Privacy Policy
Introduction
XPERT MEDIA OÜ (registry code 12852895, address Kirsi tn 8-90, 10616 Tallinn, Estonia), hereinafter "Evoluna", "we" or "platform", operates the website evoluna.app. This privacy policy explains how we collect, use, store, and protect your personal data in accordance with the European Union General Data Protection Regulation (GDPR) and Estonian data protection laws.
Platform Role
Evoluna is a marketplace platform that connects users with independent specialists (mentors, coaches, consultants). We are not the provider or employer of these services. Specialists are independently responsible for the content, quality, and any data processing that occurs within their services. Evoluna acts as a data controller for the data necessary for platform operations.
What Data We Collect
Account Data
- •Name
- •Email address
- •Profile picture (optional)
- •Password (encrypted)
- •Language preference
Authentication Data
- •Google OAuth data (if using Google login)
- •Apple Sign-In data (if using Apple login)
- •Session data and cookies
Service Usage Data
- •Booking history
- •Reviews and ratings
- •Favorites and preferences
- •Session reflections and notes
- •Development plans and achievements
- •Assessment results and dimension scores
- •Growth profile data (pillar summaries, health and growth state summaries)
- •Onboarding preferences (selected role, intent, deferral status)
- •Profile visibility preferences
- •AI match scores and explanations
- •Referral data (referrer, referee, status)
- •Custom profile URL (vanity URL)
- •Campaign and discount redemption data
- •Contact reveal history (time of reveal, user and specialist identifiers)
- •Message sending history (time of message, sender, recipient)
- •Event log (profile views, contact reveals, clicks, messages, bookings)
Subscription Data
- •Subscription tier (Basic/Standard/Premium)
- •Billing period and history
- •Subscription status and changes
- •Trial period data
- •Custom package data (content, price, status)
Payment Data
- •Transaction history (via Stripe)
- •Invoice data
- •Subscription recurring payment data
- •Custom package payment data
- •The platform does not store your bank card details – these are securely processed by Stripe
Technical Data
- •IP address
- •Browser type and version
- •Device information
- •Timezone (auto-detected)
- •Visit statistics (Google Analytics)
- •Terms acceptance metadata (version, timestamp, IP)
- •Session identifier (sessionId) for anonymous event logging
Special Categories of Personal Data (Article 9)
Evoluna never asks for or requires special-category personal data (e.g., health data, religious beliefs, sexual orientation). Our platform services are wellness- and development-focused and do not constitute medical or healthcare services.
Please do not share sensitive data in free-text fields (e.g., profile descriptions, reviews, messages, reflections) that is not necessary for the provision of the service. If you choose to share such data, you do so at your own responsibility.
Because the platform involves wellness and personal-development specialists, some information generated during service use (e.g., coaching notes, reflections, assessment results) may indirectly relate to health. In such cases, we rely on your explicit consent (GDPR Article 9(2)(a)) and apply additional security measures.
Legal Basis for Processing
We process your data on the following GDPR Article 6 grounds:
Contract Performance
To manage your account, service bookings, subscriptions, and custom packages.
Consent
For sending marketing communications, using analytics cookies, and managing profile visibility settings.
Legitimate Interest
To ensure platform security, prevent fraud, improve services, AI-based matching, recommendation generation, usage statistics collection (EventLog), contact information protection, and automated abuse detection (GDPR Art. 6(1)(f)).
Legal Obligation
To comply with accounting and tax laws.
Data Sharing with Third Parties
We share your data with the following trusted partners:
| Partner | Cel | Lokalizacja |
|---|---|---|
| Stripe | Payment processing and security | USA/EU |
| Authentication (OAuth) and analytics | USA/EU | |
| Apple | Authentication (Sign-In with Apple) | USA/EU |
| Cloudflare | Security and bot protection (Turnstile) | USA/EU |
| Abacus.AI | Platform hosting, infrastructure, and AI services (LLM API: match explanations, chatbot, AI generation of profile/content text and translation) | USA |
All third parties are required to comply with GDPR requirements, and we have data processing agreements in place with them.
International Data Transfers
Your personal data may be transferred to and processed outside the European Economic Area (EEA). We ensure that all international data transfers comply with GDPR Chapter V.
