Privacy Policy

Evana Inc. ("Evana," "we," "us," or "our") helps businesses recover duties paid on imports, through duty drawback and IEEPA tariff refunds, and understand their import data. This Privacy Policy explains what personal information we collect through our website, platform, and services (together, the "Services"), how we use and share it, and the choices you have.

We handle personal information in two roles:

• For our own purposes. Information about website visitors, prospective clients, and the people who use our platform. This policy describes how we handle it.
• On behalf of our clients. The customs records, documents, and order and shipment data our clients give us so we can provide the Services, including information about our clients' own customers. We process this information for the client, under our agreement with that client. See Information we process for our clients.

Information you give us

• Contact and account details: name, email address, phone number, company name, job title, and password. We store passwords only as one-way hashes, never in a form we can read.
• Business and customs records: entry summaries (CBP Form 7501), commercial invoices, packing lists, bills of lading, proof of export and delivery records, inventory, manufacturing, and accounting records, and details of the duties, taxes, and fees you paid. These records include business identifiers such as your importer of record number.
• Signed documents: when you sign a non-disclosure agreement, engagement letter, or power of attorney with us, we and our electronic signature provider keep the signed document along with the signer's name and email address and the internet address and browser details used to sign it. We also keep the company details that go into those documents, such as legal name, entity type, and address.
• Payment information: card payments are handled by Stripe, and we do not receive or store full card numbers. If we pay out refunds to you, we keep the bank account details you give us for that purpose.
• Communications: what you send us by email, through our forms, or by phone, meetings you book with us, and newsletter sign-ups.

Information from systems you connect and other sources

• Store, warehouse, and order systems you connect, such as Shopify, TrackStar, and Nimble: orders, shipments, returns, products, and receiving records. These can include your customers' names, shipping addresses, email addresses, and phone numbers.
• U.S. Customs and Border Protection: reports from Customs' Automated Commercial Environment that you send us or authorize us to receive, and correspondence with Customs about your claims.
• Single sign-on: if your company signs in to Evana through its own identity provider, we receive your name and email address from it.

Information collected automatically

• Device and usage information: internet address, browser, operating system, the pages you view, the links you click, and the page that sent you to us.
• Sign-in records: the email address, internet address, and browser details of each attempt to sign in, which we use to protect accounts.
• Cookies and similar technologies. See Cookies, analytics, and advertising.

• To provide the Services: preparing, filing, and tracking duty drawback claims and IEEPA tariff refunds, analyzing your imports, and reading the documents you upload;
• To communicate with you about your account, your claims, and our Services, and to respond to your questions and requests;
• To send newsletters and information about our Services, which you can stop at any time;
• To understand how our website is used and to measure and improve our advertising;
• To keep the Services secure, protect accounts, prevent spam and fraud, and enforce our Terms of Service; and
• To comply with the law, including the recordkeeping rules that apply to customs and drawback claims.

We never use the customs records, documents, or customer data our clients give us for advertising.

We use artificial intelligence services to read and organize the documents you give us, for example to recognize what kind of document it is and to pull out entry numbers, product codes, quantities, and values. Our providers for this are Anthropic (Claude) and Reducto. Every request our platform sends to Anthropic is set to be processed in the United States. These providers process documents under their own commercial terms.

Our team also uses Anthropic's Claude as a work assistant, which can include reviewing client data to prepare and check claims.

We share personal information only as described below.

• With U.S. Customs and Border Protection and other government agencies, as needed to file and manage your claims and refunds.
• With companies that provide services to us, only as needed for those services:
  • Hosting, databases, and file storage: Render, Neon, Amazon Web Services, and Snowflake;
  • Reading documents: Anthropic and Reducto;
  • Data analysis: contextflo;
  • Email and team messaging: Google Workspace, Resend, and Slack;
  • Electronic signatures: DocuSeal;
  • Payments and banking: Stripe and Mercury;
  • Scheduling: Calendly;
  • Spam and bot protection: Cloudflare; and
  • Website analytics and advertising: Google and Meta (see Cookies, analytics, and advertising).
• With systems and people you direct us to, such as the store or warehouse systems you connect.
• For legal reasons: to comply with a law, court order, or government request, and to protect the rights, property, or safety of Evana, our clients, or others.
• In a business transfer: if Evana is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction.

