Privacy

Who holds your information

If you use EVIA because you work at a salon, your salon holds the record about you. They’re your employer. They decide what goes in it, who on the team can see parts of it, and whether the clock-in location check is switched on.

EVIA is the software they use. We hold that information for them and act on their instruction. We don’t decide what your salon records about you.

So most questions on this page have two answers: what your salon does, and what we do. We’ve said which is which throughout. If you want to see what’s held about you, correct something that’s wrong, or ask for it to be removed, ask whoever owns your salon first. They’re the ones who can actually do something about it, and they can ask us for help.

If you work in Mexico, those are the rights Mexican law calls ARCO. Acceso is seeing what’s held about you, rectificación is correcting it, cancelación is asking for it to be removed, and oposición is objecting to how it’s used. They’re the same things described just above, under the name you may be looking for. Your salon is who to ask, and this page is ours rather than theirs: your salon should have a privacy notice of its own.

We use what we hold to run the product, keep it secure, and help your salon when they ask us to. That’s the whole list. We don’t use it for anything else, we don’t sell it, and we don’t use it to advertise to you.

EVIA is provided by Nikki Le Consultancy.

What’s recorded

Your account. Your name, your email address, your password, your role, your job title, your start date, a phone number if your salon has one for you, and whether you’re still employed there. We never see your password: it’s stored scrambled, and nobody at EVIA or at your salon can read it.

Your work. Your shifts and the rota you’re on, the hours you clock, your timesheets, your attendance, time off you ask for and the reason you give, meetings, any appraisals your salon records, any figures it tracks against your role, your progress through onboarding and training, and any documents it attaches to your record.

Messages. Your one-to-one conversations, the channels you’re in, posts, polls and how you voted in them.

What you’ve read. Whether you’ve opened an update or a conversation, so that EVIA can show you what’s new and stop showing you what isn’t. It records that you read it and when. It doesn’t record how long you looked at it, what you tapped, or anything else about how you use the app.

Signing in. When a sign-in fails, we record that against the email address it was tried with. That’s how somebody sitting there guessing passwords gets stopped.

Your phone, if you use the app. A notification token, which phone platform it is, which build of the app registered it, and when you last had the app open and signed in. That’s what lets a notification reach the right phone and nothing else.

The EVIA app carries no analytics, no crash reporting and no advertising identifier. It doesn’t record what you tap.

That list is for people who work at a salon. If you applied for a job and never worked there, what’s held about you is different and smaller, and If you applied for a job below says what it is.

Clocking in, and location

When you clock in on the EVIA app, it checks you’re at the salon. Your phone tells EVIA how far you are from the salon’s location and how accurate that reading is. EVIA records the distance, not where you are. Your location is never stored, never shown to anyone, and never looked at outside the moment you clock in. Whoever runs the salon sees the distance, not where you were.

If your phone can’t get an accurate enough reading, or you’d rather not share your location, you can still clock in. It’s recorded as unchecked, and whoever runs the salon can see that. Clocking in on the EVIA website doesn’t check where you are, so it’s always recorded as unchecked.

EVIA doesn’t track you the rest of the time. Not between shifts, not when the app is closed, and not when you aren’t clocking in.

Your salon sets the point that counts as being at the salon, and how far from it still counts. Every change to either is recorded: what it became, who changed it, and when.

What a notification shows

A notification can appear on a locked phone that somebody else is looking at, so it deliberately carries very little.

• A message notification never contains the message.
• A meeting notification never says what kind of meeting it is.
• An answer to a time off request says it was approved or declined, and never the note that came with it.
• An update notification carries the title, and never what the update says.

Each one also carries which screen to open. Nothing else.

Who can see it

Whoever owns your salon can see the record your salon holds about you, and they can let someone on your team see parts of it to help run the salon.

They can’t read your one-to-one messages. They can read channels, which are group conversations, in the same way as anyone else in them.

You can see your own record, your own schedule, your own hours, your own training, and any appraisal once your salon has published it. You can’t see anybody else’s.

Salons can’t see each other. Each salon’s information is kept apart by the database itself rather than by each screen remembering to keep it apart.

A small number of people at EVIA can reach salon information, to keep the service running and to help a salon that has asked for help. That access requires a second factor to sign in.

Where it’s held

EVIA’s database is hosted by Supabase on Amazon Web Services in Canada, in the Montréal region. The website, and the interface the phone app talks to, are hosted by Vercel.

Most people using EVIA aren’t in Canada. If you aren’t, that means information about you is held in a country other than the one you work in, and is sent there when you use EVIA. We’re telling you plainly rather than leaving it to be worked out.

Who else handles it

These are the only companies involved, and this is everything each one gets.

