Privacy Policy

EVRE (“EVRE”, “we”, “us”, or “our”) operates the EVRE platform — a B2B enterprise training simulation service that enables organisations to conduct AI-powered crisis and chaos scenario training for their personnel.

This Privacy Policy explains what personal data we collect when you use our platform, how we use it, with whom we share it, and what rights you have with respect to that data. It applies to all users of the EVRE platform, including administrators, trainers, and trainees.

We are committed to protecting your privacy in accordance with the European Union General Data Protection Regulation (GDPR), Turkey's Law on Protection of Personal Data (KVKK, Law No. 6698), and all other applicable data protection legislation.

If you have any questions about this policy or our data practices, please contact us at [email protected].

We collect the following categories of personal data when you register for and use the EVRE platform:

Account Data

When you create an account, we collect your full name, email address, organisation name, job title, and account preferences. For enterprise customers, this may also include your organisation's billing address and payment details (processed via our payment provider).

Simulation Data

During training sessions, we collect your text responses, AI character interaction logs, performance scores, decision histories, and any free-text feedback you submit. This data forms your training record.

Voice and Audio Data

When you use voice mode, your microphone audio is transmitted in real time to our speech-to-text (STT) processing pipeline. Please see Section 4 for full details on how audio data is handled.

Usage Data

We automatically collect information about how you interact with the platform, including features used, session frequency, click-paths, and time spent on different modules.

Technical Data

We collect your IP address, browser type and version, operating system, device identifiers, time zone, and referring URLs. This data is used to maintain platform security, diagnose errors, and improve performance.

We use the personal data we collect for the following purposes:

• Service Delivery: To create and manage your account, authenticate your identity, deliver simulation sessions, and provide customer support.
• Performance Tracking: To calculate scores, generate progress reports, and provide feedback to you and your organisation administrators.
• Security: To detect and prevent fraudulent activity, unauthorised access, and other misuse of the platform.
• Analytics and Improvement: To analyse aggregated usage patterns, improve the quality of AI character interactions, and develop new training scenarios.
• Legal Compliance: To fulfil our obligations under applicable laws, respond to lawful requests from public authorities, and enforce our terms of service.
• Marketing (opt-in only): With your explicit consent, to send you product updates, case studies, and promotional communications. You may withdraw consent at any time by clicking “unsubscribe” in any marketing email.

The voice mode feature of the EVRE platform uses ElevenLabs Scribe v2 Realtime speech-to-text (STT) technology to convert your spoken input into text during training sessions. The following data handling principles apply to voice and audio data:

• Real-time processing only: Audio data is streamed directly to the STT engine for transcription. Raw audio is processed in real time and is NOT stored on our servers or those of our sub-processors beyond the duration of the active WebSocket connection.
• Transcripts: The text transcript produced by the STT engine becomes the learner's message in the simulation transcript. That text, the AI response, scores, and session metadata may be retained to produce feedback, progress history, and authorized organization reporting. Raw audio is handled separately as described above.
• No biometric profiling: We do not create voice biometric profiles, voiceprints, or any other persistent identifier derived from your voice characteristics.
• User control: Voice mode is entirely optional. You may use the platform in text-only mode at any time without any reduction in functionality.

By enabling voice mode, you consent to the real-time transmission and processing of your audio as described above.

Simulation data generated during your training sessions is treated as follows:

• Training metrics only: Performance scores, decision trees, and outcome ratings are training evaluation metrics. They do not constitute official assessments, employment evaluations, or any legally binding appraisals of your competence.
• Fictional AI characters: AI character responses generated during simulations are entirely fictional and scenario-specific. They do not reflect the views, policies, or statements of EVRE or any third party.
• Progress tracking: Session data, including scores, turn-by-turn records, and achievement milestones, is used to build your training progress dashboard and provide longitudinal feedback to you and your organisation.
• Aggregate analytics: Anonymised and aggregated simulation data may be used to benchmark training outcomes across organisations, improve scenario quality, and develop new training modules.

We process personal data under the following lawful bases pursuant to GDPR Article 6:

KVKK (Law No. 6698) Legal Bases

For data subjects in Turkey, we also rely on the following legal bases under KVKK Articles 5 and 6:

We do not sell your personal data to third parties. We share data only with the following categories of recipients:

Categories of Recipients

• Cloud infrastructure providers for database hosting, authentication, and application deployment (EU and international servers)
• AI service providers for powering the simulation engine that drives training conversations (international servers)
• Voice processing providers for speech-to-text and text-to-speech conversion, only when voice mode is enabled by the user (provider location varies)
• Error monitoring providers for platform stability and error tracking (no personal data is transmitted)
• AI quality monitoring providers for service quality measurement using anonymized metadata (EU servers)

We also share data with your organisation administrators (who have contracted for access to the platform) and with competent authorities where required by law. All sub-processors are bound by data processing agreements (DPA) that require them to protect your data in accordance with applicable law.

