Table of Contents
1. Information We Collect
1.1This Privacy Policy explains how PuglieseWeb LTD ("we", "us" or "our"), a company registered in England and Wales (company number 17078772) with its registered office at 10 Upper Wheatfield, Hook, England, RG27 9YR, collects, uses, shares and protects personal data as a controller: when you visit our websites, such as puglieseweb.com and evrella.com, talk to the assistant on those websites, contact us, or use our services.
1.2When a business uses Evrella, that business decides what its assistant is for and what happens to the conversations it has. If you talk to the assistant on another business's website, or write to that business through a channel it has connected to Evrella, such as WhatsApp or email, that business is the controller of your personal data, and we process it only on the business's behalf, as its processor, under our Data Processing Agreement. That business's own privacy notice explains what happens to your data, and requests about it should go to that business; if you send one to us, we pass it on. This policy does not cover that processing. The assistant on our own websites is ours: for it we are the controller, and this policy applies.
1.3We collect information that you provide directly to us and information that is collected automatically when you use our services.
1.4Information You Provide: (a) Contact information (name, email address) when you submit our contact form or book a discovery call (b) What you write to the assistant on our own websites, and its answers (c) Your name, email address and message, if you choose to leave them with the assistant on our own websites (d) Email address when you subscribe to our newsletter (e) Any additional information you choose to provide in messages or enquiries (f) Account and sign-in information when you create an account or sign in with Google or Apple (your name and email address, as released by that provider) (g) Your mobile number, if you have an Evrella account. It is required for the account: we text you a sign-in code and use the number to help you get back in if you are locked out (h) If you accept our Terms of Service and Data Processing Agreement for a business: your name, email address and account identifier, the business's legal name and country, the versions you accepted and when, the clauses you specifically approved if the business is established in Italy, and the IP address and browser you used (i) Your answer to “How did you hear about Evrella?”, if you choose to give one after signing up a business for Evrella (one choice from a short list) (j) If you connect a business’s Google Calendar to Evrella: the email address of the Google account you connect, the times that account’s calendar shows you as busy, and Google’s permission for us to add, change and delete the events Evrella writes for that business’s bookings (see section 2) (k) If you connect a business’s Facebook Page or Instagram professional account to Evrella Social: the access tokens Meta issues to us for that Page or account; and, from Meta, the comments people leave on its posts: each comment’s text, the commenter’s Facebook or Instagram id and display name, and the post it is on (see section 2)
1.5Information Collected Automatically: (a) Device information (browser type, operating system, device type) (b) Usage data (pages visited, time spent, referral source) via Google Analytics, and on evrella.com how you click, scroll and move through its pages via Microsoft Clarity (c) Log data (IP address, access times, pages viewed) (d) Cookie and local storage data (cookie consent preferences) (e) If you allow “Marketing” in a website’s cookie settings: the pages you visit, the identifiers Meta’s pixel stores in your browser (_fbp and, if you arrived from one of our ads, _fbc) and your IP address; on evrella.com and on the Evrella console’s sign-up page, also the identifiers Google Ads stores in your browser (_gcl_au and, if you arrived from one of our Google ads, _gcl_aw) and, on that sign-up page, the fact that you started a free trial (f) When you sign up a business for Evrella: the campaign labels in the link that brought you to us (such as utm_source and utm_campaign), the page of our website your visit began on, and any offer you claimed, such as our founding offer (see section 2)
2. How We Use Your Information
2.1We use the information we collect for the following purposes: (a) To respond to your enquiries and provide customer support (b) To deliver our SaaS products, including SystemDox and the Evrella family (c) To provide consulting, architecture, and website development services (d) To send you newsletters and product updates (with your consent) (e) To improve our website, products, and services (f) To analyse website usage and optimise user experience (g) To protect against fraud and abuse (via Cloudflare Turnstile) (h) To comply with legal obligations (i) To protect your Evrella account with a code sent by text message when you sign in, and to help you recover access (j) To contact you by text, phone or WhatsApp about Evrella products and offers — only if you tick the separate, optional box beside your mobile number. You can withdraw that at any time in your Evrella account, under Account › Mobile number (k) To keep a record of the agreements businesses make with us — who accepted which version of our Terms and Data Processing Agreement, for which business and when — to send a copy of what was accepted, and to establish, exercise or defend legal claims (l) To measure our advertising on Facebook, Instagram and Google, including how many free-trial sign-ups it brings, and to show our ads to people who have visited our websites — only if you allow “Marketing” in the website’s cookie settings (see below) (m) To understand which of our advertising campaigns and web pages bring businesses to Evrella, and to honour the offers they claim when they sign up (see below) (n) To write a business’s bookings into the Google Calendar it connects, and to stop its assistant offering times that calendar shows as busy (see below) (o) To show a business the comments people leave on its Facebook and Instagram posts, to draft a reply to each with AI for a person at the business to approve, and to post the replies they approve (see below) (p) To credit the member of our referral or partner programme whose link brought a business to Evrella, and to show that member what it earned from it (see below) (q) To answer the customers who message a business’s own WhatsApp number, when that business connects the number to Evrella (see below)
2.2We rely on the following lawful bases under the UK GDPR (and, where it applies, the EU GDPR): consent (newsletters, analytics cookies, marketing cookies, and contact about our products by text, phone or WhatsApp), legitimate interests (responding to your enquiries, securing and improving our services, keeping a record of the agreements businesses make with us, and understanding which of our marketing brings businesses to Evrella and honouring the offers they claim), performance of a contract (delivering services you have subscribed to), and legal obligation (where we are required by law to retain or disclose data).
