HelpGo to Evolve

Privacy policy

Effective from July 14, 2026

This policy explains how the Evolve mobile app for iOS and Android and its connected services collect, use, disclose, retain, and delete personal data.

Who we are and how to contact us

For the purposes of the General Data Protection Regulation and other applicable privacy laws, the controller for the Evolve service is:

UNIC Evolve Ltd

46 Makedonitissas Avenue, CY-2417

P.O. Box 24005, CY-1700

Nicosia, Cyprus

+357 22 841 528

UNIC Evolve Ltd operates Evolve for the University of Nicosia. The Evolve mobile app may appear in the Apple App Store and Google Play under the University of Nicosia developer account.

Questions about the app or an account-deletion request can be sent to evolve@unic.ac.cy. Privacy-rights enquiries can also be sent to the Data Protection Officer below.

Data Protection Officer contact details:

A. & E. C. Emilianides, C. Katsaros & Associates LLC

192 Ledras, 3rd Floor,

1011 Nicosia, Cyprus

Tel: +357 22 676752

Fax: +357 22 676754

E-mail: gdpr@ekllc.eu

How Evolve handles personal data

1. Scope

This policy applies to the Evolve mobile app, the Evolve account used to sign in, and the Evolve services reached through the app. It covers personal data collected directly from you, provided by the University of Nicosia or another participating organisation, generated when you use the app, or received from a service you choose to connect.

A participating organisation may separately control official student, employment, research, or administrative records under its own notices and retention policies. External websites and services that you choose to open or connect have their own privacy policies.

2. Information we collect

The information collected depends on the features you use. It may include:

© 2026 UNIC Evolve Ltd.
TermsPrivacyCookies
ContactStatusReleases
Account and profile information, such as your name, email address, user handle, organisation, memberships, roles, preferences, and account status.
  • Authentication and security information, such as session identifiers, verification status, multi-factor authentication or passkey status, and security events. Passwords are processed for authentication and are not stored in readable form by the mobile app.
  • Content you provide, such as prompts, chat messages, Team Chat messages, feedback, files, documents, images, audio files, and other attachments.
  • Photos or images you select from your library or capture with the camera when you choose to attach them to an Evolve request.
  • Connected-service information when you choose to connect a service such as GitHub or an organisation-provided tool, including the service account identifier, authorisation token, and the content or action you request through that connection.
  • Technical and usage information, such as IP address, device and operating-system information, app version, route or feature used, timestamps, request identifiers, crash data, performance traces, logs, and interaction breadcrumbs.
  • Diagnostic session replay through Datadog. A sample of sessions may record privacy-masked screen structure and interaction information so that faults can be reproduced. Diagnostic events may be linked to an account or device identifier when you are signed in.

    • 3. Camera, photos, files, and device permissions

    Evolve asks for camera or photo-library access only when you use a feature that needs it. For example, you may take a photo of a document or choose an existing image and attach it to an AI Studio request. Granting permission does not by itself upload a photo; the selected or captured item is transmitted only when you choose to attach or upload it.

    You can deny or later withdraw a device permission in your device settings. Some attachment features will not work without the relevant permission, but other app features remain available.

    The current mobile app does not access your contacts, does not access the device microphone or record audio, and does not use an advertising SDK or an advertising identifier for advertising. The current app does not collect precise or approximate device location. A file you deliberately select and upload may itself contain audio, location metadata, or other information chosen by you.

    4. How we use information

    We use personal data only where needed to provide, secure, support, and improve Evolve, comply with law, and administer participating organisations' access to the service.

    • Create and administer your account, authenticate you, maintain your session, and apply the correct organisation, role, and permissions.
    • Provide AI Studio, Team Chat, file, content, collaboration, and connected-service features that you request.
    • Process prompts and attachments, return generated responses, and preserve conversation history where the feature provides history.
    • Protect users and the service, prevent misuse, investigate incidents, enforce access controls, and maintain audit and security records.
    • Diagnose crashes and errors, monitor reliability and performance, and improve the app and its services.
    • Respond to support, privacy, access, correction, and deletion requests.
    • Meet legal, regulatory, contractual, accreditation, employment, and institutional record-keeping obligations where applicable.

    5. AI features

    When you use an AI feature, the prompt, relevant conversation history, selected files or images, and necessary request metadata are processed by Evolve and may be sent to the AI model provider selected for that request. Providers available through Evolve may include OpenAI, Anthropic, Google, AWS-hosted models, Groq, OpenRouter, xAI, Cerebras, or other organisation-approved providers.

