Privacy Policy

1. Introduction

Vistry, Inc., a Delaware C-Corporation ("Vistry," "we," "our," or "us"), with a principal place of business at 13816 Torrey Del Mar Drive, San Diego, CA 92130, operates the Eva platform, including Eva Insights, Eva People, and Eva HR Lab (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered HR intelligence platform. We are committed to transparency regarding our data practices, particularly concerning the use of artificial intelligence in our services.

2. Information We Collect

2.1 Information You Provide Directly

• Account information (name, email, organization)
• HR documentation and knowledge base content
• Employee directory information
• Conversation logs and queries
• Feedback and support communications

2.2 Information We Collect Automatically

• Usage analytics and interaction patterns
• Device and browser information
• IP addresses and general location data
• Log files and error reports

3. AI Transparency & Data Usage

We process customer data solely to operate and deliver the Service, including to:

• Process user queries and generate AI-assisted responses
• Retrieve and surface relevant information from your knowledge base
• Provide analytics, insights, and reporting within Eva Insights
• Support employee interactions within Eva People
• Enable simulation, testing, and evaluation workflows within Eva HR Lab
• Maintain system performance, security, and reliability
• Troubleshoot issues and provide customer support

We may use aggregated and de-identified data to improve the performance, reliability, and functionality of the Service, provided such data cannot reasonably be used to identify any individual or customer.

3.1 How AI Processes Your Data

AI processes customer data solely to deliver the functionality of the Service. Specifically:

• AI analyzes user queries in real time to generate relevant responses
• Document processing uses AI to extract, index, and retrieve content from your knowledge base
• Analytics features use AI to identify patterns, trends, and insights

AI processing is logically isolated by tenant. Where third-party AI providers are used, they act as service providers/subprocessors and are contractually restricted to processing data solely to deliver the Service, not to train their models.

3.2 AI Decision-Making

Our AI systems assist with information retrieval, summarization, and analysis but do not make autonomous decisions that produce legal or similarly significant effects, including decisions related to employment, compensation, or disciplinary actions.

All outputs are intended to support human decision-making. Customers remain solely responsible for reviewing AI-generated outputs and making all final decisions, and appropriate human oversight is required for all consequential use cases.

4. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

Retention periods are as follows:

• Customer Content (HR data, documents, conversations): Retained for the duration of the active account based on contractual necessity
• Account Information: Retained for the duration of the customer relationship and as required for billing, compliance, and audit purposes
• Usage Data and Analytics Logs: Retained for up to 12 months for legitimate interests, including service improvement, performance monitoring, and security
• System Logs and Security Data: Retained for up to 90 days, unless required for investigation of security incidents
• Backups: Retained for up to 90 days in secure, access-restricted environments

Upon account termination, customer data is deleted within 90 days, unless retention is required by applicable law or necessary to establish, exercise, or defend legal claims. You may request deletion of your data at any time, subject to legal and contractual limitations.

5. Data Security

• AES-256 encryption for data at rest
• TLS 1.2+ encryption for data in transit
• Logical tenant isolation (row-level scoping)
• Independent external security assessment; penetration testing engagement underway
• SOC 2 Type II aligned controls

6. Your Rights and How to Exercise Them

Depending on your location and applicable law, including the California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), and other applicable privacy laws, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a portable, machine-readable format
• Opt-Out: Opt out of certain types of data processing, where applicable
• Restriction / Objection: Request restriction of, or object to, certain processing activities where permitted by law
• Complaint: Lodge a complaint with a relevant data protection authority
• AI Explanation: Request information about AI-assisted processing only where such processing results in decisions that produce legal or similarly significant effects, as defined under applicable law

To exercise your rights, contact: privacy@vistry.ai

We will respond to requests in accordance with applicable legal requirements.

7. International Data Transfers

Your data may be processed in the United States or other countries where our service providers operate. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

8. Website Cookies and Tracking Choices

Our marketing website uses necessary storage to operate core site functionality. With your consent, we may also use analytics and marketing technologies, including Google Analytics 4, Google Tag Manager, and Microsoft Clarity, to understand site performance, diagnose user experience issues, measure campaigns, and route sales inquiries.

• Necessary: Required for site functionality, security, routing, and forms.
• Analytics: Google Analytics 4 and Google Tag Manager help us measure aggregate site performance.
• Experience Diagnostics: Microsoft Clarity helps us diagnose page-level user experience issues where enabled.
• Marketing: Campaign attribution and GTM marketing tags help us route sales inquiries and measure campaigns where enabled.

You can update your choices at any time using the Cookie Preferences link in the website footer. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of marketing cookies and sale/share-related tracking where applicable.

9. Contact Us

For privacy inquiries or to exercise your rights, contact:

We will respond to requests within the timeframes required by applicable data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements.

If we make material changes, we will provide advance notice through appropriate means, which may include email notification, in-product messaging, or prominent notice on our website, as required by applicable law.

Your continued use of the Service after such updates become effective constitutes acceptance of the revised Privacy Policy.