Privacy Policy for the Evolve Mobile App

1. Scope

This policy applies to the Evolve mobile app, the Evolve account used to sign in, and the Evolve services reached through the app. It covers personal data collected directly from you, provided by the University of Nicosia or another participating organisation, generated when you use the app, or received from a service you choose to connect.

A participating organisation may separately control official student, employment, research, or administrative records under its own notices and retention policies. External websites and services that you choose to open or connect have their own privacy policies.

2. Information we collect

The information collected depends on the features you use. It may include:

• Account and profile information, such as your name, email address, user handle, organisation, memberships, roles, preferences, and account status.
• Authentication and security information, such as session identifiers, verification status, multi-factor authentication or passkey status, and security events. Passwords are processed for authentication and are not stored in readable form by the mobile app.
• Content you provide, such as prompts, chat messages, Team Chat messages, feedback, files, documents, images, audio files, and other attachments.
• Photos or images you select from your library or capture with the camera when you choose to attach them to an Evolve request.
• Connected-service information when you choose to connect a service such as GitHub or an organisation-provided tool, including the service account identifier, authorisation token, and the content or action you request through that connection.
• Technical and usage information, such as IP address, device and operating-system information, app version, route or feature used, timestamps, request identifiers, crash data, performance traces, logs, and interaction breadcrumbs.
• Diagnostic session replay through Sentry. A sample of sessions and sessions in which an error occurs may record privacy-masked screen structure and interaction information so that faults can be reproduced. Diagnostic events may be linked to an account or device identifier when you are signed in.

3. Camera, photos, files, and device permissions

Evolve asks for camera or photo-library access only when you use a feature that needs it. For example, you may take a photo of a document or choose an existing image and attach it to an AI Studio request. Granting permission does not by itself upload a photo; the selected or captured item is transmitted only when you choose to attach or upload it.

You can deny or later withdraw a device permission in your device settings. Some attachment features will not work without the relevant permission, but other app features remain available.

The current mobile app does not access your contacts, does not access the device microphone or record audio, and does not use an advertising SDK or an advertising identifier for advertising. The current app does not collect precise or approximate device location. A file you deliberately select and upload may itself contain audio, location metadata, or other information chosen by you.

4. How we use information

We use personal data only where needed to provide, secure, support, and improve Evolve, comply with law, and administer participating organisations' access to the service.

• Create and administer your account, authenticate you, maintain your session, and apply the correct organisation, role, and permissions.
• Provide AI Studio, Team Chat, file, content, collaboration, and connected-service features that you request.
• Process prompts and attachments, return generated responses, and preserve conversation history where the feature provides history.
• Protect users and the service, prevent misuse, investigate incidents, enforce access controls, and maintain audit and security records.
• Diagnose crashes and errors, monitor reliability and performance, and improve the app and its services.
• Respond to support, privacy, access, correction, and deletion requests.
• Meet legal, regulatory, contractual, accreditation, employment, and institutional record-keeping obligations where applicable.

5. AI features

When you use an AI feature, the prompt, relevant conversation history, selected files or images, and necessary request metadata are processed by Evolve and may be sent to the AI model provider selected for that request. Providers available through Evolve may include OpenAI, Anthropic, Google, AWS-hosted models, Groq, OpenRouter, xAI, Cerebras, or other organisation-approved providers.

Do not submit personal, confidential, or sensitive information that is not needed for your request. AI output can be inaccurate and should be checked before it is relied upon. Evolve-generated output is not used by itself to make a legal or similarly significant decision about you.

6. When information is disclosed

We do not sell personal data and do not use personal data for third-party advertising. Information may be disclosed only as needed for the purposes described in this policy:

• To the University of Nicosia or another participating organisation where it administers your account, access, workgroup, course, employment, research, or institutional records.
• To cloud, authentication, storage, security, support, and infrastructure providers, including Amazon Web Services and Amazon Cognito.
• To Sentry and other approved observability providers for crash reporting, diagnostics, security, and performance monitoring.
• To the AI model provider used for a request and to a connected external service when you initiate that use.
• To professional advisers, regulators, courts, law-enforcement authorities, or other recipients where disclosure is required by law or necessary to protect legal rights and safety.

7. Security

We use technical and organisational measures appropriate to the nature of the data and the risks involved. These include encrypted network transport, secure device storage for authentication tokens, access controls, environment separation, audit and security logging, and restricted service credentials. No method of storage or transmission can be guaranteed to be completely secure.

You are responsible for protecting your password, device access, and any connected-service credentials. Contact evolve@unic.ac.cy if you believe your account or device has been compromised.

8. Retention

We retain account information and user content for as long as the account or relevant feature is active, and then for only as long as needed for the purposes described in this policy. Operational logs, security records, diagnostics, and backups are retained according to applicable operational schedules and are deleted, anonymised, or overwritten when no longer needed.

Official academic, employment, research, financial, accreditation, safeguarding, legal-hold, security, or audit records may be retained by UNIC Evolve Ltd, the University of Nicosia, or another participating organisation where law or institutional obligations require it. These retained records are restricted to the applicable purpose and are not treated as an active Evolve login.

Team Chat content under a legal, safety, moderation, or quarantine hold may be retained for the duration of that hold. Other authored Team Chat content is redacted as part of account deletion. Retention periods may therefore differ by data category and legal context.

9. Account deletion and data deletion

You can initiate deletion in the mobile app from Settings, Account, Delete account. The app asks you to confirm the request and re-enter your password. When the request is accepted, the Evolve login is removed, active sessions are revoked, and associated personal app content is queued for deletion or redaction. Content removal may finish asynchronously after the login has been removed.

For an account without a current institutional affiliation, identifying profile fields are anonymised and app preferences, memberships, contact links, files, AI Studio conversations, and other associated personal app content are deleted or redacted.

For a student, faculty, staff, or other institutionally affiliated account, the Evolve login and personal app content are deleted or redacted, but official institutional identity, membership, academic, employment, research, audit, legal-hold, or other records may be retained where required by law or institutional policy. Retained records cannot be used to sign in to the deleted Evolve account.

If you cannot access the app, you may request account and associated-data deletion by email. Send the request from the email address registered to the account where possible, identify the Evolve account to be deleted, and do not include your password. We may need to verify your identity before acting. We will tell you if more time is required or if specific records must be retained.

• Request Evolve account deletion by email

  Use this option if you cannot access the in-app deletion flow.

10. Your choices and privacy rights

Depending on applicable law, you may ask to access, correct, erase, restrict, or receive a portable copy of your personal data, or object to particular processing. You may withdraw consent where processing is based on consent. Withdrawing consent does not affect processing that was lawful before withdrawal or processing based on another lawful ground.

You can change camera and photo permissions in device settings, disconnect optional external services, delete content through available app controls, or delete your account as described above. To exercise another privacy right, contact the Data Protection Officer. We normally respond within one month, subject to lawful extensions and identity verification.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or the competent supervisory authority in your country.

• Contact the Data Protection Officer

11. International transfers

Some service providers or AI model providers may process data outside Cyprus or the European Economic Area. Where required, transfers are protected through an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism, together with appropriate technical and organisational measures.

12. Children

Evolve is an education and work platform intended for authorised users of participating organisations. It is not directed to children as a general consumer service. Where an authorised user is a minor, the participating organisation and UNIC Evolve Ltd apply the consent, notice, and safeguarding requirements that are applicable to that user and service.

13. Changes to this policy

We may update this policy when the app, its service providers, or legal requirements change. The date at the top shows when it was last updated. Material changes will be communicated through the app, the service, or another appropriate channel before they take effect where required.