Privacy policy

You can delete your Evantya account at any time, directly in the mobile app: More → My account → Delete my account, then confirm with your password. Deletion is immediate and you are signed out.

Erased: your name, email address, password, sessions and access to workspaces. The account can no longer be used.

Kept, no longer linked to your identity: invoices, quotes and contracts issued, for 10 years (accounting obligation), and messages exchanged with third parties, for 3 years.

Can't access the app anymore? Email oren@wedevops.fr from your account's address: we delete the account within 30 days.

The data controller is [À COMPLÉTER : dénomination sociale de l'éditeur], whose registered office is at [À COMPLÉTER : adresse du siège]. For any question about your data, you can write to oren@wedevops.fr.

Has a data protection officer been appointed? [À COMPLÉTER : désignation d'un DPO (oui / non) et ses coordonnées le cas échéant].

We process only the data the service needs:

• Account: surname, first name, email address, password (only in hashed form), role and workspace.
• Professional profile: business name, service categories, coverage area, prices, photographs, the company’s legal details.
• Event: type, date, venue, number of guests, budget, style, constraints (including, if you enter them, dietary or religious preferences and accessibility needs).
• Guests: name, contact details where given, reply, dietary needs, seating — imported by the organiser.
• Exchanges: messages between organisers and vendors, quotes, contracts, shared deliverables.
• Billing: billing details and transaction history. We never have access to your full card number.
• Technical use: connection logs, IP address, timestamp, device type — needed for security and for the service to run properly.

When you import a guest list, you alone decide what data you enter: you are responsible for it. Evantya then acts as a processor, on your behalf and on your instructions.

You undertake to import only data you are entitled to process, to tell the people concerned what you use it for, and to answer their requests. We never reuse that data for our own purposes and pass it to no third party beyond what the service requires.

The photographs and videos taken at your event may contain images of your guests. As the organiser, you undertake to tell them they are being filmed or photographed. The usage rights over those images (private use, the vendor’s portfolio, social media, duration, territory) are set by the clauses of the contract signed with the vendor concerned. Anyone appearing in an image may ask for it to be taken down: send the request to the vendor, or to us if the content is hosted on Evantya.

Some optional features help you write or visualise: a suggested quote from your catalogue, a draft reply in the messaging, a summary of your event, and mood images in the styling studio. Here is exactly what happens.

• What is sent: only what the request you trigger needs (the brief you typed and your catalogue for a quote, the latest messages in the thread for a reply, your event’s data for a summary, the description and the palette for a styling image). Nothing is sent until you explicitly ask for a suggestion.
• Generated images: the styling studio’s images are mood suggestions, produced from your description and your palette. They are neither photographs of a real venue nor a contractual rendering. Every board clearly states whether its images were generated or are selected inspiration references.
• To whom: to a language model provider acting as a processor ([À COMPLÉTER : fournisseur de modèle (texte et images) retenu]), bound by contract.
• No training: the data sent is not used to train a model.
• You keep the decision: every suggestion is a draft you read, edit and approve. Nothing is sent, published or signed automatically.
• No automated decision: no decision producing legal effects or significantly affecting you is taken on the sole basis of automated processing.
• Optional: you can use Evantya without ever touching these features. They are then replaced by deterministic calculations, which the interface states explicitly.

Your data is accessible to authorised internal teams and, strictly as far as necessary, to the following technical providers:

Data may also be disclosed to administrative or judicial authorities where the law requires it. It is never sold.

When you exchange messages with a vendor (or an organiser), the information that exchange needs is of course accessible to them: that is the very point of the service.

We favour providers hosting data within the European Union. If a transfer outside the EU is necessary ( [À COMPLÉTER : transferts hors UE éventuels et pays concernés]), it is framed by the safeguards provided for by the GDPR: an adequacy decision of the European Commission or standard contractual clauses, with supplementary measures where needed. A copy of those safeguards can be requested.

Once those periods are over, the data is deleted or irreversibly anonymised.

In accordance with regulation (EU) 2016/679 and the French Data Protection Act, you have the following rights:

• Access — obtain a copy of the data concerning you.
• Rectification — correct data that is inaccurate or incomplete.
• Erasure — ask for deletion, subject to our statutory retention obligations.
• Restriction — freeze the use of your data while something is checked.
• Objection — object to processing based on our legitimate interest, and at any time to marketing.
• Portability — get your data back in a structured, machine-readable format.
• Withdrawal of consent — at any time, without affecting processing already carried out.
• Post-mortem instructions — decide what becomes of your data after your death.

To exercise these rights, write to oren@wedevops.fr. We answer within one month, extended to three months for complex requests, telling you beforehand. Proof of identity may be requested where there is reasonable doubt.

If our answer does not satisfy you, you may refer the matter to the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or lodge a complaint online on its website.

We put appropriate technical and organisational measures in place: encrypted traffic (HTTPS), passwords stored as irreversible hashes, strict separation between workspaces, role-based access control, logging of sensitive actions, regular backups and internal access limited to what is strictly necessary.

In the event of a data breach likely to create a high risk to your rights, you will be told as quickly as possible, in accordance with article 34 of the GDPR.

The use of cookies and trackers, and how to refuse them, are set out in our dedicated policy, reachable from the footer.

This policy may change along with the service or the regulations. Any substantial change will be flagged to you before it takes effect. The date it was last updated is at the top of the page.