Privacy Policy

Evicta is an AI-powered data extraction engine that enables customers to migrate their data from third-party SaaS vendors. During the extraction process, Evicta processes source data on behalf of the Customer. This Privacy Policy describes what data we process, how we process it, and what we retain after the extraction is complete.

Zero-Staging Guarantee: Evicta does not utilize staging databases. Source data is processed as a memory-resident stream. No customer payload is written to disk on Evicta infrastructure during the extraction process.

Extracted archives are stored in an encrypted, non-indexed object store for the duration of the Migration Window (default 30 days) and are subsequently purged via automated lifecycle policies. This is the only point at which customer data touches persistent storage.

We retain configuration metadata (field names, mapping logic, job status) to ensure idempotency and support. We do not retain the contents of your support tickets within our configuration metadata databases.

Metadata is stored in an encrypted metadata layer and is used exclusively for:

• Ensuring extraction runs are idempotent and resumable
• Providing technical support for failed or incomplete runs
• Generating schema mapping recommendations

All data is encrypted in transit using TLS 1.3 with certificate pinning. Connection credentials are encrypted at rest using AES-256-GCM before entering our metadata layer. Decryption occurs exclusively within the isolated execution context of an active extraction.

Extraction runtimes are ephemeral. Once the stream closes, the transient execution context is destroyed. No customer data remains in memory after the runtime terminates.

Customers have the right to:

• Access — Request a copy of all configuration metadata associated with their account
• Deletion — Request immediate deletion of all archives, metadata, and account data
• Export — Download all retained metadata in a machine-readable format
• Complaint — The right to lodge a complaint with a supervisory data protection authority (e.g., the Swedish Authority for Privacy Protection, IMY)

To exercise these rights, contact support@evicta.dev. Requests are processed within fourteen (14) calendar days.

Evicta uses minimal, first-party analytics to understand platform performance and reliability. We do not use third-party tracking cookies or advertising networks beyond the subprocessors listed in our Subprocessor List.

No personally identifiable information is collected through analytics. Analytics data is aggregated and anonymized at the point of collection.

For privacy-related inquiries, data access requests, or to report a privacy concern, contact our Data Protection team: