Privacy Policy

Effective date: September 1, 2026

Last updated: September 27, 2026

Applies to AI Customer Engine pages and services offered by Evoward through evoward.com, grow.evoward.com, and related checkout, intake, scheduling, review, and service pages.

1. Who we are and what this Policy covers

AI Customer Engine is a service offered by Evoward. This Privacy Policy explains how Evoward collects, uses, discloses, retains, and protects personal information when you visit an AI Customer Engine page, contact us, schedule a call, purchase the service, complete onboarding, receive support, or use the service for your business.

"Customer" means the business that purchases or uses AI Customer Engine. "End Customer" means a caller, lead, customer, or other person who communicates with a Customer through the service.

This Policy applies specifically to AI Customer Engine. Other Evoward offers may have separate notices. Third-party websites and services have their own privacy policies.

2. Our role

Evoward generally acts as the controller or business for information about visitors, prospects, purchasers, account contacts, and people who communicate directly with us. We decide why and how that information is used for sales, contracting, payment, onboarding, service administration, support, security, and our own business operations.

When Evoward processes End Customer information through a Customer's configured AI Customer Engine, the Customer generally determines the purpose and instructions. In that context, the Customer is the controller or business, and Evoward acts as its processor or service provider. End Customers should normally direct privacy requests to the business they contacted. We will assist the Customer as reasonably required.

3. Information we collect

We may collect the following categories of information.

• Visit and acquisition information: page route, landing-page version, referral domain, campaign parameters, advertising click identifiers, device or browser information, approximate location derived by infrastructure providers, IP address in security or delivery logs, and a random first-party session identifier.
• Page and interaction measurements: pages visited, visible and engaged time, scroll positions, section exposure and dwell, button exposure, pointer hover and keyboard focus duration, clicks, questions expanded, video playback and distinct content coverage, form progress counts, and safe error categories. These observations do not establish that you read content or intended to purchase. Behavioral form events contain progress counts, not the values you enter.
• Advertising identification and measurement: on our public sales pages, Whop's pixel collects page URLs and referrers, cookies, browser and device identifiers, IP address, browser characteristics used for device fingerprinting, and advertising campaign identifiers. Unless advertising tracking is disabled, it can collect the valid first name, last name, and email you enter or change in the sales form before you press Continue. This is identification for advertising measurement, not a submitted inquiry or permission for an abandoned-checkout email.
• Contact and pre-purchase information: name, email address, business information, the time you submitted the contact step, whether you accepted the displayed communication disclosure, and whether you opened the payment step. If you submit contact details and open the payment step without purchasing, we may send one message asking whether you have questions about fit or setup.
• Purchase and subscription information: product, price, currency, checkout and transaction references, payment status, membership or subscription status, renewal, cancellation, refund, billing-event timestamps, and limited purchaser identity returned by the payment provider. Whop and its payment partners process full payment-card details; Evoward does not receive your full card number.
• Onboarding and service information: contact and business name, email, phone number, services, service area, business hours, website, current business phone, calendar preference, appointment availability, call-transfer rules, approvals, lifecycle status, operator notes, support history, and files or business assets you choose to upload.
• Scheduling information: attendee name, email, time zone, event type, appointment time, booking status, meeting link, and attendance or no-show status from Cal.com.
• Communication information: messages you send us, support requests, and limited delivery outcomes such as delivered, bounced, complained, or replied. The journey system does not use email opens or clicks as customer analytics and does not copy the contents of an email reply into PostHog.
• End Customer information: depending on the Customer's approved configuration, the service may process caller or message sender contact details, call audio, recordings or transcripts, service needs, job details, location or service address, appointment information, message history, review-request status, and reviews. Customers decide which functions to enable and are responsible for required notices and consent.
• Service and value events: timestamps and status showing that an inbound call was handled, an estimate request was captured, an appointment was booked, or a review was received. Our analytics receives only pseudonymous event data, not the End Customer's identity, communication, recording, transcript, or provider identifier.
• Security and operational information: authentication and session records, signed-link state, webhook receipts, error categories, suppression status, change timestamps, and other limited technical records needed to protect, operate, and troubleshoot the service.