2.3Your mobile number is used for the security of your account because that is part of the service you signed up for (performance of a contract). We use it to contact you about our products only with your consent, which is never a condition of using the service. We record when you gave or withdrew that consent and which wording you agreed to.
2.4Advertising measurement on our websites. If you allow “Marketing” in a website’s cookie settings, that website loads Meta’s pixel through Google Tag Manager. The pixel sends Meta Platforms Ireland Ltd the pages you visit, identifiers stored in your browser (the _fbp and _fbc cookies), the identifier of an ad you clicked to reach us, and your IP address, and we use what it measures to see how our Facebook and Instagram ads perform and to show them to people who have visited our websites. On evrella.com, and on the sign-up page of the Evrella console (app.evrella.com), the same consent also loads Google Ads’ conversion tracking, which sends Google Ireland Ltd the page you are on, identifiers stored in your browser (the _gcl_au and _gcl_aw cookies), the identifier of a Google ad you clicked to reach us, and your IP address, so that we can see how our Google ads perform. When you complete a free-trial sign-up on that page, Google Tag Manager tells Google and Meta that a trial has started, with the plan you chose, if any, and a value of zero; that signal carries no campaign labels, and no name, email address or other details of your account. The console loads neither tag on any other page, and in the console the “Marketing” choice is called “Advertising measurement”. Our lawful basis is your consent (UK GDPR Article 6(1)(a)), which the Privacy and Electronic Communications Regulations (regulation 6) also require before these cookies are set. Meta and we are joint controllers for collecting this data on our websites and transmitting it to Meta (UK GDPR Article 26), and you can exercise your rights over that processing with us or with Meta; what Meta does with the data afterwards, it does as a controller in its own right, under its own privacy policy (https://www.facebook.com/privacy/policy/). Google receives the data its conversion tracking collects as a controller in its own right, under its own privacy policy (https://policies.google.com/privacy); for our part in collecting it, you can exercise your rights with us. Meta and Google may transfer the data to the United States, each relying on its certification under the EU–US Data Privacy Framework and its UK Extension. You can withdraw your consent at any time through the Cookie Settings link at the foot of every page or, in the Evrella console, through Cookie preferences in the account menu. Without your consent none of this happens.
2.5How businesses find Evrella. When you sign up a business for Evrella, we record on that business's account how the sign-up came about: the campaign labels in the link you followed to reach us (utm_source, utm_medium, utm_campaign, utm_content and utm_term, which are the names we give our own adverts and posts and identify a campaign, not a person); which page of our website your visit began on; the offer you claimed, if any, such as our founding offer; and, if you choose to answer the optional question “How did you hear about Evrella?”, your answer, one choice from a short list. We use this to understand which of our marketing works and to honour the offers we make. Our lawful basis is our legitimate interests (UK GDPR Article 6(1)(f)). We keep these details with the business's account for as long as the account exists, and delete them with it; our own analytics also keep them, linked only to internal account identifiers and never to your name, your email address or anything else that says who you are (see section 5). We store nothing on your device to do this, neither a cookie nor any identifier: until you sign up, the labels travel only in the addresses of the pages you open. We do not record the click identifiers that advertising platforms add to links (such as gclid and fbclid), and we never send these details to Meta, Google or any other advertiser. If you allow “Marketing” in the cookie settings, the Evrella console’s sign-up page does tell Google and Meta that a free trial has started (as described above under advertising measurement); that signal carries none of these details and nothing that names you. Your visits to our websites before you sign up are measured only if you accept analytics cookies or allow “Marketing” in the cookie settings, and that measurement is never joined to this record (see section 7).
