Privacy Policy

September 5, 2026

1. Overview and roles

This Privacy Policy explains how EVYNUM ("we", "us", or "our") collects, uses, discloses, and protects personal data when you visit https://www.orathos.com, create an Orathos account, install backup agents, or otherwise use the Orathos backup and disaster recovery platform (the "Service").

For account, billing, website, and Service administration data, EVYNUM generally acts as a controller (or "business" under certain US state laws). For personal data contained in systems, files, or applications you back up through the Service, you are typically the controller and EVYNUM acts as a processor, as further described in our Data Processing Agreement.

By using the Service, you acknowledge this Privacy Policy. If you do not agree, do not use the Service.

2. Personal data we collect

We collect information you provide directly, information generated through use of the Service, and information from third parties where permitted.

Account and profile data: name, email address, organization, role, authentication credentials, team membership, and communication preferences.
Billing and transaction data: subscription plan, invoices, payment status, billing address, tax identifiers where provided, and limited payment metadata processed by Stripe. We do not store full payment card numbers on our servers.
Service and technical data: backup job metadata, agent identifiers, hostnames, IP addresses, device and operating system information, logs, timestamps, configuration settings, API usage, audit events, support tickets, and security signals.
Customer content metadata: file paths, sizes, checksums, encryption metadata, retention settings, restore history, and related operational data necessary to provide backup and disaster recovery functionality. Depending on your configuration, backup payloads may reside in EVYNUM-managed infrastructure or in BYOS storage you control.
Website and marketing data: pages viewed, referral source, cookie identifiers, and similar usage analytics where enabled.

3. How we use personal data

We use personal data to provide, operate, secure, and improve the Service; authenticate users; process subscriptions; deliver notifications and service communications; investigate abuse; comply with law; and enforce our terms and policies.

We may use aggregated or de-identified data for analytics, capacity planning, reliability engineering, and product development. We do not sell personal data.

We may send transactional messages about the Service. Where permitted by law, we may send product updates or marketing communications with your consent or as otherwise allowed, and you may opt out of non-essential marketing emails.

4. Legal bases for processing (EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we process personal data on one or more of the following legal bases: performance of a contract, legitimate interests (such as securing the Service, preventing fraud, and improving reliability, balanced against your rights), compliance with legal obligations, and consent where required.

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

5. Sharing, subprocessors, and disclosures

We share personal data with service providers that help us deliver the Service, including hosting providers, email delivery vendors, payment processors such as Stripe, monitoring and security vendors, and customer support tools. These providers are authorized to process personal data only as necessary to perform services for us and subject to contractual safeguards.

We may disclose personal data if required by law, regulation, legal process, or governmental request; to protect the rights, property, or safety of EVYNUM, our customers, or others; or in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate protections.

A current list of key subprocessors is available on request at support@orathos.com. We remain responsible for subprocessors processing personal data on our behalf to the extent required by applicable law.

6. International transfers

EVYNUM is based in the United States. Personal data may be processed in the United States and other countries where we or our subprocessors operate. These countries may have data protection laws different from those in your jurisdiction.

Where required by applicable law, we implement appropriate safeguards for international transfers, including Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum, supplemented by additional measures where appropriate.

Enterprise customers may request transfer details or a signed Data Processing Agreement at support@orathos.com.

7. Retention and deletion

We retain personal data for as long as necessary to provide the Service, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce agreements.

Backup metadata, audit logs, and billing records may be retained for longer periods where required for security, accounting, or legal compliance. When you delete your account or request deletion, we will take reasonable steps to delete or anonymize personal data, subject to backup systems, legal holds, and technical limitations.

8. Security

We implement technical and organizational measures designed to protect personal data, including encryption in transit and at rest, role-based access controls, multi-factor authentication options, audit logging, and vulnerability management. Details are described in our Security Policy.

No method of transmission or storage is completely secure. You are responsible for safeguarding your credentials, API tokens, encryption keys, and access to systems where agents are installed.

9. Your privacy rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to data portability where applicable.

Residents of the EEA, UK, and Switzerland may lodge a complaint with a supervisory authority. US state privacy laws may provide additional rights, including the right to know, delete, correct, and opt out of certain processing in some circumstances.

To exercise rights relating to account or billing data, contact support@orathos.com. For personal data contained in backed-up systems where you are the controller, direct requests to your organization in the first instance; we will assist our customers as required by our Data Processing Agreement and applicable law.

10. Children and changes to this policy

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Material changes will be posted on https://www.orathos.com with an updated effective date. Continued use of the Service after changes become effective constitutes acceptance of the revised policy.

Privacy inquiries: support@orathos.com.