CHEVORA OÜ · Privacy

Privacy Policy

How CHEVORA processes personal data

Effective 22 April 2026 · Version 1.0

1.Data Controller

Data Controller: CHEVORA OÜ · Reg. 17237686 · Sepapaja 6, Tallinn 15551, Estonia, EU · info@chevora.ai

Privacy enquiries: privacy@chevora.ai

2.Purpose of Processing

We process personal data solely for the purpose of providing verification services: document analysis, business verification, data reconciliation and due diligence. Identity documents are used exclusively as supporting evidence within the scope of the ordered verification.

3.Legal Basis

Legal basis: GDPR Art. 6(1)(b) — performance of a contract. For special category data (identity documents): GDPR Art. 9(2)(a) — explicit consent.

4.Data Retention Schedule

Identity documents are deleted within 30 days of order completion. Audit records are retained indefinitely for compliance purposes.

Data CategoryRetention PeriodLegal Basis

Order data (name, email, company)5 yearsContract performance · AML requirements

Verification reports5 yearsContract performance · Client access

Uploaded documents (P1)30 days after orderData minimisation principle

Bitcoin OTS timestampsIndefinitelyCryptographic integrity · eIDAS

Payment dataNot storedStripe PCI DSS (not processed by CHEVORA)

Assistant / chat historyNot storedSession-only, not persisted

IP addresses, access logs, and aggregate site analytics (device type, approximate location, pages viewed, session duration)90 daysSecurity, fraud prevention, and site-traffic monitoring

Data may be deleted earlier upon a data subject request, unless retention obligations apply. Submit a request using the form below or email privacy@chevora.ai.

5.Processors

We use Supabase Inc. for data storage (server region: EU West, Ireland). Data Processing Addendum (DPA) signed 22 April 2026. No data transferred outside the EU.

6.Your Rights

Your rights under GDPR:

Right of access — request what data we hold about you
Right to rectification — correct inaccurate data
Right to erasure — request deletion before the retention period expires
Right to restriction of processing
Right to data portability
Right to object to processing

7.Supervisory Authority

Complaints: Estonian Data Protection Inspectorate (AKI) · aki.ee · UK data subjects may also complain to the Information Commissioner's Office (ICO) · ico.org.uk

8.Changes

We will notify you of material changes to this policy by email or via the platform.

Data Subject Access Request

To exercise your data subject rights, please complete the form below. We will respond within 30 days.