2.6Google Calendar. A business that takes bookings through Evrella can connect a Google account so that its bookings appear in that account’s calendar. When you connect one, Google asks you to allow Evrella, which Google’s screen shows as Puglieseweb, to see, create, change and delete events on calendars you own, and to see your availability. We use these permissions for two things only. First, we write each booking into the account’s primary calendar as an event (the service, the customer’s name, contact details and notes, and a link to the booking in Evrella), change it when the booking moves and delete it when the booking is cancelled; we invite no one, and we change or delete only the events Evrella has written. Second, if the business leaves busy times switched on, we read the times the calendar shows as busy over the next six weeks, so that its assistant and booking page never offer them; we receive only the start and end of each busy period, never what your events say, and we keep them in memory for at most a minute. The assistant is only ever told which times are free. We also keep the email address of the connected account, to show which account is connected. Google’s permission to act for the account (a refresh token) is kept in its own encrypted secret on Amazon Web Services in London, which only the parts of Evrella that need it can read; it never appears in our records, logs or messages. We do not sell this data, use it for advertising, or use it to develop or train any artificial-intelligence or machine-learning model, and we share it with no one. No one at PuglieseWeb reads it, except with the business’s agreement to resolve a request for help, where it is needed for security, or where the law requires it. We do this to provide the Booking feature the business subscribes to (performance of our contract with the business). You can disconnect the calendar at any time under Settings › Booking in Evrella: we then revoke our access at Google and delete the token and the connection at once. The events already written stay in your calendar, because they are yours, and you can delete them there. You can also remove our access in your Google Account (https://myaccount.google.com/permissions), after which we can write nothing more; disconnect the calendar in Evrella as well, or ask us at privacy@puglieseweb.com, to have the token and the connection deleted. Our use, and transfer to any other app, of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
2.7Evrella Social (comments on Facebook and Instagram). A business can connect its Facebook Page or its Instagram professional account to Evrella Social, so that Evrella helps it answer the comments people leave on its posts. When it does, Meta Platforms Ireland Ltd, which runs Facebook and Instagram, sends us, for each comment on that business’s posts: the comment’s text, the commenter’s Facebook or Instagram id and display name, and the post the comment is on. Meta also issues us access tokens that let us read those comments and reply on behalf of that Page or account; we store them encrypted. We use this data for one purpose only: to show each comment to the business and to draft and post its reply. Each reply is drafted by an AI model hosted by Amazon Web Services (Amazon Bedrock) in the European Union, and is posted only after a person at the business has read and approved it; nothing is posted without that approval. We do not create contact records or profiles of the people who comment, we do not use their data for advertising, and we do not use it to develop or train any artificial-intelligence or machine-learning model. The business is the controller of the comments on its own Page and account, and we process them only on its behalf, as its processor, under our Data Processing Agreement; if you commented on a business’s post, that business’s own privacy notice applies, and requests about your data should go to that business (if you send one to us, we pass it on). We delete a commenter’s data 90 days after the reply to their comment is closed. We delete all of it, the comments, the drafts and the tokens, when the business disconnects its Page or account or asks us to, and when Meta sends us a request to delete a person’s data. You can also ask us to delete it at privacy@puglieseweb.com.
2.8Referral links. When someone opens an Evrella sign-up link that carries a referral code, the sign-up page keeps the code in the browser’s session storage (ema.signup.referral) only until the account is made or the tab is closed. The code is then recorded on the new organisation, so that the person who referred the business can be credited and the discount the link offers can be applied. A member of our referral or partner programme sees, in the PuglieseWeb client portal, the name of each business that signed up with its code, how far that business has got (signed up, on trial, card added, paying, ended) and what the member earned from that business’s payments, and nothing else about the business, its people or its conversations. Our lawful basis is our legitimate interests in running our referral and partner programmes and paying the commission we owe (UK GDPR Article 6(1)(f)). The code stays on the organisation for as long as it exists, and is deleted with it.
