Privacy policy

1. Overview

Evident UGC is a brand operated by Better Interaction INC ("Company", "we", "us", "our"). We provide a customer evidence and incentives platform for e-commerce merchants. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our website (evidentugc.com), our platform (app.evidentugc.com), our API (api.evidentugc.com), and our MCP server for AI assistants (mcp.evidentugc.com).

2. Information we collect

Merchant account data: When you create an account we collect your name, email address, company name, store URL, and billing information. Billing is processed by our payment provider; we do not store payment card numbers.

End-consumer data processed on your behalf: As a merchant using our platform, you may direct us to send review request emails to your customers and to store their review submissions, loyalty activity, and related metadata. We process this data as a data processor acting on your instructions.

Usage and technical data: We automatically collect IP addresses, browser type, operating system, pages viewed, and referring URLs when you visit our website or use our platform. We use this data for security, analytics, and service improvement.

Communications: If you contact us by email or through a contact form, we retain that correspondence to respond and improve our support.

AI assistant connections: When you connect an AI assistant (such as ChatGPT or Claude) to Evident through our MCP server, we store a connection record containing your Evident user identifier and the organization you chose. We do not store the assistant's conversation with you. For each tool the assistant calls, we record the tool name, whether it succeeded, the type of credential used (a signed-in connection or an API key), your organization identifier, how long the call took, and when it happened. We do not record the arguments the assistant sent or the data returned.

3. AI assistants and data sent to them

You choose whether to connect an AI assistant to Evident, and which organization it can reach. A connected assistant acts with your own role and permissions in that organization; Evident re-checks your membership on every call.

When the assistant uses an Evident tool, the result is sent to the AI provider that operates the assistant (for example OpenAI for ChatGPT, or Anthropic for Claude). Depending on what you ask, a result can include store data such as products, orders, reviews and review text, FAQs, gallery submissions, loyalty balances and transactions, and, when you look up one customer by email address, that customer's email address and activity. List results never include customers' email addresses; where a list needs to identify a customer, the address is masked.

The AI provider processes that data under its own terms and privacy policy, not ours. We do not control how an AI provider stores or uses what it receives. Do not connect an assistant to Evident if your agreement with your customers does not allow their data to be processed this way.

You can disconnect an assistant at any time from the assistant's own settings, remove a user from your organization to end their connections, or revoke an API key in Evident under Settings → API Keys. To have stored connection records deleted, contact privacy@evidentugc.com.

4. How we use your information

To provide, operate, and improve the Evident platform and website.

To send transactional communications such as account confirmations, billing receipts, and service updates.

To process review requests and loyalty events on behalf of merchants and their customers.

To monitor platform health, detect security incidents, and investigate abuse.

To comply with legal obligations.

We do not sell personal information to third parties.

5. Data sharing and third-party services

We share data only as necessary to operate the platform. Our key sub-processors include:

Clerk (authentication and user identity); Throttle (subscription billing); Resend (transactional email delivery); Cloudflare (media and file storage, MCP server hosting, and MCP usage analytics); Render (API and worker hosting); Vercel (frontend hosting); Sentry (error monitoring); Klaviyo (email marketing integration, when enabled by merchant).

When you connect an AI assistant, the provider that operates it (for example OpenAI or Anthropic) receives the tool results described in section 3. It acts on your instructions as your chosen recipient, not as our sub-processor.

When a merchant connects an integration such as Klaviyo, BigCommerce, or Shopify, we share only the data necessary to power that integration, subject to the merchant's configuration and the third party's own privacy policy.

We may disclose information if required by law, court order, or to protect the rights and safety of Evident, our users, or the public.

6. Cookies and tracking

We use session cookies and local storage to maintain authenticated sessions on the platform. Our marketing website (evidentugc.com) uses minimal analytics. We do not use third-party advertising trackers or sell browsing data.

7. Data security

We protect personal information using industry-standard controls including TLS encryption in transit, encryption at rest, role-based access controls, and least-privilege principles. Our hosting infrastructure (Render, Vercel, Cloudflare) maintains SOC 2 compliance. We monitor for anomalies and security incidents using Sentry and platform-level alerting.

8. Data retention

Merchant account data and end-consumer data processed on your behalf (reviews, orders, loyalty records, gallery submissions) are kept while your account is active. When you close your account, or ask us to delete it, we delete this data from our live systems within 90 days.

Backups: we keep daily backups for 30 days and monthly backups for 12 months. Deleted data therefore leaves our backups within 12 months of deletion, and is not restored from a backup except to recover from an incident.

MCP usage records (tool name, outcome, credential type, organization identifier, duration, and time) are kept for 3 months and then deleted automatically.

AI assistant connection records are kept while the connection exists and deleted with your account data, or sooner on request.

Error reports sent to Sentry are kept for up to 90 days.

Support correspondence is kept while your account is active and deleted with your account data.

We may keep specific records longer where the law requires it, such as billing records for tax purposes. You may request deletion of your data at any time by contacting privacy@evidentugc.com.

9. Your rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal information; to object to or restrict certain processing; and to data portability.

California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.

EEA/UK residents (GDPR): You have the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at privacy@evidentugc.com.

10. Children's privacy

Our platform is not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of our services after any change constitutes your acceptance of the updated policy.

12. Contact us

For privacy-related questions or requests, contact us at privacy@evidentugc.com or by mail at Better Interaction INC, attn: Privacy, 3435 NE 45th Ave Suite H, Portland, OR 97213.