Privacy Policy
Last updated: July 2026
This privacy policy describes how Evokly ("we", "our", "Evokly") collects, uses and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
By using our service you acknowledge that you have read and understood this privacy policy.
1. Data controller
2. Personal data we collect
We collect the following data:
2.1. Identification data
- First and last name
- Email address
- Phone number (optional)
- Company name (for business accounts)
2.2. Connection data
- IP address
- Browsing data (cookies, session identifiers)
- Sign-in timestamps
2.3. User content
- Uploaded photos and videos
- Media metadata (date, time, location where available)
- Comments and interactions
Your photos and videos are NEVER used for commercial purposes. They are not sold, passed to third parties, used for advertising or marketing, or used to train artificial-intelligence models. They are processed solely to provide you with the service (hosting, organising, presenting and sharing within your event).
2.4. Face-matching data
Important: Face matching is only switched on after your explicit consent, recorded with a timestamp and the version of the notice. Your selfie is then sent securely to our servers, where it is converted into a facial descriptor (a mathematical vector that cannot be turned back into an image) used to find your photos in the event. The selfie and the descriptor are encrypted in transit (TLS 1.3) and at rest, are never shared with third parties or used to train models, and are deleted automatically at the end of the event's storage period. You can also ask for them to be deleted at any time.
3. Purposes of processing
Your data is used to:
- Provide and improve our media collection and sharing services
- Manage your user account and authentication
- Organise and present media within events
- Enable face matching (with your explicit consent)
- Maintain security and prevent fraud
- Meet our legal and regulatory obligations
- Send you important communications about your account (invoices, notifications)
- Improve our services through statistical analysis (anonymised data)
4. Legal basis for processing
Performance of a contract: The data needed to deliver the service (name, email, media) is processed to perform the service contract.
Consent: Face matching and newsletters require your explicit consent, which you can withdraw at any time.
Legal obligation: Retention of billing data in line with accounting and tax obligations.
Legitimate interest: Improving our services, security and fraud prevention (anonymised data).
5. Who receives your data
Your data may be shared with:
- Authorised Evokly staff: Only where the service requires it
- Technical providers: Hosting (Cloudflare R2), payment services (strictly necessary data only)
- Judicial authorities: On lawful request only
We never sell your personal data to third parties, and your photos and videos are never commercialised, passed to third parties, used for advertising or used to train artificial-intelligence models.
6. How long we keep data
Account data: Kept for as long as you use the service and for 3 years after the account is closed (legal obligations).
Media: Kept until deleted by the user or the event administrator, or 1 year after the event ends.
Connection data: 12 months maximum.
Billing data: 10 years (legal obligation).
7. Your rights
Under the GDPR you have the following rights:
7.1. Right of access
You can ask for a copy of all the personal data we hold about you.
7.2. Right to rectification
You can correct or update your personal data from your account or by contacting us.
7.3. Right to erasure (the "right to be forgotten")
You can ask us to delete your personal data, subject to any legal retention obligations.
7.4. Right to portability
You can ask to receive your data in a structured, commonly used format.
7.5. Right to object
You can object to the processing of your data on legitimate grounds, in particular for direct marketing.
7.6. Right to restriction
You can ask us to restrict the processing of your data in certain cases.
7.7. Right to withdraw consent
For processing based on consent (face matching, newsletter), you can withdraw your consent at any time.
To exercise your rights:
Contact us by email at contact@evokly.io or through your account settings. We will reply within one month at most.
8. International transfers
Your data is hosted mainly in the European Union. Some of our providers (Cloudflare in particular) may transfer data to third countries. Where that happens, we make sure appropriate safeguards are in place (standard contractual clauses, the EU-US Data Privacy Framework, and so on).
9. Data security
We put appropriate technical and organisational measures in place:
- Encryption of data in transit (HTTPS/TLS)
- Password encryption (bcrypt hashing)
- Two-factor authentication available
- Restricted access to personal data
- Regular, secure backups
- Monitoring and intrusion detection
10. Cookies
We use cookies to run the service. For more information, see our cookie policy.
11. Complaints
If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority (CNIL):
12. Data Processing Agreement (DPA)
For business and enterprise customers, Evokly offers a Data Processing Agreement (DPA) compliant with article 28 of the GDPR.
What the DPA covers: The DPA covers the respective obligations of the controller (the customer) and the processor (Evokly), the technical and organisational security measures, the conditions for sub-processing, and how we assist with data subject requests.
Face matching: Biometric data is processed only with the attendees' explicit consent. The selfie and facial descriptors (mathematical vectors) are processed on our secure servers, deleted automatically at the end of the event's storage period, and deletable on request at any time. They are never shared with third parties or used to train models.
Storage periods by plan:
- Discover plan (free): 15 days after the event
- Event plan: 6 months after the event
- Pro plan: 12 months after the event
- Enterprise plan: 24 months (customisable)
Sub-processors: The full list of our sub-processors (hosting, storage, payment) is available on request and included in the DPA.
Getting the DPA:
To receive our DPA, contact us at contact@evokly.io. The DPA is provided free of charge and can be signed electronically.
13. Changes to this policy
We may change this privacy policy. Any change will be published on this page with a new update date. We will let you know by email if the change is substantial.
14. Contact
For any question about this privacy policy or your personal data, contact us:
General contact: contact@evokly.io