Legal basis for transfers
For transfers of data to third countries (including the USA), we use the following safeguards:
- European Commission Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46(2)(c)
- EU-US Data Privacy Framework (DPF), where the recipient is certified
- Supplementary technical and organisational safeguards (encryption, pseudonymisation)
Sub-processors outside the EEA
| Partner | Lokalizacja | Cel | Zabezpieczenie |
|---|---|---|---|
| Amazon Web Services (AWS) | USA | File hosting and cloud storage (S3) | SCCs + EU-US DPF |
| Stripe, Inc. | USA | Payment processing and billing | SCCs + EU-US DPF |
| Google LLC | USA | Authentication (OAuth), analytics (GA4) | SCCs + EU-US DPF |
| Apple Inc. | USA | Authentication (Sign-In with Apple) | SCCs + EU-US DPF |
| Cloudflare, Inc. | USA | CDN, security, and bot protection | SCCs + EU-US DPF |
| Abacus.AI, Inc. | USA | Platform hosting, AI services, and infrastructure | SCCs |
You have the right to obtain a copy of the relevant safeguards by contacting us at [email protected]
Data Retention
We retain personal data only for as long as necessary to fulfil the specific purpose, to comply with a legal obligation, or to pursue a legitimate interest. We periodically review retention periods and delete data whose retention is no longer justified.
The blocklist contains only the email address (no other personal data) and is necessary under GDPR Article 17(3)(e) — compliance with the data subject's erasure request. Without the list, it is impossible to ensure that a previously removed profile is not automatically re-imported.
Your Rights
Under GDPR, you have the following rights:
Right of Access
The right to obtain information about what data we process about you.
Right to Rectification
The right to request correction of inaccurate data.
Right to Erasure
The right to request deletion of your data ("right to be forgotten").
Right to Restrict Processing
The right to restrict processing of your data in certain situations.
Right to Data Portability
The right to receive your data in a structured, machine-readable format.
Right to Object
The right to object to processing based on legitimate interest.
Right to Withdraw Consent
The right to withdraw given consent at any time.
To exercise your rights, contact us at [email protected]
Data Security
We use the following measures to protect your data:
- SSL/TLS encryption for all data transfers
- Password hashing with bcrypt algorithm
- Regular security audits
- Limited data access (need-to-know basis)
- CAPTCHA protection (Cloudflare Turnstile)
Cookies
We use cookies for platform functionality and to improve user experience. For detailed information, please see our cookies policy.
Minors
The Evoluna platform is intended only for adult users (18+). We do not knowingly collect personal data from persons under 18. If we become aware that a person under 18 has created an account, we will delete that account and associated data.
Profile Visibility Settings
Evoluna allows you to control what data is displayed on your public profile.
Displaying assessment results on your profile is disabled by default. You can choose to show your assessment results on your public profile by enabling the corresponding option in your dashboard. Only the assessment name, profile type, and overall score are displayed publicly – detailed answers, dimension scores, and internal analyses are not shown.
You have full control over which assessment results are visible. You can change your visibility preferences at any time from your dashboard (Assessments section).
If you enable assessment results to be displayed on your public profile, the platform will share this information with anyone who views your profile. We recommend carefully considering what information you wish to share publicly.
Profile visibility settings are based on GDPR Article 6(1)(a) (consent). Withdrawal of consent (disabling visibility) immediately removes the data from your public profile.
Automated Decision-Making and Profiling
In accordance with GDPR Article 22, we inform you about automated decision-making and profiling.
Evoluna uses an AI-based matching system that analyzes your assessment results and specialist profile data to generate personalized recommendations. This constitutes profiling within the meaning of GDPR.
AI matching is NOT fully automated decision-making: AI provides recommendations and explanations, but the final choice is always made by the user. AI recommendations do not have legal or similarly significant effects.
You have the right to:
•Request human intervention in reviewing AI recommendations
•Challenge AI recommendations
•Opt out of AI-based matching by contacting us at [email protected]
•Obtain information about the logic of AI matching
Data used for AI matching: assessment dimension scores, goals, preferences, and specialist competency profiles. AI-generated explanations are stored and used solely for displaying recommendations to you.
AI-Generated Specialist Profiles
Evoluna uses artificial intelligence to enrich specialist profile data, including generating semantic summaries, GEO-optimized descriptions, and LSI keywords.
