CHEVORA OÜ · Privacy

Privacy Policy

How CHEVORA processes personal data

Effective 22 April 2026 · Version 1.0

1.Data Controller

Data Controller: CHEVORA OÜ · Reg. 17237686 · Sepapaja 6, Tallinn 15551, Estonia, EU · info@chevora.ai

Privacy enquiries: privacy@chevora.ai

2.Purpose of Processing

We process personal data solely for the purpose of providing verification services: document analysis, business verification, data reconciliation and due diligence. Identity documents are used exclusively as supporting evidence within the scope of the ordered verification. We also send a push notification to our mobile app to confirm your pre-order submission.

3.Legal Basis

Legal basis: GDPR Art. 6(1)(b) — performance of a contract. For special category data (identity documents): GDPR Art. 9(2)(a) — explicit consent.

4.Data Retention Schedule

Identity documents are deleted within 30 days of order completion. Audit records are retained indefinitely for compliance purposes.

Data CategoryRetention PeriodLegal Basis

Order data (name, email, company)5 yearsContract performance · AML requirements

Verification reports5 yearsContract performance · Client access

Uploaded documents (P1)30 days after orderData minimisation principle

Bitcoin OTS timestampsIndefinitelyCryptographic integrity · eIDAS

Payment dataNot storedStripe PCI DSS (not processed by CHEVORA)

Assistant / chat historyNot storedSession-only, not persisted

IP addresses, access logs, and aggregate site analytics (device type, approximate location, pages viewed, session duration)90 daysSecurity, fraud prevention, and site-traffic monitoring

Data may be deleted earlier upon a data subject request, unless retention obligations apply. Submit a request using the form below or email privacy@chevora.ai.

5.Processors

We use Supabase Inc. for data storage (server region: EU West, Ireland). Data Processing Addendum (DPA) signed 22 April 2026. No data transferred outside the EU.

Recipients and processing locations: Supabase (Ireland — encrypted storage; data processing agreement signed 22 April 2026), Hetzner (Germany — document processing and analysis), Stripe (payments; CHEVORA stores no card data), Mistral AI (France) and the hosting platform, whose deployment region is Frankfurt. All processing takes place within the EU. The processor register is available at privacy@chevora.ai. Data obtained from public registries: reports contain personal data about company directors and beneficial owners taken from official public registers, processed on the basis of legitimate interests (GDPR Art. 6(1)(f)); the information required by Art. 14 for that data is available at the same address. Automated decisions: a CHEVORA report supports a decision and is not itself an automated decision producing legal effects within the meaning of Art. 22.

6.Your Rights

Your rights under GDPR:

Right of access — request what data we hold about you
Right to rectification — correct inaccurate data
Right to erasure — request deletion before the retention period expires
Right to restriction of processing
Right to data portability
Right to object to processing
Right to withdraw consent at any time, without affecting processing already carried out

7.Supervisory Authority

Complaints: Estonian Data Protection Inspectorate (AKI) · aki.ee · UK data subjects may also complain to the Information Commissioner's Office (ICO) · ico.org.uk

8.Changes

We will notify you of material changes to this policy by email or via the platform.

Data Subject Access Request

To exercise your data subject rights, please complete the form below. We will respond within 30 days.