2.9WhatsApp (a business’s own number). A business can connect its own WhatsApp Business number to Evrella, through Meta’s sign-up window in the Evrella console, so that Evrella answers the customers who message that number. When it does, Meta Platforms Ireland Ltd, which runs WhatsApp, sends us each message a customer writes to that number, with the customer’s phone number, and issues us an access token that lets us receive those messages and reply from that number; we store the token encrypted, in a store kept for that business alone. We use this data to answer the customer: each reply is written by an AI model hosted by Amazon Web Services (Amazon Bedrock) in the European Union, from what the business has told Evrella about itself, and people at the business can read the conversation in the console and reply themselves. If the customer asks for a booking or leaves their details, the business keeps them as a booking or a lead in its account. We do not send marketing or bulk messages, we write only to people who have written to the business first, we do not use the messages for advertising, and we do not use them to develop or train any artificial-intelligence or machine-learning model. The business is the controller of its customers’ messages, and we process them only on its behalf, as its processor, under our Data Processing Agreement; if you wrote to a business on WhatsApp, that business’s own privacy notice applies, and requests about your data should go to that business (if you send one to us, we pass it on). Each message is deleted 90 days after it was sent or received. When the business disconnects its number, or removes our app in Meta, we stop answering on it and delete its access token; we also delete a person’s data when Meta sends us a request to do so. You can also ask us to delete it at privacy@puglieseweb.com.
3. Information Sharing
3.1We do not sell your personal information. We may share your information with the following categories of service providers: (a) Amazon Web Services (AWS) — cloud infrastructure hosting in eu-west-2 (London) (b) Amazon Web Services (AWS) — sending the text messages that carry sign-in and verification codes, through its SMS service and the mobile networks it uses (c) Google Analytics — website analytics (with IP anonymisation enabled) (d) Cloudflare — bot protection and security (Turnstile CAPTCHA) (e) Our built-in booking system — appointment scheduling when you book a discovery call (f) Stripe — payment processing when you subscribe or pay us; it receives your email address and billing details and takes card details on its own checkout page (g) Sentry — error tracking in our product applications, which can include technical details of your session, such as your IP address and browser (h) We may disclose your information if required to do so by law or in response to valid legal requests (i) In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction (j) Meta Platforms Ireland Ltd — only if you allow “Marketing” in a website’s cookie settings: it receives the data its pixel collects on our websites, as a joint controller with us (see section 2) (k) Microsoft Ireland Operations Ltd (Microsoft Clarity) — only on evrella.com, and only if you accept analytics cookies there: session recordings and heatmaps of how its pages are used, with the Evrella chat masked so that no conversation is recorded (l) Meta Platforms Ireland Ltd (Facebook and Instagram) — only if a business connects its Facebook Page or Instagram professional account to Evrella Social: the replies a person at that business has approved, which we post on that Page or account (see section 2) (m) Google Ireland Ltd (Google Ads) — only on evrella.com and the Evrella console’s sign-up page, and only if you allow “Marketing” in the cookie settings: it receives the data its conversion tracking collects, including that a free trial has started, as a controller in its own right (see section 2) (n) The member of our referral or partner programme whose code a business signed up with — the business’s name, how far it has got and what the member earned from its payments, shown in the PuglieseWeb client portal (see section 2) (o) Meta Platforms Ireland Ltd (WhatsApp) — only if a business connects its own WhatsApp number to Evrella: the replies we send to its customers from that number (see section 2)
3.2Requests from public authorities. We disclose personal data to a public authority, such as the police, a court or a regulator, only when the law requires it. We check every request before answering it: that it comes from an authority entitled to make it, that it has a lawful basis and is in the proper legal form, and that it is limited to what it needs. We refuse, and where it is appropriate challenge, a request that is not lawful or is broader than the law allows. When we must disclose, we give only the minimum the request lawfully requires. Where the data belongs to a business that uses Evrella, we refer the authority to that business and tell the business about the request, unless the law forbids us to. We keep a record of every request we receive, of our answer and of the legal reasoning behind it. In the last 12 months we have not disclosed anyone’s personal data in answer to a national-security request.
