information if required by law, to enforce our agreements, to protect the rights, property, or safety of Evestar, our users, or others, or in connection with a corporate transaction (such as a merger, acquisition, or sale of assets), in which case affected users will receive notice of any change in handling of their data.

8. International Data Transfers

Our infrastructure is located in the United States. If you access EVY from outside the United States, your information will be transferred to and processed in the United States. Where personal data of EU/EEA, UK, or Swiss residents is transferred internationally, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss equivalents, as applicable) as the legal mechanism for transfer.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy.

Data	Retention
Shopify product data	While EVY is installed on the store; refreshed continuously and replaced with current values
Figma file metadata (file key, file name, node list)	Retained in Postgres while the Figma connection remains active; deleted within 30 days after you disconnect Figma or uninstall the plugin
Figma client-side plugin state (`figma.clientStorage`)	Stored locally in your Figma client; removed when you uninstall the EVY plugin from Figma
Shop-level data after uninstall	Deleted within 48 hours of receipt of Shopify’s `shop/redact` webhook
Customer data request and erasure webhooks	EVY does not store customer personal data or order data; we respond to Shopify’s `customers/data_request` and `customers/redact` webhooks within the required windows (30 days), confirming that no customer-level personal data is held
Backups	Retained for 7 days, then permanently deleted
Account, billing, and tax records	Retained as required by law (typically up to 7 years for tax records)
Support communications	Retained for up to 24 months
Aggregated, non-identifiable insights	May be retained indefinitely for product analytics

We comply with Shopify’s mandatory privacy webhooks: customers/data_request, customers/redact, and shop/redact.

10. Security

We apply industry-standard security measures to protect data, including:

Encryption in transit. TLS 1.2 or higher for all connections between you and EVY, and between EVY and our sub-processors.
Encryption at rest. AES-256 encryption for stored data via our database and storage providers.
Tenant isolation. Logical separation of data per merchant and per account; access is scoped at the API and database layer so one tenant cannot read another tenant’s data.
Access controls. Least-privilege role-based access for Evestar personnel; production access is logged and reviewed.
Vulnerability management. Dependency scanning, regular patching, and periodic penetration testing.
Secrets management. API tokens and credentials are stored encrypted and rotated on a defined schedule.

No method of electronic storage or transmission is 100% secure. While we apply commercially reasonable safeguards, we cannot guarantee absolute security.

11. Your Rights Under GDPR (EU/EEA, UK, Switzerland)

If you are located in the EU/EEA, the United Kingdom, or Switzerland, you have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you
Rectification — correct inaccurate or incomplete data
Erasure (“right to be forgotten”) — request deletion of your personal data
Restriction — request that we limit processing in certain circumstances
Portability — receive your personal data in a structured, machine-readable format
Objection — object to processing based on our legitimate interests
Withdraw consent — where we rely on consent, you may withdraw it at any time
Lodge a complaint — with your local data protection supervisory authority

To exercise any of these rights, contact us at support@evestar.com.

If you are a customer of a Shopify merchant using EVY, requests for access or deletion are typically directed first to the merchant (the data controller). Because EVY does not store customer personal data, our response to Shopify’s customers/data_request and customers/redact webhooks confirms that no customer-level personal data is held within the App.

12. Your Rights Under CCPA / CPRA (California Residents)

If you are a California resident, you have the following rights:

Right to know — request the categories and specific pieces of personal information we have collected about you
Right to delete — request deletion of personal information we have collected about you, subject to legal exceptions
Right to correct — request correction of inaccurate personal information
Right to opt out of sale or sharing — Evestar does not sell personal information and does not share personal information for cross-context behavioral advertising; accordingly, there is nothing to opt out of for this purpose
Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond those permitted under the CPRA without a separate disclosure
Right to non-discrimination — we will not discriminate against you for exercising any of these rights

To submit a CCPA/CPRA request, contact support@evestar.com. We will verify your identity before fulfilling the request, typically by confirming control of the email address associated with the account in question. You may use an authorized agent to submit a request on your behalf, subject to verification of authorization.

In the preceding 12 months, Evestar has collected the categories of personal information described in Section 4 of this Policy, used it for the purposes described in Section 5, and disclosed it only to the sub-processors described in Section 7.

13. Children’s Privacy

EVY is a business-to-business product not directed at individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided personal data through EVY, contact us at the address below and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this Policy reflects the latest revision. For material changes, we will provide additional notice through the App or by email to account administrators before the change takes effect. Your continued use of EVY after a change becomes effective constitutes acceptance of the updated Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your data, contact us at:

Evestar Group LLC 8625 Twin Lake Drive Boca Raton, FL 33496 United States

Email: support@evestar.com