Privacy notice

This policy describes how Eaviora Inc. ("eAviora", "we", "our") handles personal data on our public marketing pages (this site) and in the eAviora platform (the product). It applies to visitors, prospects in evaluation conversations, and users of the platform.

We version this policy openly: the date above, and the version history, say what changed and when.

The data controller is Eaviora Inc., federally incorporated in Canada under the Canada Business Corporations Act, with its registered office in Quebec and headquartered in Montreal, Quebec, Canada. For any privacy question, data-subject request, or complaint, contact us at contact@eaviora.com.

We collect the minimum we need to run the site and respond to you:

• Form submissions. Name, work email, organisation, role, topic, and message you type into our contact form.
• Server logs. Standard HTTP access logs (IP, user agent, request path, timestamp) from our hosting provider (Vercel), used for security and abuse prevention.

Cookies. We use two categories, and only two. Strictly necessary cookies are set on every visit because the site cannot work without them. Analytics cookies are set only if you allow them, and they are off until you do.

• Strictly necessary. Your Supabase authentication session and its security tokens (sb-*), your chosen theme, and the record of your cookie choice itself (eav_consent, kept 6 months). No consent is required for these, and they cannot be switched off.
• Analytics, optional. Google Analytics 4 (_ga, _ga_*, kept up to 13 months) tells us which pages are useful. It runs only after you accept. We do not use it for advertising, remarketing, or profiling, and Google Consent Mode is set to deny advertising storage outright.

Analytics runs on this public website only, never inside the platform. The tag is loaded by the marketing layout alone, so it cannot execute on a signed-in page. That is a structural boundary, not a setting: no analytics request is made from the product, and no page address containing one of your records is ever sent to Google. Customer safety data stays inside the tenant boundary described in sections 04 and 06.

We use no advertising or social-media pixels, no session replay, and no cross-site tracking. Our product analytics (Vercel Analytics and Speed Insights) are cookieless: they store nothing on your device and read nothing back from it, which is why they are not a consent category.

Your choice, and changing it. The consent banner appears on your first visit and nothing optional loads before you answer. Refusing is one click and is exactly as easy as accepting. You can change or withdraw your choice at any time using the Cookie preferenceslink in the footer of any page. Withdrawing does not just stop future collection, it deletes the analytics cookies already on your device. We ask again after 6 months.

When your organisation uses the eAviora platform, the data you enter is your operational data:

• Account data. Name, email, role, and authentication metadata via Supabase Auth.
• Operational records. Occurrences, hazards, findings, actions, documents, training records, and every other record your team creates. These are yours, held under database-enforced tenant isolation.
• Audit log. Every change is recorded append-only in the same request that makes it, hash-chained and scoped to your tenant, so the trail is tamper-evident by construction.

Your operational data is stored in Canada (Montréal region), unless another region is agreed in writing. It is encrypted with AES-256 at rest, and all communications travel over HTTPS in transit.

The application runs in the United States, and several sub-processors process limited data outside Canada, AI processing through OpenRouter among them. Each is named on our sub-processor page, with its region. Those transfers are governed by Standard Contractual Clauses where required.

Safety data is protected to a higher standard than ordinary records. Every record carries one of five confidentiality levels, open to the organisation, module members only, named people only, confidential, or privileged, and access is governed by role allowlists plus explicit clearance grants. Those levels are enforced everywhere the data surfaces: the work queue, notifications, and AI reads all inherit the same confidentiality rules.

When a closed occurrence becomes a shared bulletin, the reporter is never exposed: tail numbers and dates are scrubbed automatically, the AI drafts without names, and a person approves the bulletin before it is published.

The platform uses AI, processed through OpenRouter, to draft classifications, analyses and bulletins. The AI suggests; people validate. No AI can move a record's workflow stage, and low-confidence output is queued for a person instead of being written.

We send only the data a given analysis needs, and AI reads inherit the same confidentiality rules. eAviora does not use your operational data to train or fine-tune any model, and operates no training pipeline. OpenRouter states in its own privacy policy that it does not use inputs or outputs for model training. We do not warrant the practices of the model provider it routes a request onward to; those are governed by that provider's own terms.

Row-level security is mandatory: a query that arrives without your organisation's context returns zero rows. Data is encrypted with AES-256 at rest and protected by HTTPS in transit.

Sign-in supports passkeys and one-time-code (TOTP) multi-factor authentication, and enterprise identity via SAML 2.0 single sign-on and SCIM 2.0 provisioning. Access to production infrastructure is limited to authorised engineers and logged. SOC 2 attestation is in preparation. See the security one-pager for details.

We rely on the following legal bases under the EU General Data Protection Regulation:

• Contract. Processing necessary to provide the platform to your organisation.
• Legitimate interest. Security logging, fraud prevention, and improving the service. Balanced against your rights.
• Consent. For any optional marketing email (opt-in only, we have none at present).
• Legal obligation. When a regulator with lawful authority compels disclosure.

Marketing-form submissions are kept for up to 24 months to respond to your inquiry and maintain conversation context. Operational records inside the platform are retained for the duration of your organisation's subscription plus any contractually-defined retention period. You can export and delete your data on request, see your rights and portability below.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccuracies.
• Request deletion (subject to legal obligations to retain).
• Object to processing on legitimate-interest grounds.
• Port your data to another provider.
• Lodge a complaint with your supervisory authority.

Portability is backed by a real export engine, not just a manual request: your team can run a self-service bulk export in JSON or CSV with signed download links, and a versioned REST API is available for ongoing data portability.

Write to contact@eaviora.com and we will respond within 30 days.

The providers that process data for us are listed on our sub-processor page, with each one's role, region and data-processing terms, and the date of every change to the list.

We update this policy as the product and our processing practices evolve. Material changes are announced by email to platform administrators and listed in the version history on this page. Continued use after the update constitutes acceptance.