4. Data Security
4.1We implement appropriate technical and organisational measures to protect your personal information: (a) All data is hosted on AWS eu-west-2 (London) with encryption at rest and in transit (b) HTTPS encryption for all website traffic (c) Access controls and authentication for all backend systems (d) Regular security reviews and updates
4.2While we strive to protect your personal information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
5. Data Retention
5.1We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected: (a) Contact form submissions and chat conversations: 12 months after your last interaction (b) Newsletter subscriptions: until you unsubscribe (c) Analytics data: 26 months (Google Analytics default retention period); Microsoft Clarity recordings 30 days and its heatmaps 13 months (d) Your mobile number and your contact preference: for as long as your account exists, and deleted with it (e) Records of the acceptance of our Terms and Data Processing Agreement: for as long as the agreement lasts and six years after it ends or, if a claim is made or threatened within that time, until it is finally resolved, even if the account or the organisation is deleted, because we may need them to establish, exercise or defend legal claims (f) Marketing cookies: Meta’s (_fbp, _fbc) up to 3 months and Google Ads’ (_gcl_au, _gcl_aw) up to 90 days in your browser; Meta and Google keep the data they receive under their own privacy policies (g) How a business came to sign up for Evrella (the campaign labels, the page the visit began on, the offer claimed and the answer to “How did you hear about Evrella?”): with the business's account for as long as it exists, and deleted with it; in our own analytics, linked only to internal account identifiers, for as long as we use them to compare how our marketing performs over time (h) A connected Google Calendar: the connected account’s email address and Google’s refresh token for as long as the calendar stays connected, deleted at once when it is disconnected in Evrella; busy times for at most a minute, in memory only; the events Evrella writes stay in the business’s own calendar, under its control (i) Evrella Social: a commenter’s data (the comment, their Facebook or Instagram id and display name, and the reply drafted to it) until 90 days after the reply to their comment is closed; all of it, the Page’s or account’s tokens included, is deleted when the business disconnects the Page or account or asks us to, and when Meta sends us a data-deletion request (j) A referral code: in the browser’s session storage only until the account is made or the tab is closed; on the organisation it was recorded on for as long as that organisation exists, and deleted with it (k) A business’s own WhatsApp number: each message 90 days after it was sent or received; the number’s access token until the business disconnects the number or removes our app in Meta, then deleted at once; bookings and leads the business keeps in its account for as long as the account exists
6. Your Rights
6.1Under the UK General Data Protection Regulation (UK GDPR) and, where it applies to you, the EU General Data Protection Regulation (EU GDPR), you have the following rights: (a) Right of access — request a copy of the personal data we hold about you (b) Right to rectification — request correction of inaccurate personal data (c) Right to erasure — request deletion of your personal data (d) Right to restrict processing — request that we limit how we use your data (e) Right to data portability — request your data in a structured, machine-readable format (f) Right to object — object to our processing of your personal data (g) Right to lodge a complaint — you may complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk, or, if you live or work in the European Union, to the supervisory authority there; in Italy that is the Garante per la protezione dei dati personali, at garanteprivacy.it
6.2To exercise any of these rights, please contact us at privacy@puglieseweb.com or at the address in section 12. We will respond within one month, as the law requires. Some rights have exceptions: for example, we keep the record of an agreement a business has made with us even if you ask us to erase your data, because we may need it to establish, exercise or defend legal claims.
8. Third-Party Services
8.1Our website integrates with third-party services that may collect information about you. Each service has its own privacy policy:
8.2We use the following third-party services: (a) Amazon Web Services (AWS) — cloud hosting and infrastructure (b) Google Analytics — website usage analytics with IP anonymisation; Microsoft Clarity — session recordings and heatmaps on evrella.com (c) Cloudflare Turnstile — CAPTCHA and bot protection (d) Our built-in booking system — appointment scheduling for discovery calls (e) Google — Sign in with Google, used to authenticate you if you choose that sign-in method (f) Apple — Sign in with Apple, used to authenticate you if you choose that sign-in method (g) Stripe — payments for our subscriptions (h) Sentry — error tracking in our product applications (i) Meta — its pixel, loaded through Google Tag Manager, for advertising measurement on our websites, only with your consent (j) Google Ads — its conversion tracking, loaded through Google Tag Manager, for advertising measurement on evrella.com and the Evrella console’s sign-up page, only with your consent
9. Children's Privacy
9.1Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly.
10. International Transfers
10.1Your personal data is mainly stored and processed in the United Kingdom (AWS eu-west-2, London). Some of it is processed elsewhere: email we receive is handled in Ireland (AWS eu-west-1); the AI model that writes the assistant's answers and Evrella Social's draft replies may run in any AWS region in the European Union that our inference profile covers; Sentry stores its data in the European Union; and Google Analytics, Google Tag Manager, Google Ads, Meta, Microsoft, Stripe and Cloudflare process data on their own global infrastructure.
10.2The United Kingdom recognises the countries of the European Economic Area as providing adequate protection. For any other country, we transfer personal data only under UK adequacy regulations, such as the UK Extension to the EU–US Data Privacy Framework for a recipient certified under it, or under a safeguard the UK GDPR recognises, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
11. Changes to This Policy
11.1We may change this Privacy Policy. Each version has a version identifier and the date it takes effect, both shown at the top of this page, and earlier versions remain available at their permanent addresses. If a change is material, we will also tell the people who hold an account with us by email before it takes effect.
12. Contact Us
12.1If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:
12.2PUGLIESEWEB LTD Registered office: 10 Upper Wheatfield, Hook, England, RG27 9YR Email: legal@puglieseweb.com Company No. 17078772, registered in England and Wales