HelpGo to Evolve
© 2026 UNIC Evolve Ltd.
TermsPrivacyCookiesAccessibility
Help
StatusReleases

Privacy policy

Effective from August 17, 2026

This policy explains how the Evolve mobile app for iOS and Android and its connected services collect, use, disclose, retain, and delete personal data.

Who we are and how to contact us

For the purposes of the General Data Protection Regulation and other applicable privacy laws, the controller for the Evolve service is:

UNIC Evolve Ltd

46 Makedonitissas Avenue, CY-2417

P.O. Box 24005, CY-1700

Nicosia, Cyprus

+357 22 841 528

UNIC Evolve Ltd operates Evolve for the University of Nicosia. The Evolve mobile app may appear in the Apple App Store and Google Play under the University of Nicosia developer account.

Questions about the app or an account-deletion request can be sent to evolve@unic.ac.cy. Privacy-rights enquiries can also be sent to the Data Protection Officer below.

Data Protection Officer contact details:

A. & E. C. Emilianides, C. Katsaros & Associates LLC

192 Ledras, 3rd Floor,

1011 Nicosia, Cyprus

Tel: +357 22 676752

Fax: +357 22 676754

E-mail: gdpr@ekllc.eu

How Evolve handles personal data

1. Scope

This policy applies to the Evolve mobile app, the Evolve account used to sign in, and the Evolve services reached through the app. It covers personal data collected directly from you, provided by the University of Nicosia or another participating organisation, generated when you use the app, or received from a service you choose to connect.

A participating organisation may separately control official student, employment, research, or administrative records under its own notices and retention policies. External websites and services that you choose to open or connect have their own privacy policies.

2. Information we collect

The information collected depends on the features you use. It may include:

Providers and data handling

Where each inference provider we route to processes requests, how long it keeps them and whether it trains on them. Every value was read from the provider's published pages on the date shown.

Providers and data handling
ProviderRouteProcessing regionRetentionTraining useLast checked
OpenAI (IE)
DirectUnited States (default OpenAI endpoint)SourceKept up to 30 days for abuse monitoringSourceNot used for trainingSourceSep 4, 2026
Anthropic (IE)
DirectUnited States, Europe, Asia or Australia (routing); stored in the United States
Account and profile information, such as your name, email address, user handle, organisation, memberships, roles, preferences, and account status.
  • Authentication and security information, such as session identifiers, verification status, multi-factor authentication or passkey status, and security events. Passwords are processed for authentication and are not stored in readable form by the mobile app.
  • Content you provide, such as prompts, AI Studio conversations, Spaces messages and reactions, live audio or video you choose to share in a Spaces call, feedback, profile pictures, files, documents, images, audio files, and other attachments.
  • Photos or images you select from your library or capture with the camera when you choose a profile picture, attach media in AI Studio or Spaces, or upload media to Drive.
  • Spaces safety and moderation information, such as reports about messages or users, report reasons or comments, blocked-user preferences, records showing acceptance of applicable usage rules, automated safety or malware signals, quarantine status, and actions taken by authorised administrators or moderators.
  • Connected-service information when you choose to connect a service such as GitHub or an organisation-provided tool, including the service account identifier, authorisation token, and the content or action you request through that connection.
  • Technical and usage information, such as IP address, device and operating-system information, app version, route or feature used, timestamps, request identifiers, crash data, performance traces, logs, and interaction breadcrumbs.
  • Diagnostic session replay through Datadog. A sample of sessions may record privacy-masked screen structure and interaction information so that faults can be reproduced. Diagnostic events may be linked to an account or device identifier when you are signed in.

    • 3. Microphone, camera, photos, files, and device permissions

    Evolve asks for microphone, camera, or photo-library access only when you use a feature that needs it. For example, you may start or join a Spaces call, choose a profile picture, take or select a photo to attach in AI Studio or Spaces, save an image to Drive, or turn on video in a Spaces call. Granting permission does not by itself transmit microphone audio, upload a photo, or start video. Microphone audio is transmitted only after you confirm starting or joining a call and while your microphone is unmuted; selected or captured media is transmitted only when you choose to attach, save, upload, or turn on the camera in a call.

    You can deny or later withdraw a device permission in your device settings. Some attachment features will not work without the relevant permission, but other app features remain available.

    The current mobile app does not access your contacts and does not use an advertising SDK or an advertising identifier for advertising. When you choose AI Studio voice dictation, the app accesses the microphone only while you are actively recording in the foreground. The recording is sent securely through the service to an approved AI transcription provider to return text, and the app deletes its temporary local copy after the transcription attempt. After you confirm starting or joining a Spaces call, microphone audio is transmitted securely through an approved real-time meeting provider only while your microphone is unmuted, and camera video is transmitted only while you have turned on your camera. The mobile app does not save a copy of live call audio or video to your device and does not record audio in the background. The current app does not collect precise or approximate device location. A file you deliberately select and upload may itself contain audio, location metadata, or other information chosen by you.