Please do not send protected health information, full payment-card data, government identification numbers, account passwords, or other highly sensitive information unless we have expressly agreed in writing to the required handling.

4. How we collect information

We collect information directly from you when you visit, enter or submit form details, purchase, upload a file, schedule, approve a configuration, contact us, or use the service. Our own sales-form draft saving is separate from Whop's automatic identification. Saving a draft or identification alone does not submit your contact step or qualify you for our abandoned-checkout message. That message requires submitted details and an actually opened payment checkout. We also receive information from Customers that configure the service, from End Customers who interact with that configuration, and from connected providers such as payment, scheduling, email, telephone, messaging, calendar, review, and authentication services.

We may derive limited information, such as lifecycle status, conversion events, campaign attribution, delivery status, or whether an action is a duplicate, from the records described above.

5. How we use information

We use personal information to:

• answer questions about AI Customer Engine and determine whether it fits a business;
• create and secure a purchase session, process payment, and administer subscriptions, cancellations, and refunds;
• collect onboarding information, configure the service, conduct the walkthrough and approval process, and provide ongoing support;
• operate calls, messages, scheduling, follow-up, review requests, the conversion website, and connected business workflows selected by the Customer;
• deliver transactional email and appointment reminders and suppress contact after a bounce, complaint, opt-out, or do-not-contact instruction;
• monitor service operation, investigate errors, prevent fraud or abuse, protect accounts, and enforce our agreements;
• measure the customer journey, campaign performance, fulfillment progress, service value, and retention using restricted pseudonymous analytics;
• measure and attribute advertising through Whop and Meta, including matching sales-page visits, entered identity, submitted leads, booked sales calls, and Whop checkout or payment activity, subject to the advertising choices below;
• maintain accounting, tax, dispute, legal, and compliance records; and
• comply with law and respond to lawful requests.

We do not use End Customer call content, transcripts, recordings, messages, or identity for our own cross-customer advertising audiences. We do not use PostHog to create person profiles from AICE journey events.

6. Legal bases

Where applicable law requires a legal basis, we process information as needed to take steps at your request, perform a contract, operate and secure the service, pursue legitimate business interests that do not override your rights, comply with legal obligations, and obtain consent where consent is required. You may withdraw consent for future processing when consent is the basis, but this does not affect processing already completed or processing supported by another lawful basis.

7. Cookies, advertising, and analytics

AICE sales and customer pages use a first-party secure HttpOnly session cookie to keep a visitor's checkout, payment, intake, signed email link, and journey state connected. The cookie uses SameSite=Lax, is not readable by page scripts, and normally expires after 30 days. It is used for essential continuity and security rather than cross-site advertising.

Our current AICE analytics implementation sends a restricted list of pseudonymous journey events to PostHog from Evoward's server-side infrastructure. It does not install the PostHog browser library, enable autocapture, session replay, feature flags, person profiles, or PostHog's automatic geolocation lookup. Names, email addresses, phone numbers, form answers, uploaded files, call or message content, internal customer records, payment references, calendar identifiers, meeting links, raw URLs, and query strings are excluded from PostHog. PostHog receives a one-way pseudonymous identifier and allowlisted event properties.

Cloudflare provides approximate country, region, and city information from the network connection. We include available location information in our journey analytics and private Discord notifications. This is a network location estimate, not a precise device location or proof of residence. We do not store raw IP addresses in our journey event history or send them to PostHog or Discord.

We use private Discord channels for internal activity notifications and journey summaries so we can respond to requests and operational problems. Notifications may include your name and email when available from an accepted contact submission, authorized customer record, or verified booking. They exclude form answers, payment details, and private access links. Our journey measurements do not record mouse coordinates or use device fingerprinting. The separate Whop advertising practices described below remain distinct.

Whop advertising measurement is separate from PostHog and is not anonymous or server-only. On the public sales pages at grow.evoward.com/ and grow.evoward.com/book-more-jobs, Whop's browser pixel uses cookies, local browser storage, device identifiers, and fingerprinting to connect visits and identity to advertising and checkout activity. Its automatic form identification is limited to the current sales form's first name, last name, and email. We also send a submitted-lead event after accepted contact submission and a sales-call event after a verified, linked pre-purchase booking. These server events may include email, Whop's browser identifier, original visitor IP address and user agent, and approved campaign and Meta identifiers. We do not put this advertising data into PostHog.