We do not sell personal information for money. Our use of Google's and Meta's advertising tools on our website, described below, may count as "sharing" personal information for targeted advertising under some state privacy laws, such as California's. You can opt out as described in Your choices and rights.

Cookies are small files a website stores in your browser. We use cookies that are needed to sign you in and keep the Services working. On our public website pages, including the sign-up and onboarding pages for our IEEPA refund service, we also use the analytics and advertising tools below. These tools do not load inside the client dashboard or on our sign-in and password-reset pages.

• Google Analytics shows us how visitors use our website. Learn how Google uses this information at policies.google.com/technologies/partner-sites.
• Google Ads tells us which of our Google ads led to a visit, a form, or a sign-up.
• Meta Pixel does the same for our ads on Facebook and Instagram. When you submit a form, sign up, or complete a step of IEEPA onboarding, our server also sends Meta a scrambled (hashed) copy of your email address, along with your internet address and browser details, so Meta can match the event to its ads.
• Cloudflare Turnstile checks that forms are filled in by people, not bots.
• Calendly collects the details you enter when you book a meeting with us.

Your options

• Global Privacy Control. If your browser sends this signal (learn more at globalprivacycontrol.org), we treat it as a request to opt out: we do not load Google Ads or the Meta Pixel for you, our server sends nothing about you to Meta, and Google Analytics runs with Google's advertising features turned off.
• Browser settings. You can block or delete cookies in your browser. Blocking cookies needed to sign in will stop parts of the Services from working.
• Google and Meta settings. You can opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout, manage Google ads at myadcenter.google.com, and manage Meta ads at facebook.com/adpreferences.
• Do Not Track. There is no common standard for the older "Do Not Track" browser setting, so our website does not respond to it. We do honor Global Privacy Control, as described above.

Our clients give us their records, and connect their store and warehouse systems, so we can prepare their claims. These records can include personal information about our clients' own customers and contacts, such as the names and shipping addresses on orders and delivery records, and sometimes email addresses and phone numbers. We use this information only to provide our Services to that client.

If you are a customer of one of our clients and have a question or request about your information, please contact that business directly. If you contact us instead, we will pass your request to the business and help them respond.

• Claim and customs records, including the client data used in a claim: at least three years after the claim is paid, as federal drawback rules require (19 C.F.R. § 190.15), and for as long as we work with the client.
• Account information: while your account is open, and afterwards as long as we need it for legal, tax, and accounting purposes or to resolve disputes.
• Sign-in records: 180 days.
• Marketing and inquiry information: until you ask us to delete it or stop contacting you.

We encrypt information sent between your browser and the Services, we store passwords only as one-way hashes, only a small number of Evana staff can access client data, and we require two-step verification on the accounts we use to run our systems. Companies can have their team sign in to Evana through their own identity provider.

No system is perfectly secure, and we cannot guarantee that information will never be accessed without permission. If we learn of a security incident that affects your personal information, we will notify you as the law requires.

• See, correct, delete, or get a copy of your information: email us at michael@evana.app. We will confirm your identity and respond within 45 days. If the law requires us to keep some information, such as drawback claim records, we will tell you what we kept and why.
• Stop marketing emails: use the unsubscribe link in the email, or email us. We will still send messages about your account and claims.
• Opt out of ad tracking: see the options under Cookies, analytics, and advertising.

Depending on where you live, including California, Colorado, Connecticut, Virginia, and other states, you may have the right to know what personal information we have about you, to correct it, to delete it, to get a copy of it, and to opt out of its "sale" or "sharing" for targeted advertising. To use any of these rights, email us at michael@evana.app. You may also have someone you authorize make a request for you. We will not treat you differently for using your rights. If we decline your request, you can appeal by replying to our decision, and if you are not satisfied with the outcome, you can contact your state attorney general.

Evana is based in the United States, and we run the Services from the United States. Some of the companies that provide services to us may process information in other countries. If you use the Services from outside the United States, your information will be transferred to the United States.

The Services are for businesses and are not meant for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will post the new version on this page with a new "Last updated" date. If we make a material change, we will also email account holders before the change takes effect.

For questions about this Privacy Policy or to make a privacy request, email Evana Inc. at michael@evana.app.