AI profile data categories:
Semantic summaries in Estonian and English (semanticSummaryEt/En)
GEO-optimized description (geoExecutiveSummary)
LSI keywords (lsiKeywords) — for categorizing services and competencies
Structured data (aiSchemaData) — in schema.org format
Generation timestamp and model used
Legal basis: GDPR Article 6(1)(f) — legitimate interest (improving platform quality and specialist discoverability). Specialists have the right to review, correct, or request deletion of their AI-generated profile data at any time.
Retention: AI profile data is periodically updated and deleted when the specialist's account is closed.
Crisis Detection
Evoluna uses an automated crisis detection system that analyses user activity on the platform to identify potential crisis signals and display crisis support contacts.
Crisis detection data processing:
Assessment result scores and chatbot messages are analysed in real-time
When a crisis signal is detected, crisis support contacts are immediately displayed to the user
Separate data about detected crisis signals is NOT stored
Crisis detection operates only on the user's device (client-side) and does not send other notifications
Legal basis: GDPR Article 6(1)(f) — legitimate interest in ensuring user safety.
Crisis detection does not replace professional crisis intervention. In an emergency, call 112.
Growth Profile and Assessment Data
Evoluna creates an automatic growth profile based on users' assessment results.
Growth profile data categories:
Assessment results across five pillars: Body, Mind, Spirit, Health, Growth
Dimension scores and profile levels
AI-generated pillar summaries (healthStateSummary, growthStateSummary, etc.)
Profile overviews (patterns, strengths, development areas)
AI matching context (user profile for specialist matching)
Legal basis: GDPR Article 6(1)(b) — contract performance (providing assessment services); Article 6(1)(f) — legitimate interest (improving AI matching quality).
Retention: growth profile data is retained until account deletion. Users can request data export or deletion at any time.
Marketing Communications
We may send you marketing communications and newsletters about Evoluna services, offers, and updates.
We ask for your explicit consent to send marketing communications during registration. Consent is not required to create an account – you can use the platform without receiving marketing emails.
You have the right to opt out of marketing communications at any time by changing settings on your profile page (Security tab) or by contacting us.
We do not send marketing communications more frequently than once a month and we respect your privacy.
All marketing communications are sent on the basis of GDPR Article 6(1)(a) (consent). Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Data from Public Professional Directories
Evoluna may import specialist data from public professional directories and registries (e.g., Estonian Association of Supervision and Coaching, Estonian Psychologists' Association, kutsekoda.ee, etc.) to create so-called "unclaimed profiles" on the platform.
Legal basis: GDPR Article 6(1)(f) – the controller's legitimate interest in providing users with a comprehensive overview of available specialists. The data source is always public and verifiable. The full Legitimate Interest Assessment (LIA) is available at evoluna.app/legal/lia.
Evoluna uses artificial intelligence (AI) technology to analyze, systematize, and enrich imported data – for example, extracting skills and competencies from bios. The AI-based analysis and resulting profile structure are Evoluna's intellectual property.
Imported data: name, specialty/field, qualifications, contact information (if publicly available), source URL.
Unclaimed profiles are clearly marked and include information about the data source. Bookings are not possible through unclaimed profiles.
Your rights as an unclaimed profile subject:
Claim the profile – you can claim and manage the profile via the secure link (magic link)
Self-service removal – you can instantly and independently remove your profile via the secure link, without needing to submit a separate request
Data rectification – you can request correction of inaccurate data
Data erasure – you can request complete removal of your data from the platform
Object to processing – you can object to the processing of your data
Self-service removal is performed via a secure link (valid for 180 days). After removal: the profile and all associated data are deleted immediately; the email address is added to a blocklist preventing automatic re-import; an audit trail (PrivacyRequest record) is created; a confirmation email is sent.
Blocklist: after removal, the data subject's email address (and only the email) is retained in the blocklist indefinitely to prevent repeated data import. The listed address is not used for any other purpose. The data subject can request removal of their address from the blocklist if they wish to rejoin the platform in the future.
To exercise your rights: use the secure link in the notification email, visit our privacy request page at evoluna.app/privacy-request, or contact us at [email protected].
In accordance with GDPR Article 14, we notify individuals whose data has been imported via email within 14 days after the data has been added to the platform. The notification includes all information required by GDPR Art. 14(1) and 14(2).