7.1 Google Sign-In

Signing in with Google is optional. When you use it, EVRE requests only the openid, email and profile scopes, and receives your name, email address, profile picture and Google account identifier. That data is used solely to create and authenticate your EVRE account and to display who you are inside the platform. It is not sold, not used for advertising, and not used to train AI models.

EVRE does not request or receive access to your Gmail messages, Google Drive files, Google Calendar events, or any other Google service. You can revoke EVRE's access at any time from your Google Account permissions page; doing so ends Google Sign-In for your account but does not by itself delete your EVRE account (see Section 10).

Some of our sub-processors are located outside Turkey and the European Economic Area (EEA). Where we transfer personal data to countries that have not been deemed to provide an adequate level of data protection, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCC): We use the European Commission's approved Standard Contractual Clauses for transfers to processors in third countries, ensuring equivalent data protection obligations apply.
• KVKK Cross-Border Transfer Provisions: For transfers from Turkey under KVKK Article 9, we rely on the explicit consent of data subjects. Turkey's Personal Data Protection Board has not yet designated the United States as a country with adequate protection; accordingly, we also use data processing agreements and Standard Contractual Clauses (where applicable) with US-based processors. Your use of the Service constitutes your explicit consent to these transfers.
• Adequacy decisions: Where the European Commission has issued an adequacy decision for the recipient country, we rely on that decision as the transfer mechanism for EEA-originating data.

You may request a copy of the applicable transfer safeguards by contacting us at [email protected].

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and resolve disputes. The following retention periods apply:

When data is no longer required, it is securely deleted or anonymised such that it can no longer be linked to an individual.

Rights under GDPR

If you are located in the EEA or the United Kingdom, you have the following rights under the GDPR:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request that we correct inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data where there is no longer a legitimate reason for us to retain it.
• Right to restriction of processing: You may request that we restrict the processing of your data in certain circumstances.
• Right to data portability: You may request that we provide your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.

Rights under KVKK

If you are located in Turkey, you have the following rights under KVKK Article 11:

• To learn whether your personal data is being processed.
• To request information about the processing of your data.
• To learn the purpose of processing and whether data is used in accordance with this purpose.
• To know third parties to whom your data is transferred.
• To request correction of incomplete or incorrect data.
• To request deletion or destruction of your data.
• To request notification of correction/deletion to third parties.
• To object to outcomes resulting from automated processing.
• To claim compensation for damage arising from unlawful processing.

To exercise any of the above rights, please contact us at [email protected]. We will respond to all requests within 30 days. In some cases we may need to verify your identity before processing your request.

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security measures include:

• TLS 1.3 encryption: All data in transit between your browser and our servers is encrypted using TLS 1.3.
• Encrypted storage: Data at rest is encrypted using industry-standard AES-256 encryption.
• Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis. Role-based access controls are enforced across all systems.
• Regular security reviews: We conduct periodic security assessments and vulnerability scanning of our infrastructure.
• Incident response: We maintain a data breach response plan. In the event of a breach affecting your data, we will notify you and the competent supervisory authority within 72 hours where required by law.

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

We use cookies and similar tracking technologies on the EVRE platform. The following categories of cookies are used:

Essential Cookies (Always Active)

These cookies are strictly necessary for the platform to function. They cannot be disabled. They include:

• Authentication session cookie: Maintains your logged-in state across page loads. Set by Supabase auth. Expires at session end or after 7 days.
• Preference cookies: Store your language and theme preferences (dark/light mode). Expires after 12 months.

Optional Analytics Cookies (Consent Required)

With your consent, we use analytics cookies to understand how users interact with the platform. These cookies collect aggregated, anonymised data about page visits, feature usage, and session duration. You may accept or decline these cookies via the cookie consent banner displayed on your first visit. You may change your preference at any time via your account settings.

We do not use advertising or tracking cookies for behavioural profiling or cross-site tracking.

The EVRE platform is a B2B enterprise service intended solely for professional use by adults within business organisations. Our platform is not directed at or designed for use by individuals under the age of 18.

We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently collected personal data from a person under 18, we will take immediate steps to delete that data. If you have reason to believe that a minor has provided us with personal data, please contact us immediately at [email protected].

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. When we make material changes to this policy, we will notify you by:

• Sending an email notification to the address associated with your account; and/or
• Displaying a prominent in-app notice when you next log in to the platform.

The updated policy will be effective as of the date stated at the top of the page. Your continued use of the EVRE platform after the effective date of the revised policy constitutes your acceptance of the updated terms.

For non-material changes (such as typographical corrections or formatting updates), we will update the “Last updated” date without formal notice. We recommend that you review this policy periodically to stay informed of any updates.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our privacy team using the details below. We aim to respond to all enquiries within 30 days.