    4. How we use information

    We use personal data only where needed to provide, secure, support, and improve Evolve, comply with law, and administer participating organisations' access to the service.

    • Create and administer your account, authenticate you, maintain your session, and apply the correct organisation, role, and permissions.
    • Provide AI Studio, Spaces, profile-picture, file, content, collaboration, and connected-service features that you request.
    • Process prompts and attachments, return generated responses, and preserve conversation history where the feature provides history.
    • Protect users and the service, prevent misuse, investigate incidents, enforce access controls, and maintain audit and security records.
    • Receive and assess Spaces reports, apply user blocks, filter or quarantine suspected harmful content or files, investigate misuse, enforce applicable usage rules, and maintain safety and moderation records.
    • Diagnose crashes and errors, monitor reliability and performance, and improve the app and its services.
    • Respond to support, privacy, access, correction, and deletion requests.
    • Meet legal, regulatory, contractual, accreditation, employment, and institutional record-keeping obligations where applicable.

    5. AI features

    When you use an AI feature, the prompt, relevant conversation history, selected files or images, and necessary request metadata are processed by Evolve and may be sent to the AI model provider selected for that request. Providers available through Evolve may include OpenAI, Anthropic, Google, AWS-hosted models, Groq, OpenRouter, xAI, Cerebras, or other organisation-approved providers.

    Do not submit personal, confidential, or sensitive information that is not needed for your request. AI output can be inaccurate and should be checked before it is relied upon. Evolve-generated output is not used by itself to make a legal or similarly significant decision about you.

    6. When information is disclosed

    We do not sell personal data and do not use personal data for third-party advertising. Information may be disclosed only as needed for the purposes described in this policy:

    • To the University of Nicosia or another participating organisation where it administers your account, access, workgroup, course, employment, research, or institutional records.
    • To authorised administrators or moderators of the relevant participating organisation when needed to review a Spaces report, investigate misuse, enforce applicable rules, or protect users, the organisation, and the service.
    • To cloud, authentication, storage, security, support, and infrastructure providers, including Amazon Web Services and Amazon Cognito.
    • To Datadog and other approved observability providers for crash reporting, diagnostics, security, and performance monitoring.
    • To the AI model provider used for a request and to a connected external service when you initiate that use.
    • To professional advisers, regulators, courts, law-enforcement authorities, or other recipients where disclosure is required by law or necessary to protect legal rights and safety.

    Service-provider protections

    Service providers are required to process personal data for the authorised service, apply appropriate confidentiality and security protections, and provide protection consistent with this policy and applicable law. Their own terms may also apply when you independently connect or direct Evolve to use their service.

    7. Security

    We use technical and organisational measures appropriate to the nature of the data and the risks involved. These include encrypted network transport, secure device storage for authentication tokens, access controls, environment separation, audit and security logging, and restricted service credentials. No method of storage or transmission can be guaranteed to be completely secure.

    You are responsible for protecting your password, device access, and any connected-service credentials. Contact evolve@unic.ac.cy if you believe your account or device has been compromised.

    8. Retention

    We retain account information and user content for as long as the account or relevant feature is active, and then for only as long as needed for the purposes described in this policy. Operational logs, security records, diagnostics, and backups are retained according to applicable operational schedules and are deleted, anonymised, or overwritten when no longer needed.

    Official academic, employment, research, financial, accreditation, safeguarding, legal-hold, security, or audit records may be retained by UNIC Evolve Ltd, the University of Nicosia, or another participating organisation where law or institutional obligations require it. These retained records are restricted to the applicable purpose and are not treated as an active Evolve login.

    Spaces messages and files, reports, moderation and quarantine records, block relationships, and records showing acceptance of applicable usage rules are retained only while needed for the feature, safety, security, audit, legal, or institutional purposes described in this policy. Content under a legal, safety, moderation, or quarantine hold may be retained for the duration of that hold. Other authored Spaces content is redacted as part of account deletion.

    9. Account deletion and data deletion

    You can initiate deletion in the mobile app from Settings, Account, Delete account. The app asks you to confirm the request and re-enter your password. When the request is accepted, the Evolve login is removed, active sessions are revoked, and associated personal app content is queued for deletion or redaction. Content removal may finish asynchronously after the login has been removed.