Unclaimed profiles remain on the platform in unclaimed form until the profile is claimed or the data subject exercises their right of removal. Evoluna periodically reviews the data quality and relevance of unclaimed profiles.
Article Publishing
Evoluna allows specialists to publish articles (blog posts, guides, opinion pieces) on the platform, and readers to engage with them through comments and reactions.
Categories of personal data related to articles:
- •Author data: publicly displayed name, profile picture, biography, link to specialist profile
- •Article content: title, body, meta description, cover image, tags, categories, language versions
- •Publishing data: publication date, last modified time, publishing status (draft/published/archived)
- •Usage statistics: article view count (anonymous counter), reaction counts (gratitude/insight/resonance)
- •Comments: comment body, commenter name/avatar, timestamp, replies (1 level)
- •Reactions: user ID, reaction type (GRATITUDE/INSIGHT/RESONANCE), timestamp
Processing purposes:
- •Publishing and displaying articles on the public platform
- •Improving reader experience (relevant articles, search, category filters)
- •Increasing specialist visibility and authority
- •Enabling user engagement (comments, reactions)
- •Enriching the AI chatbot knowledge base (it searches published articles for relevant content)
- •Article analytics dashboards for specialists (views, reactions, comments)
Legal basis: GDPR Article 6(1)(b) – performance of contract (providing publishing service to specialist); Article 6(1)(a) – consent (storing and displaying reader comments and reactions); Article 6(1)(f) – legitimate interest (counting views, AI chatbot recommendations, platform quality control).
Copyright and intellectual property: the specialist retains copyright to their articles. By publishing on the platform, the specialist grants Evoluna a free, non-exclusive, worldwide license to display, distribute, index (including in search engines), and reference the content in short excerpts within AI chatbot recommendations for as long as the article is published on the platform. The license terminates upon article archival or deletion.
Moderation: Evoluna reserves the right to moderate or remove content that violates the Terms of Service (hate speech, misleading medical information, personal data leaks, etc.). AI-based moderation is optional (administrator-configurable) and does not make final decisions – a human reviews all flagged articles.
Retention: published articles remain on the platform until the specialist archives or deletes them. Archived articles are retained for 90 days and then permanently deleted. Comments are retained as long as the article is published or until the commenter deletes them. Reactions are automatically deleted when the article is deleted.
Your rights regarding articles:
- •Specialist: right to edit, archive, or delete your articles at any time via the dashboard
- •Reader: right to edit or delete your comments (soft delete – text is hidden)
- •Reader: right to remove your reaction by clicking again
- •Data subject: right to request deletion of all article-related data ([email protected])
Organization Data
Evoluna allows companies and organizations to create B2B accounts (organization accounts) that bring specialists together under a shared brand.
Categories of personal data related to organizations:
- •Organization data: name, slug (URL name), description, logo, website
- •Membership data: member role (owner/member), visibility setting (isPublic), joining date
- •Invitation data: invitee email address, invitation status, validity period, sender
- •Billing data: Stripe customer ID, subscription data, tier info (FREE/BUSINESS/ENTERPRISE)
- •AI service usage data: request type (team profile, matching, summary), usage time
Processing purposes:
- •Organization account management and team consolidation
- •Displaying the public organization page (only members marked as public)
- •Sending and managing invitations
- •Managing B2B billing via Stripe
- •Providing AI-powered team services according to tier
Legal basis: GDPR Article 6(1)(b) – performance of contract (providing organization services); Article 6(1)(f) – legitimate interest (displaying public page, AI services).
Data retention: organization data is retained as long as the organization is active. Upon deletion, all organization-related data is removed, except billing data (7 years per accounting law). Invitation data is deleted 90 days after expiration or rejection.
Visibility control: each organization member decides whether their profile is visible on the organization's public page. The owner cannot force-change a member's visibility.
Third parties: organization billing data is shared with Stripe for payment processing purposes. AI service data is processed within Evoluna's AI systems without sharing with third parties.
Changes to Privacy Policy
We may update this privacy policy from time to time. For significant changes, we will notify you via email and/or through the platform. We recommend checking this page regularly.
Contact
For questions regarding your personal data, contact:
You also have the right to file a complaint with the Data Protection Inspectorate (www.aki.ee) if you believe your rights have been violated.