Privacy Policy
evot.io (EVOTIO) handles your personal information in line with Korea's Personal Information Protection Act and other applicable laws. This policy explains what we collect, why we use it, who we entrust it to, when we delete it, and what you can ask of us.
1. What we collect
Account (required) — your email address, name, and profile image, received from Google Sign-In. We never see your Google password. Your name becomes your default display name, which you can change in Settings. Content — the cells, logs, Vots (personality, instructions, memory), knowledge, files, images, routines, and simulations you create or upload; your conversations with yourself (what you said, your clone Vot's replies, and conversation summaries); your Hideout (what you add to the diary, what you write in the books on your bookshelf, the monologues and diary entries your clone Vot writes from your conversations with yourself, the hobbies, likes, habits, how you are when worn down and what comfort helps, current worries and hopes, the people close to you, and what you value that your clone Vot picks up from those conversations, your diary, and your book notes and remembers, and your room layout); and your settings. Activity — a record of how you work inside evot.io, used by your clone Vot to understand how you work: the text of a cell before and after you edit it, the requests you send to a Vot along with part of the cell you were looking at, whether you accept an autocompletion a Vot proposes, and requests and notes you send to your clone Vot from a messenger. We record only what you wrote yourself, and we do not collect which logs you open or how long you stay on a cell. This record is summarized into a profile that belongs to you alone, which your Vot consults when it responds. You can exclude specific logs from collection in Settings, and on the Free plan we collect only the type and time of each activity, never the text. Usage — which models you called, token counts, cost and credit history, feature usage, and error logs. Prompts and responses carried in AI requests are kept for 90 days for debugging and then deleted; after that only totals such as the model, token counts, and cost remain. Connection and device — IP address, browser and device information, when you last visited, how you first arrived (the public page you signed up from, if any), and your invite code and who invited you. If you turn on the hideout's weather (off by default), we use your approximate location (latitude and longitude) derived from your IP address only to fetch the weather, and we don't store it with your account. Integrations (optional) — if you link Notion, Slack, Telegram, Discord, or KakaoTalk, the account identifiers and access tokens that integration needs. If you connect an external AI app (MCP), that app's name and when it was last used. If you turn on browser notifications, your notification subscription. If you connect the evot.io agent running on your computer, the computer's name and the tools installed (Claude Code, Codex). If you register your own API key, that key (stored encrypted). Payments (paid use) — we never receive your card details. Polar, the seller, processes the payment and sends us the transaction status, plan, billing email, name, billing address, and business tax ID (if you entered one). Support and refund requests — the messages you send from Support in Settings, our replies, the screen details you choose to send with a message (the address of the page you were on, your browser and window size, and recent error messages), and the reason you give when you request a refund.
2. Why we use it and on what basis
To run the Service and keep your workspace in sync; to produce the AI results you ask for; to meter usage and bill it; to prevent abuse and keep accounts secure; to answer support requests; and to meet legal obligations such as tax and e-commerce record keeping. How you first arrived and who invited you are used to grant invite rewards and improve the Service; public page view counts are used to calculate publisher rewards. Activity records are used only to personalize your clone Vot. That profile applies to you alone, is never shown to other users, and is not used for advertising or to compare or rate users. Legal basis — in Korea, processing necessary to enter into and perform our contract with you (PIPA Article 15(1)(4)), to meet legal obligations (Article 15(1)(2)), and your consent for optional features such as integrations. Where the GDPR applies, we rely on performance of contract, legitimate interests (security, abuse prevention, and personalizing your clone Vot), legal obligations, and consent. You may object at any time to the processing of activity records for personalization — exclude logs in Settings, or email us and we will stop.
3. What other people can see
The following is visible to others only when you choose to make it public. Publishing on Vot Hub — the title, description, tags, face image, price, and your display name are visible to anyone, including people who are not signed in. When a subscriber talks with that Vot, the Vot's personality, instructions, and memory and the contents of the Log linked to the Vot are used to produce the subscriber's replies, and the Vot's routine results are delivered to subscribers. Hub comments — show your display name and profile image. Knowledge network — cells you share as knowledge and the comments you leave on knowledge are visible, with your display name, to other signed-in users. Knowledge goes public after review. Separately, summaries and addresses of public web pages your Vots read may be published as knowledge after review. We don't show who had them read. Addresses on document-sharing services such as Google Docs or Notion, and YouTube videos that aren't public, are not submitted. Public publishing — when you publicly publish a simulation, its content and your display name are posted on public pages anyone can see (evot.io/s) and may be indexed by search engines. Unpublishing or deleting your account removes the public page, but copies other users made with Continue and content already collected elsewhere may remain. Your display name defaults to your Google account name; you can change it in Settings before publishing.