    For an account without a current institutional affiliation, identifying profile fields are anonymised and app preferences, memberships, contact links, files, AI Studio conversations, and other associated personal app content are deleted or redacted.

    For a student, faculty, staff, or other institutionally affiliated account, the Evolve login and personal app content are deleted or redacted, but official institutional identity, membership, academic, employment, research, audit, legal-hold, or other records may be retained where required by law or institutional policy. Retained records cannot be used to sign in to the deleted Evolve account.

    If you cannot access the app, you may request account and associated-data deletion by email. Send the request from the email address registered to the account where possible, identify the Evolve account to be deleted, and do not include your password. We may need to verify your identity before acting. We will tell you if more time is required or if specific records must be retained.

    • Request Evolve account deletion by email

      Use this option if you cannot access the in-app deletion flow.

    10. Your choices and privacy rights

    Depending on applicable law, you may ask to access, correct, erase, restrict, or receive a portable copy of your personal data, or object to particular processing. You may withdraw consent where processing is based on consent. Withdrawing consent does not affect processing that was lawful before withdrawal or processing based on another lawful ground.

    You can change microphone, camera, and photo permissions in device settings, disconnect optional external services, report a Spaces message or user, block or unblock another Spaces user, delete content through available app controls, or delete your account as described above. To exercise another privacy right, contact the Data Protection Officer. We normally respond within one month, subject to lawful extensions and identity verification.

    You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or the competent supervisory authority in your country.

    • Contact the Data Protection Officer

    11. International transfers

    Some service providers or AI model providers may process data outside Cyprus or the European Economic Area. Where required, transfers are protected through an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism, together with appropriate technical and organisational measures.

    12. Children

    Evolve is an education and work platform intended for authorised users of participating organisations. It is not directed to children as a general consumer service. Where an authorised user is a minor, the participating organisation and UNIC Evolve Ltd apply the consent, notice, and safeguarding requirements that are applicable to that user and service.

    13. Changes to this policy

    We may update this policy when the app, its service providers, or legal requirements change. The date at the top shows when it was last updated. Material changes will be communicated through the app, the service, or another appropriate channel before they take effect where required.

    Source
    Deleted within 30 days; flagged content kept up to 2 yearsSource
    Not used for trainingSource
    Sep 4, 2026
    Google (Gemini API) (IE)
    		DirectAny country where Google maintains facilities (no regional commitment)SourceKept for a limited period for abuse detection; project logs 55 daysSourceNot used for training (paid tier)SourceSep 4, 2026
    xAI (US)
    		DirectUnited StatesSourceKept 30 days for abuse auditingSourceNot used for training without permissionSourceSep 4, 2026
    Groq (US)
    		DirectUnited States and other Groq regions; retained data stored in the United StatesSourceNot retained by default; reliability and abuse logs up to 30 daysSourceNot used for trainingSourceSep 4, 2026
    Cerebras (US)
    		DirectUnited States and other countriesSourceNot retainedSourceNot used for trainingSourceSep 4, 2026
    Amazon Bedrock (eu-central-1) (LU)
    		Cloud hostFrankfurt (eu-central-1)SourceNot retained by default; up to 30 days for models that require AWS reviewSourceNot used for training; not shared with the model labSourceSep 4, 2026
    OpenRouter (US)
    		Through an aggregatorUnited States routing, then the serving lab's regionSourceNot retained by OpenRouter unless prompt logging is enabled; the lab's retention appliesSourceNot used for training by OpenRouter; the lab's policy appliesSourceSep 4, 2026
    Alibaba Cloud International (Model Studio) (NL/SG)
    		Lab · openrouterSingapore, via OpenRouter (United States); compute scheduled globally excluding mainland ChinaSourceNot published by the labSourceNot used for training (Model Studio statement)SourceSep 4, 2026
    ByteDance Seed (BytePlus ModelArk) (SG)
    		Lab · openrouterJohor, Malaysia, via OpenRouter (United States); offshore storage clauseSourceNot published as a period; authorised data cannot be technically deletedSourceTraining licence in the Data Authorization Agreement; reach via OpenRouter unresolvedSourceSep 4, 2026
    MiniMax (SG)
    		Lab · openrouterNot published; Singapore entity, transfers to affiliates permittedSourceKept as long as necessary; no period publishedSourceNot addressed by the labSourceSep 4, 2026
    Kling AI (Kuaishou) (SG)
    		Lab · openrouterSingapore servers, via AtlasCloud (United States) on OpenRouterSourceKept as long as necessary; no period publishedSourceTerms permit training on content (section 4.7.3)SourceSep 4, 2026

    This table is the registry as published on 2026-09-04. Signed-in members see the live registry under Account settings.