Our pixel does not load on private intake, thank-you, customer walkthrough, or privacy pages. Unsafe sales URLs or referrers, previews, and designated synthetic visits are excluded. Whop operates its embedded and hosted checkout separately and reports its own checkout and payment events.

For our U.S.-targeted launch, advertising tracking is on by default unless you opt out or signal Global Privacy Control (GPC). Use Your Privacy Choices in the sales-page footer, sales form, or this policy to turn it off. We save your choice in a secure, host-only cookie for one year and update the current session's associated purchase attempts so later linked booking events respect withdrawal. GPC takes precedence over an enabled preference. Essential session cookies, operational draft saving, and restricted PostHog analytics are separate and continue. Re-enabling does not resend past conversions.

Advertising click identifiers may be retained in Evoward's operational records for attribution, but they are not copied into PostHog. Third-party pages such as Whop and Cal.com may use their own cookies under their policies. Our choice control does not govern all processing by Whop's independently operated checkout or Meta. Information already sent, including in-flight events, cannot be recalled by switching off future tracking. A different browser, cleared cookies, or another device may require a separate choice; GPC can communicate it automatically. If saving your preference fails, the interface explains the limitation and provides a retry option.

8. When we disclose information

We disclose information only as reasonably needed for the purposes in this Policy, including to:

• Cloudflare for page delivery, security, server-side processing, database storage, and private file storage;
• Whop and its payment partners for checkout, payment, fraud prevention, subscription administration, cancellation, and refunds; Whop also receives the advertising identification and conversion information described above;
• Meta, through Whop's advertising integrations, for advertising measurement, identity matching, attribution, and advertising delivery or optimization;
• Cal.com when you choose to schedule a pre-purchase call or customer walkthrough;
• Sequenzy and connected email delivery services for transactional messages, reminders, replies, and delivery outcomes;
• Airtable for the named internal operator view used to administer prospects, onboarding, fulfillment, support, subscription state, and uploaded business assets;
• PostHog for the restricted pseudonymous analytics described above;
• Discord for private internal activity notifications, journey summaries, and operational alerts, including accepted contact identity when available;
• telephone, messaging, calendar, artificial-intelligence, review, website, and other service providers selected or connected for a Customer's approved configuration;
• professional advisers, auditors, insurers, banks, tax authorities, courts, regulators, and law enforcement when reasonably necessary or legally required; and
• a buyer or successor in a merger, financing, reorganization, or transfer of the relevant business, subject to appropriate confidentiality and legal requirements.

We do not exchange personal information for money. Sharing identifiers, entered name and email, and conversion activity with advertising partners may be considered a "sale," "sharing," or processing for targeted advertising under applicable U.S. privacy laws. You can opt out of our advertising sharing as described in Sections 7 and 14. Service providers process information subject to their contracts and applicable law; advertising partners may also process information under their own privacy notices. We do not share End Customer call content, recordings, transcripts, messages, or identity for our advertising.

9. Artificial intelligence calls and messages

A Customer may configure AI Customer Engine to use artificial intelligence to answer inbound calls, respond to questions, collect job details, offer approved appointment times, transfer a call, or prepare approved follow-up. Automated responses may be generated from information and instructions supplied by the Customer.

If recording or transcription is enabled, the Customer is responsible for giving notices and obtaining consent required by the jurisdictions involved. If text messages, emails, or review requests are enabled, the Customer is responsible for lawful recipient selection, consent, content, and opt-out handling. Evoward processes that information to provide the configured service and does not make decisions that produce legal or similarly significant effects about End Customers on its own behalf.

10. Customer instructions and End Customer rights

Customers must provide an accurate privacy notice for their own callers and customers and must tell us about restrictions that apply to their data. A Customer must not instruct us to collect or use information unlawfully.

If you are an End Customer, contact the business you called, messaged, booked with, or reviewed to exercise privacy rights related to that interaction. If we receive your request directly and process the information only for that Customer, we may refer the request to the Customer and assist with its response.