4. Who processes it with us
The companies below process information on evot.io's behalf. Where they process it is in parentheses. Supabase — database, sign-in, and file storage. Your account and all content (Seoul, South Korea) Vercel — web hosting and delivery. Request information and IP addresses (global edge network) Google — sign-in: email address, name, and profile image Google — Gemini API: the cells and prompts needed for Vot conversations, summaries, cleanup, tagging, simulations, image generation, voice transcription, Vot creation, and the knowledge network (search embeddings), plus text extracted from attachments, reference images, and audio (Google infrastructure, no fixed location) Google — document reading (Cloud Run): extracts text from documents you attach to cells. The original document (Seoul, South Korea) Google — Document AI OCR: only document pages whose cost and transfer you approve (Singapore) Google — YouTube Data API: video and channel identifiers from YouTube links you or a Vot provide OpenRouter — the cells, prompts, and conversation needed for AI models other than Gemini (DeepSeek, Qwen, Claude, GPT, and others) and for the model that decides whose turn it is in a conversation. The request is handled by a provider OpenRouter selects (such as Amazon Bedrock, OpenAI, Moonshot AI, or Alibaba), and we configure it never to select providers that train on inputs (United States and the providers' countries) fal.ai — the image prompt and reference images when you choose the Seedream model for image generation. We ask fal not to store the request, and resulting images are deleted there within an hour after we copy them to evot.io (United States and elsewhere) xAI — the image prompt and reference images when you choose a Grok model for image generation. We set xAI not to store the request or the result (United States) Anthropic — the cells, prompts, and conversation needed for Claude models, including free clone learning runs. We send these directly with evot.io's key and go through OpenRouter only when that key can't be used (United States) Anthropic and OpenAI — operator review on the knowledge network (Claude Code and Codex). Knowledge submitted for publication and its sources, comments, and reports (United States) Browserless — loads and reads web pages a Vot collects for you. The page address (United States) Polar — payments, invoicing, and tax. Billing email, account identifier, and subscription and order details (United States) Telegram, Slack, Discord, KakaoTalk, Notion — only if you link them. Vot replies, notifications, and cells you export MET Norway (Norwegian Meteorological Institute) — only if you turn on the hideout's weather. Latitude and longitude rounded to about 10 km. We don't send your IP address or account information (Norway) Browser push services — only if you turn on notifications. Routine, Vot, and simulation names (no content, encrypted) We don't sell your personal data and we don't share it for advertising.
5. AI providers and your content
When you ask a Vot to do something, the cells, prompts, and files needed for that request are sent to the provider serving the model you chose, and the result comes back to your workspace. Document pages that mechanical parsing cannot read are sent to Google Document AI OCR only after you separately approve the cost and transfer. evot.io does not use your content to train AI models. The same holds for your clone Vot's profile — it is a summary of your activity that the Vot consults when responding, and it never retrains a model or changes its weights. Gemini requests sent with evot.io's key go through Google's paid API. Google does not use these inputs and responses to train models, and logs them for a limited period solely to detect abuse and meet legal obligations. Requests sent through OpenRouter are configured to avoid providers that train on inputs. Claude requests go directly to Anthropic with evot.io's key, and Anthropic does not use API inputs and responses to train models. How long each provider keeps data is governed by that provider's terms. Files you upload to create a Vot are turned into text in your browser. That text is sent to Gemini only when you press Look through with AI or Draft my Vot, and we don't store the original file or its contents. Personal details that appear in the AI's draft — contact info, addresses, account numbers, birth dates and the like — are removed automatically. On paid plans you can bring your own OpenRouter, Gemini, Anthropic, or OpenAI key, in which case conversations and interactive image requests go to your own provider account and follow its terms. The following always run on evot.io's keys: fal.ai and xAI image generation, batch processing (simulation steps and scene images), the model that decides whose turn it is in a conversation, short AI features within the free allowance (auto-tagging, rewriting, cleanup), knowledge network features (pre-screening and Vot comments), free clone learning runs, and the Hideout (your clone Vot's monologues and diary, the word it says back to a note you throw in the trash bin, what it remembers about you, and fishing). Your clone Vot's profile is made by summarizing your activity with the AI model you chose. Only free learning runs (once a week on paid plans, once a month on the Free plan) use Claude Haiku (Anthropic) on evot.io's key. AI replies can be wrong or inappropriate. If you see a problematic reply, let us know at the privacy officer's email below and we will look into it. Unless it's necessary, please don't enter sensitive information — such as health, beliefs, or financial details — or other people's personal information.
6. International transfers
To perform our service contract, evot.io entrusts processing to providers outside Korea and discloses those transfers through this policy under PIPA Article 28-8(1)(3)(a). Transfers happen over the network when you use the relevant feature. Each line reads: recipient (contact) — country · items · purpose · retention. Google LLC (support.google.com/policies/troubleshooter/7575787) — the United States and other countries where Google has data centers · sign-in information; the cells, prompts, text extracted from attachments, reference images, and audio needed for AI requests; video and channel identifiers from YouTube links · sign-in, AI processing, YouTube lookups · AI requests up to 55 days for abuse prevention Google Cloud (same contact) — Singapore · document pages you approve · text recognition (OCR) · as long as needed to handle the request OpenRouter, Inc. (privacy@openrouter.ai) — the United States and the countries of the providers OpenRouter selects · the cells, prompts, and conversation needed for AI requests · AI processing · OpenRouter requests follow the account data policy Features & Labels, Inc. (fal, support@fal.ai) — the United States and elsewhere · image prompts and reference images · image generation · we ask fal not to store the request, and resulting images are deleted there within an hour X.AI LLC (xAI, privacy@x.ai) — the United States · image prompts and reference images · image generation · we set xAI not to store the request or the result Anthropic, PBC (privacy@anthropic.com) — United States · the cells, prompts, and conversation needed for Claude requests · AI processing · for the period set by Anthropic's API terms Anthropic, PBC (privacy@anthropic.com), OpenAI OpCo, LLC (privacy.openai.com) — United States · knowledge submitted for publication and its sources, comments, and reports · operator review on the knowledge network · for the period set by each company's terms and the operator account's data settings browserless.io, Inc. (support@browserless.io) — United States · page addresses · reading web pages · as long as needed to handle the request Polar Software Inc. (privacy@polar.sh) — the United States and elsewhere · billing email, name, billing address, and order details · payments and tax · as Polar's legal obligations require Vercel Inc. (privacy@vercel.com) — the United States and elsewhere · request information and IP addresses · web hosting and delivery · as Vercel's terms specify Volentio JSD Limited (jsDelivr, legal@jsdelivr.com) — the United Kingdom and elsewhere · visitors' IP addresses and browser information · font delivery · as jsDelivr's policy specifies Notion Labs, Inc. (team@makenotion.com), Slack Technologies (privacy@slack.com), Discord Inc. (privacy@discord.com), Telegram (edpo.com/telegram-gdpr-data-request) — each company's countries · Vot replies, notifications, and cells you export, when you've linked them · transfers you request · as each company's terms specify MET Norway (Norwegian Meteorological Institute, met.no) — Norway · latitude and longitude rounded to about 10 km, when you've turned on the hideout's weather (no IP address or account information) · weather lookup · as MET Norway's terms specify If you don't want your data transferred abroad, you can stop using the feature or delete your account. AI features and payments can't be provided without the transfer, so refusing means you can't use them. Our database and file storage (Supabase) and attachment reading (Google Cloud Run) are processed in Seoul, South Korea.
7. Sharing with third parties
evot.io does not provide your personal information to third parties, except where you choose it — publishing on Vot Hub and public publishing (section 3), and sending to messengers or Notion you've linked — or where the law requires it.
