Privacy Policy
Effective date: June 1, 2026
1. Who We Are
Evrai Software Systems Inc. ("Evrai," "we," "our," or "us") operates the website at https://evrai.app and the Evrai dashboard application at dashboard.evrai.app (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Service.
Questions? Contact us at [email protected].
2. Information We Collect
a. Information you provide directly
- Account data: Email address and password (hashed) when you register.
- Betting records: Game identifiers, odds, stake amounts, results, and notes you enter manually or import via API.
- Payment data: Billing details for Pro subscriptions are handled by our third-party payment processor (Stripe). We do not store full card numbers.
- Communications: Any messages you send to our support team.
b. Information collected automatically
- Log data: IP address, browser type, pages visited, timestamps, and referring URLs.
- Usage data: Feature interactions, query patterns, and performance metrics collected to improve the Service.
- Cookies and local storage: We use two categories of cookies and local storage: (i) strictly necessary — session and authentication tokens required to keep you signed in; and (ii) preferences — UI state such as theme and table layout. We do not set third-party advertising, tracking, or cross-site analytics cookies. We honor Global Privacy Control (GPC) and Do Not Track browser signals. You can disable cookies in your browser, but authenticated features will not work without strictly-necessary cookies.
c. Third-party API data
When you connect Kalshi or Polymarket, we receive trade history and account position data from those platforms and store the credentials needed to maintain the connection:
- Kalshi: RSA API key pair, stored encrypted at rest (AES-256). Used only to read your trade history and balance and — on the Sharp plan — to place orders you explicitly authorize from within Evrai.
- Polymarket: Wallet address and EIP-712 signatures used to authenticate read and (where enabled) execution requests. Polymarket activity tied to your wallet address is recorded on the Polygon blockchain and is inherently public; that on-chain visibility is outside Evrai's control.
You can revoke a platform integration at any time from Settings → Integrations in the dashboard. Revoking deletes the stored credentials; previously synced trade records remain in your Evrai account until you delete them or close the account.
3. How We Use Your Information
- Provide, operate, and improve the Service
- Calculate performance metrics, CLV, and Kelly-optimized recommendations
- Process payments and manage your subscription
- Send transactional emails (account confirmation, password reset, billing receipts)
- Send product update and marketing emails only to users who have opted in (opt-in is required for EEA/UK residents and offered globally). Every marketing email includes a one-click unsubscribe link.
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal obligations
We do not sell your personal data to third parties. We do not use your betting records or trading data to train AI models that are shared externally.
4. AI Features
The Props Analyzer and Golf Analyzer (priced in AI credits) send analysis requests to Anthropic (Claude API), our AI sub-processor.
- Zero training: Requests are processed under Anthropic's API terms, which prohibit using customer inputs or outputs to train Anthropic models.
- Minimum necessary data: We send only the game, prop, or course context required for the analysis. We do not transmit your email address, API keys, wallet address, or account-level P&L to the AI provider.
- Short-term logging: Prompt and response metadata is retained by Evrai for up to 30 days for abuse prevention, debugging, and quality review, then deleted.
5. How We Share Your Information
We share data only in the following limited circumstances:
- Service providers: Third-party vendors who help operate the Service: Supabase (database and authentication hosting), Stripe (payment processing), Cloudflare (CDN and edge delivery), and Anthropic (Claude API for AI analyzers). These providers are contractually required to use your data only as directed by us. We have not engaged a third-party transactional email provider or external error-monitoring service at this time; if we do, we will update this policy and notify registered users before processing begins.
- Legal requirements: When required by law, court order, or to protect the rights, property, or safety of Evrai, our users, or the public.
- Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.
6. Data Retention
We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., billing records retained for 7 years per tax regulations).
You can delete your account at any time from Settings → Account in the dashboard, or by emailing [email protected].
7. Where We Store Your Data
Your primary account data is stored on Supabase infrastructure in the United States. Static assets and request routing are delivered through Cloudflare's global edge network. AI analyzer requests are processed by Anthropic in the United States.
If you access the Service from outside the United States, including from the EEA, United Kingdom, or Switzerland, you understand that your information will be transferred to and processed in the United States. For transfers of personal data from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) with our sub-processors.
8. Security
We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest for sensitive fields, and access controls limiting data access to authorized personnel. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security, but we commit to notifying affected users of any data breach within 72 hours of discovery.
9. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate data.
- Deletion: Request deletion of your account and associated data.
- Portability: Request your betting records in a machine-readable format. A self-serve CSV export of your full betting and trade history is available in-app at any time.
- Opt-out: Unsubscribe from marketing emails via the link in any email we send.
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
10. EEA / UK Residents (GDPR)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, the EU General Data Protection Regulation (or the UK GDPR) applies to our processing of your personal data. Evrai is the data controller for the personal data described in this policy.
Lawful bases for processing:
- Performance of a contract: Providing the Service, processing payments, and delivering account features you request.
- Legitimate interests: Securing the Service, preventing fraud and abuse, and improving product quality, balanced against your rights and expectations.
- Consent: Marketing emails and any non-essential cookies (if introduced in the future). You may withdraw consent at any time without affecting prior lawful processing.
- Legal obligation: Tax, accounting, and other statutory record-keeping.
Your rights: In addition to the rights listed in section 9, you have the right to restrict or object to processing, to withdraw consent, and to lodge a complaint with your local data protection supervisory authority (for example, the Irish Data Protection Commission or the UK Information Commissioner's Office). For international transfers of your personal data out of the EEA/UK to the United States, we rely on Standard Contractual Clauses (and the UK Addendum where applicable) — see section 7.
11. California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to non-discrimination for exercising your privacy rights. We do not sell personal information as defined under the CCPA.
12. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will delete it promptly.
13. Third-Party Links
The Service may contain links to third-party platforms (Kalshi, Polymarket). We are not responsible for the privacy practices of those platforms. Review their respective privacy policies before connecting your accounts.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and send an email notification to registered users at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
15. Contact
Evrai Software Systems Inc.
Privacy inquiries: [email protected]