• Supabase holds the database and handles signing in. In Canada, as above.
• Vercel hosts the website and the interface the phone app uses.
• Resend sends EVIA’s emails: invitations, password resets and notifications. It receives the address and what the email says.
• Google, through Firebase Cloud Messaging, delivers notifications to phones. It receives the phone’s notification token and what the notification says, which is the little described above.
• Stripe handles the salon’s subscription payments. That’s between EVIA and whoever pays for the salon. Staff records aren’t sent to Stripe.
• Expo builds the phone app. It receives nothing about you when you use it.

Each is under a contract that requires it to protect what it holds to the standard set out on this page, and to use it only to run EVIA. We don’t sell information about you and we don’t use it to advertise to you.

What you can turn off

• Location. You can refuse the location permission when the app asks, or turn it off afterwards in your phone’s settings. You can still clock in. It’s recorded as unchecked.
• Notifications. You can turn them off on the Account screen in the app, or in your phone’s settings. Nothing else about EVIA changes.
• The app. You can use EVIA on the web instead. Clocking in on the web never checks where you are.

How long it’s kept, and what happens when you leave

When you leave a salon, your record is marked as no longer employed. You stop being put on rotas, stop being booked into meetings, and can no longer clock in.

Your record isn’t deleted. The shifts you worked, the hours you clocked and the timesheets that were approved stay as the salon’s record of the work that was done, because a business has to be able to show it.

Seven years. Your salon keeps your record for at least seven years after your employment ends. That’s the whole record and not part of it: the details you gave, tax and payroll information, the hours you clocked and the timesheets that were approved, and anything recorded about how you were doing your job. Seven years is how long a business may need to be able to answer a question about pay or tax for work that was done, and the rest of the record is kept alongside it for the same period rather than being split up.

EVIA doesn’t delete anything on a timer. Nothing disappears from your salon’s record by itself at the end of the seven years; what happens then is the salon’s to decide, and the next section says exactly what can be done and by whom.

When the app is signed out of on a phone, that phone’s notification token is deleted straight away, and the phone stops receiving anything.

Deleting information

We want to be exact about this, because it’s the part most often overstated.

There’s no button that deletes one person’s information, and we haven’t built one. A person’s record runs through the salon’s own records: who approved a timesheet, who covered a shift, who published a rota. Pulling one person out of those while the salon is still running would damage the salon’s record rather than tidy it.

What exists instead:

• Ask your salon. They decide what’s held, and what happens to it once the seven years above are up. They can correct what’s wrong and remove what they’re able to remove. They can ask us for help, and we help.
• A salon can take everything with it. Whoever owns a salon can download the salon’s entire record as a single file, at any time, without asking us.
• A salon can have everything deleted. On the salon’s instruction we delete the salon’s whole record: everything it owns, and the sign-in details of the people in it. That can’t be undone.

If you’re asking because you’ve left a salon, or are about to, the person to ask is still whoever owns it. Your record is theirs to answer for.

If you applied for a job

If you applied to a salon through a careers page hosted by EVIA, that salon holds your application: what you put in the form and anything you attached. Everything on this page applies to it. The salon decides how long to keep it, and the salon is who to ask about it.

A salon using EVIA may send you an email about your application, to the address you gave on it. If it does, the salon decides what is sent and when; EVIA delivers it on their behalf, through Resend, as described above. We don’t send you anything else. You aren’t added to a mailing list, and there’s nothing here to unsubscribe from, because these are replies to an application you made rather than marketing.

EVIA records each of those emails. Which one it was, the address it went to, the address you would reach by replying, who at the salon sent it, and when. That record belongs to the salon and is kept so that whoever is handling your application can see what you have already been told, and so that you don’t get the same message twice. Nobody at the salon can edit it or quietly remove it afterwards.

The address you would reach by replying is the salon’s, which whoever owns it sets. If they haven’t set one, a reply goes to the personal sign-in address of the salon’s longest-standing owner instead, and EVIA tells them that is what will happen before they send.

You don’t need an EVIA account to apply, and for most of the process you won’t have one. If a salon offers you a job through EVIA they can send you a link to set one up, and that link stops working if the application closes.

Keeping it safe

Everything travels over an encrypted connection. Passwords are stored scrambled and can’t be read back by anyone. Who may see what is enforced by the database itself, so the rules don’t depend on every screen remembering to apply them. People at EVIA whose work reaches across salons need a second factor to sign in.

Who EVIA is for

EVIA is used by people at work, through the salon that employs them. It isn’t offered to the general public, and it isn’t for children.

When this page changes

If it changes in a way that matters, salons are told. Staff are shown the new notice inside EVIA and asked to acknowledge it before carrying on, which is how a change that affects you reaches you rather than waiting for you to come back here.

Asking us something

Write to admin@eviatalent.com.

If you work at a salon, ask whoever owns your salon first. They hold your record, and they can sort out most of what you might want.