8. How long we keep it and how we destroy it
Your content stays until you delete it or delete your account. Deleted cells stay in the trash for 7 days and are then permanently deleted. Activity records — 24 months from collection Conversations with yourself — until you delete them or your account AI request text — 90 days (only totals remain afterwards) Public page view measurement — 2 days (we don't store IP addresses; afterwards only daily view counts remain) Short AI feature usage totals — 400 days When you delete your account we promptly delete your account and content, Vots, Hub listings and their subscriptions, integration links, and credit and usage history. Uploaded files are deleted progressively after the deletion is processed. The following remain: Payment records — only the order number, amount, and status, with anything that identifies you removed, kept for 5 years and then destroyed. Polar, the seller, keeps transaction records under its own obligations. Support and refund request records — as records of consumer complaints and dispute handling, kept for 3 years from the last action with the link to your account removed and the email address you had when you deleted your account, then destroyed (Korean Act on Consumer Protection in Electronic Commerce). A hash of your sign-up email — kept so sign-up bonus credits can't be claimed twice. The hash alone can't reveal your email. Copies of your simulations that other users made with Continue, and copies of public web pages that several users share App installations in a Slack workspace (they remain at the workspace level) Knowledge made public on the knowledge network — kept with the author's name replaced by a generic label and the link to your account removed. Comments and ratings are deleted, as are posts that were never made public. How we destroy data — electronic files are deleted in a way that can't be recovered. Copies in our infrastructure providers' backups are removed when those backups expire. We don't create paper records.
9. Your rights and how to exercise them
You can ask at any time to see, correct, delete, or stop the processing of your personal information, and you can withdraw consent. You can check and edit your data in the app, export your content (for example to Notion), and unlink integrations or delete your account in Settings. For anything you can't do yourself, email the privacy officer below and we'll tell you the outcome within 10 days. You can also act through a legal representative or someone you've authorized; in that case we may ask for proof of the authorization. If you're in the EEA or the UK you also have the right to data portability and to complain to your local supervisory authority. Account information is required to enter into the service contract, so you can't sign up without it. Optional information such as integrations can be left out and the rest of the Service still works.
10. Cookies, browser storage, and outside resources
evot.io doesn't use cookies, doesn't use advertising or analytics tools, and doesn't track you across other sites. Instead, your browser's local storage holds your sign-in session, logs and cell text and account information (email, name, photo) for fast display, language, theme, and layout preferences, and your invite code and how you first arrived. Signing out clears the log list, and clearing your browser's site data removes all of it. Turning on notifications installs a service worker for them. Fonts are loaded from jsDelivr, so opening a page sends your IP address and browser information to jsDelivr. Google profile images are loaded directly from Google's servers.
11. Children
evot.io isn't intended for children under 14. If we learn we've collected data from a child under 14, we'll delete it.
12. How we keep it secure
Technical — data is encrypted in transit and at rest by our infrastructure providers, and your own API keys and integration tokens (Notion, Slack) are encrypted once more. Row-level access control lets only you reach your data, and uploaded files are kept in private storage and served only through short-lived signed links (images you publish publicly are kept in public storage). Administrative — access to production data is limited to the operator, service keys are kept only on the server, and we run regular security reviews. Physical — servers are protected by our providers' (Supabase, Vercel, and others) data center security.
13. Automated decisions
evot.io does not make decisions that significantly affect your rights or obligations without human involvement. Refund requests are reviewed by the operator. Clone Vot personalization adjusts the replies of a tool you use and is not such a decision.
14. Privacy officer
Privacy officer — Jein Song (Representative) Contact — support@evot.io Send privacy questions, access requests, and complaints to this address.
15. Remedies
To seek a remedy for a privacy infringement you can apply for dispute resolution or advice at: Personal Information Dispute Mediation Committee — +82 1833-6972 (www.kopico.go.kr) Personal Information Infringement Report Center — 118 (privacy.kisa.or.kr) Supreme Prosecutors' Office — 1301 (www.spo.go.kr) Korean National Police Agency — 182 (ecrm.police.go.kr)
16. Changes to this policy
We post changes on this page with the date they take effect, shown below. For important changes that affect your rights we notify you in the app or by email 30 days before they take effect.
Business information
- Business name
- EVOTIO
- Representative
- JEIN SONG
- Business registration no.
- 365-26-02109
- Address
- 527 Ogeum-ro, Songpa-gu, Seoul, Republic of Korea
- support@evot.io
Effective 2026-10-12
← Back to home