11. International processing

Evoward and its providers may process information in the United States and other countries where they operate. Privacy laws in those locations may differ from the law where you live. When required, we use contractual, technical, or organizational safeguards intended to protect information transferred across borders.

12. Retention

The browser temporarily queues journey observations for up to 24 hours to recover from connection failures. Our journey event and delivery history normally expires after 90 days. Unresolved delivery failures remain available for investigation and replay until resolved. Existing customer record, PostHog, and provider retention settings continue to apply.

The essential AICE session cookie normally expires after 30 days. Contact drafts that were not submitted and did not result in payment are scheduled for deletion or de-identification after 30 days of inactivity, including removal from the operator view. Provider backups or security logs may take longer to expire.

We retain submitted inquiries, transaction records, subscription state, onboarding information, Customer content, communications, approvals, service records, and End Customer data only as long as reasonably needed to provide and support the service, maintain business and tax records, resolve disputes, enforce agreements, protect security, and comply with law. Retention differs by record type, Customer instructions, provider capability, and legal requirement. When information is no longer needed, we delete, de-identify, or securely isolate it as appropriate.

If a Customer needs a specific deletion or return schedule for End Customer data, it should be agreed in writing before the relevant data is submitted. Cancellation does not require us to delete records that we must retain for billing, tax, fraud prevention, dispute, security, or legal purposes.

13. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the information and service. These include restricted access, encrypted transport, secure session cookies, signed links and webhooks, private file storage, provider authentication, and separation of named operational data from pseudonymous analytics.

No system is completely secure. You are responsible for protecting connected accounts, credentials, devices, telephone and calendar accounts, and access granted to your staff. Notify us promptly at support@evoward.com if you suspect unauthorized use or disclosure involving AI Customer Engine.

14. Your choices and rights

Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent where processing relies on consent. These rights may be limited by legal exceptions, another person's rights, or records we must keep.

You can opt out of Evoward follow-up by replying to a message or contacting us. Transactional, billing, security, and service messages may still be sent while needed to administer an active purchase or account. You can control third-party communications through the relevant provider and browser settings.

To opt out of our advertising sharing and targeted-advertising processing, use Your Privacy Choices or enable GPC in a supporting browser. This choice stops future automatic sales-form identification, pixel page reporting, advertising link and iframe hooks, and our server-side advertising conversions associated with that browser's session. It does not cancel a purchase, erase saved progress, unsubscribe you from service messages, or control all of Whop's or Meta's independent processing. You do not need to enter an email address to use the browser choice. Contact us if you need assistance or wish to exercise rights over information already collected.

To make a privacy request concerning information Evoward controls, email support@evoward.com. We may need to verify your identity and authority before acting. We will not discriminate against you for exercising an applicable privacy right.

15. United States privacy disclosures

For residents of U.S. states with applicable privacy laws, the categories collected, sources, purposes, and recipients are described in Sections 3 through 8. Advertising-related disclosures of identifiers, contact details, internet activity, and conversion information to Whop and Meta may qualify as sale, sharing for cross-context behavioral advertising, or targeted advertising. The opt-out and GPC controls described above apply to our advertising processing. We do not use or disclose sensitive personal information to infer characteristics about a person.

You may submit an applicable access, correction, deletion, portability, or appeal request to support@evoward.com. Authorized agents must provide reasonable proof of authority. Because AICE is primarily a business service and because some information is processed for a Customer, certain records or requests may be outside the scope of a state law or must be handled by that Customer.

16. Children

AI Customer Engine is a business service and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13 for our own purposes. If you believe a child has provided information to Evoward, contact us so we can review it. Customers must not configure the service to target children without first agreeing with us in writing on the required safeguards.

17. Third party services and links

AICE pages may link to or embed services operated by other companies. Their collection and use of information are governed by their own privacy policies. This Policy does not control a Customer's independent practices or information a Customer handles outside AI Customer Engine.

18. Changes and contact

We may update this Policy as the service, providers, or law changes. We will post the updated version and effective date. If a change materially affects how we use information already collected, we will provide additional notice when required.

Questions and privacy requests may be sent to support@evoward.com.