    Do not submit personal, confidential, or sensitive information that is not needed for your request. AI output can be inaccurate and should be checked before it is relied upon. Evolve-generated output is not used by itself to make a legal or similarly significant decision about you.

    6. When information is disclosed

    We do not sell personal data and do not use personal data for third-party advertising. Information may be disclosed only as needed for the purposes described in this policy:

    • To the University of Nicosia or another participating organisation where it administers your account, access, workgroup, course, employment, research, or institutional records.
    • To cloud, authentication, storage, security, support, and infrastructure providers, including Amazon Web Services and Amazon Cognito.
    • To Datadog and other approved observability providers for crash reporting, diagnostics, security, and performance monitoring.
    • To the AI model provider used for a request and to a connected external service when you initiate that use.
    • To professional advisers, regulators, courts, law-enforcement authorities, or other recipients where disclosure is required by law or necessary to protect legal rights and safety.

    Service-provider protections

    Service providers are required to process personal data for the authorised service, apply appropriate confidentiality and security protections, and provide protection consistent with this policy and applicable law. Their own terms may also apply when you independently connect or direct Evolve to use their service.

    7. Security

    We use technical and organisational measures appropriate to the nature of the data and the risks involved. These include encrypted network transport, secure device storage for authentication tokens, access controls, environment separation, audit and security logging, and restricted service credentials. No method of storage or transmission can be guaranteed to be completely secure.

    You are responsible for protecting your password, device access, and any connected-service credentials. Contact evolve@unic.ac.cy if you believe your account or device has been compromised.

    8. Retention

    We retain account information and user content for as long as the account or relevant feature is active, and then for only as long as needed for the purposes described in this policy. Operational logs, security records, diagnostics, and backups are retained according to applicable operational schedules and are deleted, anonymised, or overwritten when no longer needed.

    Official academic, employment, research, financial, accreditation, safeguarding, legal-hold, security, or audit records may be retained by UNIC Evolve Ltd, the University of Nicosia, or another participating organisation where law or institutional obligations require it. These retained records are restricted to the applicable purpose and are not treated as an active Evolve login.

    Team Chat content under a legal, safety, moderation, or quarantine hold may be retained for the duration of that hold. Other authored Team Chat content is redacted as part of account deletion. Retention periods may therefore differ by data category and legal context.

    9. Account deletion and data deletion

    You can initiate deletion in the mobile app from Settings, Account, Delete account. The app asks you to confirm the request and re-enter your password. When the request is accepted, the Evolve login is removed, active sessions are revoked, and associated personal app content is queued for deletion or redaction. Content removal may finish asynchronously after the login has been removed.

    For an account without a current institutional affiliation, identifying profile fields are anonymised and app preferences, memberships, contact links, files, AI Studio conversations, and other associated personal app content are deleted or redacted.

    For a student, faculty, staff, or other institutionally affiliated account, the Evolve login and personal app content are deleted or redacted, but official institutional identity, membership, academic, employment, research, audit, legal-hold, or other records may be retained where required by law or institutional policy. Retained records cannot be used to sign in to the deleted Evolve account.

    If you cannot access the app, you may request account and associated-data deletion by email. Send the request from the email address registered to the account where possible, identify the Evolve account to be deleted, and do not include your password. We may need to verify your identity before acting. We will tell you if more time is required or if specific records must be retained.

    • Request Evolve account deletion by email

      Use this option if you cannot access the in-app deletion flow.

    10. Your choices and privacy rights

    Depending on applicable law, you may ask to access, correct, erase, restrict, or receive a portable copy of your personal data, or object to particular processing. You may withdraw consent where processing is based on consent. Withdrawing consent does not affect processing that was lawful before withdrawal or processing based on another lawful ground.

    You can change camera and photo permissions in device settings, disconnect optional external services, delete content through available app controls, or delete your account as described above. To exercise another privacy right, contact the Data Protection Officer. We normally respond within one month, subject to lawful extensions and identity verification.

    You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or the competent supervisory authority in your country.

    • Contact the Data Protection Officer

    11. International transfers

    Some service providers or AI model providers may process data outside Cyprus or the European Economic Area. Where required, transfers are protected through an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism, together with appropriate technical and organisational measures.

    12. Children

    Evolve is an education and work platform intended for authorised users of participating organisations. It is not directed to children as a general consumer service. Where an authorised user is a minor, the participating organisation and UNIC Evolve Ltd apply the consent, notice, and safeguarding requirements that are applicable to that user and service.

    13. Changes to this policy

    We may update this policy when the app, its service providers, or legal requirements change. The date at the top shows when it was last updated. Material changes will be communicated through the app, the service, or another appropriate channel before they take effect where required.