> In short:
> * We use data to operate and protect the Services. We do not sell it, use it for targeted advertising, or train general-purpose AI models on it.
> * We collect only what is needed to operate our Services, such as your email address for sign-in.
> * We limit retention: technical logs are kept for up to 30 days; expired or revoked sessions and OAuth tokens are deleted within the same period.
> * The sections below explain what data we process, why we process it, and who receives it.
### 1. Scope
Mattesu Works ("we", "us") is the collective under whose name Evgerable develops the EVEV project and ecosystem. This Policy applies to EV Identity and related services (EV Index, EV Director, EV Circles, Amiak, Namiko, and others) that link to it (collectively, the "Services").
EV Identity is your shared account. It handles authorization and hosts the canonical version of this Policy. Processing specific to an individual Service is described in that Service's supplement.
Evgerable, operating under the Mattesu Works name, is responsible for processing. Questions can be sent to evev@matte.su.
### 2. Data we process
We collect only the information needed to operate the Services. The data involved depends on the features you use. If you do not provide data required for sign-in or a selected feature, that feature will not be available.
- Google sign-in: we receive your unique identifier, verified email address, name, and avatar URL. Your Google password is not shared with us, and Google access and refresh tokens are not retained.
- Your EV Identity profile: system-generated username, display name, email address, interface language, and avatar.
- Security and authorization: active sessions, permissions you grant to applications, IP address, device and browser type, sign-in time, and technical signals used by Cloudflare Turnstile to prevent automated abuse.
- Usage and reliability: anonymized usage statistics such as visited pages, referrer, device and browser type, and approximate region, together with technical errors and traces.
- Support: the content of your messages and information you choose to submit with a request.
- Payments and subscriptions: when you use paid features, the Merchant of Record ("MoR") processes payment details, tax information, and fraud-prevention data. The Services receive the transaction identifier, product, amount, currency, payment, subscription or refund status, and related account entitlements.
### 3. Why we process data
We process data for specific purposes and on the following legal bases:
- Providing the Services (contract): to create your account, sign you in, provide product functions, and support you.
- Protection and improvement (legitimate interests): to protect accounts, prevent spam and abuse, diagnose faults, and maintain reliable Services.
- Compliance with law (legal obligations): to comply with applicable law and respond to binding requests from public authorities.
- Your consent: for optional processing that requires separate permission. You can withdraw consent at any time.
Marketing messages are sent only with your explicit consent.
### 4. Who else can access data
We share data to the extent needed for the relevant function:
- EVEV Services — within the permissions you grant during authorization;
- Google — to provide account sign-in;
- Vercel and Cloudflare — for hosting, delivery, analytics, and abuse prevention;
- Infrastructure providers — for data storage, caching, monitoring, and Service operations;
- MoR — for payments, subscriptions, and refunds;
- public authorities — where required by applicable law.
### 5. Your profile and its visibility
EV Identity has no public user directory or profile search. When you sign in through EV Identity, a Service receives the account identifier with the `openid` scope, display name and avatar with `profile`, and email address with `email`.
*Please note:* your avatar is available through a public but unpredictable URL. After replacement or deletion, the previous image may remain in network caches for up to one hour.
### 6. Cookies and local storage
We use technical cookies and browser local storage for sessions, secure OAuth redirects, and preferences such as language.
We do not use advertising trackers. Vercel Web Analytics produces basic statistics without analytics cookies, while Cloudflare Turnstile checks requests for signs of automated activity.
### 7. Retention
We do not keep data indefinitely. Our retention periods are:
- Account and profile — while your account exists.
- Expired or revoked sessions and OAuth tokens — up to 30 days.
- Access logs, errors, and technical traces — up to 30 days.
- Records of significant account, profile, and permission actions — one year.
- Support requests — one year after the request is closed.
- Payment records — for the periods set by the MoR and applicable law.
- Account deletion: after a deletion request is confirmed, data is deleted from primary systems within 30 days and from backups within 90 days.
Retention is extended for the period needed to comply with law, resolve a dispute, or investigate abuse.
### 8. Managing your data and your rights
In EV Identity settings, you can change your display name, avatar, and language, review active sessions, and revoke access for Services you no longer use.
To request a copy of your data, correct it, restrict processing, exercise portability, or delete your account, email evev@matte.su. Before fulfilling a request, we will confirm that the account belongs to you.
If processing is based on our legitimate interests, you may object to it by emailing the same address.
Available rights are determined by applicable law. You may withdraw consent without affecting processing completed before withdrawal and lodge a complaint with a competent data protection authority.
### 9. International data transfers
Data may be processed outside your country, including in the United States and the European Economic Area. International transfers use contractual and other safeguards recognized by applicable law. You can request information about the applicable safeguards and a copy of them by emailing evev@matte.su.
### 10. Age restrictions
Accounts and paid features are intended for users aged 18 or older. We do not verify age or request a date of birth. By continuing sign-in, you state that you are 18 or older. If you believe a child has provided data, email evev@matte.su: we will review the report and delete the data unless continued retention is required by law or for security.
### 11. Security
We protect data through encryption in transit, access controls, logging, and other measures proportionate to risk. If you suspect that someone has accessed your account, email evev@matte.su.
### 12. Policy changes
The Policy version and effective date appear at the top of the page. Where required by law, we will notify you of material changes in advance through your account email or the Services. Processing that requires consent begins only after consent is obtained.
See also our Terms of Service.