Privacy Policy

Last updated 27 October 2026.

Evolamate ("we", "us") provides AI-generated marketing content and marketing automation for Australian businesses. Evolamate is a product of SkilliHire (ABN 61 661 477 964), of Sydney, Australia. This is an early-stage product. Please read this policy with that in mind, and contact us with any questions before signing up.

What we collect

  • Account details: your email address and password. Your password is stored securely by our authentication provider, Supabase. We never see it in plain text.
  • Business details you provide: business name, industry, website URL, location and service areas, marketing objective and automation preferences.
  • Publicly available text from your business website, fetched to ground the research we generate about your business.
  • Anything you add yourself: your logo and product photos, corrections and additions to what we have learned about your business, competitors you ask us to look at, and customer messages you enter or import.
  • Documents you upload (company profiles, brochures, service lists, price guides). We read the words in a document to understand your business and we keep the extracted text and facts. We do not keep the file itself, and there is nothing to download it back from. Evolamate is not a document storage service.
  • Content we create on your behalf: research summaries, strategy, post captions, generated images and derivative creatives, campaign plans, proposed ad campaigns, recommendations and monthly reviews.
  • Access tokens for the social accounts you connect, so we can publish on your behalf. These are stored encrypted (AES-256-GCM).
  • A record of what was published, where, and whether it succeeded, including posts you tell us you published yourself.
  • Publicly available information about competitors you nominate, fetched from their public websites to produce market analysis. We do not collect personal information about individuals from competitor sites.
  • Questions you ask the advisor ("Ask Evolamate") and the answers, kept so the conversation has context.
  • Billing details are collected and held by Stripe, our payment provider. We never see or store your full card number.
  • Where you signed up from: when you create your account we estimate your approximate town and country from your internet (IP) address, using the IP lookup service ipinfo.io, and note how you found us (for example a search engine, a social site or a campaign link, from our own visit counter). We keep the town, country and source on your account, not your IP address, and use them only to understand where our customers come from.

How we use it

To research your business, plan your marketing, generate, store, schedule and publish the content you ask for, classify and draft replies to customer messages, propose campaigns, run your subscription, and email you about your account. We record the AI model, token and image usage of each operation so we can monitor cost and quality. We do not sell your data, and we do not use it to train any AI model.

Publishing to your social accounts

When you connect a Facebook Page, you authorise us to publish on your behalf. Once you approve a post, we send its text and image to Facebook, and to Instagram if your Page has an Instagram business account linked. This is a real transfer of your content and images to Meta, governed by Meta's own terms and privacy policy once it arrives. Nothing is ever sent without your approval, unless you have explicitly switched your account to Autopilot mode, in which case content is published under the rules you set and you can stop it at any time from the Planner or Settings.

LinkedIn Company Pages and Google Business Profile can also be connected for publishing where the platform has granted us API access. Where access is not yet available for your account, posts are prepared for you to publish yourself. Medium and Reddit content is prepared for manual publishing. Disconnecting an account stops all future publishing to it and removes the stored access token. Content already published stays on the platform; only you can remove it there.

YouTube and Google API data

Evolamate uses YouTube API Services. When you connect a YouTube channel you sign in with Google and grant two permissions: to upload videos to your channel (youtube.upload) and to read your channel's basic details (youtube.readonly). By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

  • What we access: your channel ID, channel name and handle, so the Channels page shows which channel is connected; the ability to upload a video you have approved in Evolamate; and, for the videos you uploaded through Evolamate only, their title, thumbnail and public counts (views, likes and comments).
  • How we use it: to publish the videos you choose to post, with the title, description and privacy you set; to link you to the published video; and to show how those videos are doing in Insights, so Evolamate can learn what works for your business. We do not read, download or analyse your channel's other videos, comments, subscribers or any other channel data.
  • What we store, and for how long: the encrypted access and refresh tokens (AES-256-GCM), your channel ID and name, the ID and link of each video we published for you, and that video's title, thumbnail link and latest view, like and comment counts. Nothing else from your Google account is stored. We re-read your channel details and those videos' counts from YouTube every day; anything we have not been able to refresh for 30 days is deleted, a video you delete on YouTube is removed from Evolamate at the next daily check, and if you revoke our access or disconnect YouTube we delete the tokens and all of these figures immediately. Access tokens themselves expire after an hour.
  • Who we share it with: nobody. YouTube data is not shared with or sold to anyone, and it is not used for advertising.
  • Revoking and deleting: press Disconnect on the YouTube card in Channels and we revoke our access with Google and delete the stored tokens immediately. You can also remove Evolamate at any time from your Google Account permissions page. Deleting your Evolamate account deletes all of this. Videos already published stay on your channel until you remove them there.

Evolamate's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data obtained through Google APIs to develop, improve or train generalised AI or machine-learning models.

Google Ads

If you connect a Google Ads account, you sign in with Google and grant Evolamate access to manage your Google Ads account (the adwords permission). We read your account's name, ID and currency, and your campaigns' names, types, status and results (impressions, clicks, cost and conversions), to show them on your Ads page and help plan your marketing. We store the encrypted access and refresh tokens and the latest 30 days of those results, refreshed every day. We do not change, create or spend anything in your Google Ads account without your explicit approval in Evolamate. Press Disconnect on the Ads page to revoke our access with Google and delete everything we stored; you can also remove Evolamate from your Google Account permissions page. Google Ads data is not shared or sold, and, like all data from Google APIs, its use follows the Google API Services User Data Policy, including the Limited Use requirements, and is never used to train AI models.

TikTok

When you connect TikTok you log in with TikTok and allow Evolamate to read your basic profile (display name, username, avatar and profile link) and to post videos you approve to your account. Before each post you choose who can see it, whether comments, duets and stitches are allowed, and whether the video is promotional; nothing is posted without your action. We store the encrypted access and refresh tokens, your TikTok account ID and name, and the ID of each post we made for you. If you allow it when connecting, we also read the view, like, comment and share counts of the videos Evolamate posted for you (never your other videos) and your follower count, once a day, to show results in Insights and learn what works for your business; these are refreshed daily, removed when a video is deleted, deleted after 30 days without a refresh, and deleted at once when you disconnect. Press Disconnect on the TikTok card to revoke our access and delete the tokens, or remove Evolamate in the TikTok app under Settings and privacy, Security, Manage app permissions. TikTok's handling of your data is governed by the TikTok Privacy Policy.

Customer engagement (comments, messages and reviews)

If you use the Inbox, Evolamate collects comments, messages and reviews sent to your connected accounts, along with the sender's name and platform identifier, timestamps, and the reply history you create. A person who comments on or messages your account did not sign up to Evolamate; this data is collected because they interacted with your own business account, the same way it would already be visible to you directly on the platform.

We may generate an AI-suggested reply from this data, grounded in your own business information, and we may recognise an enquiry as a sales lead and track its status for you. In the Inbox, Evolamate never sends a reply automatically; every reply requires you to review it and choose to send it. WhatsApp, described below, is the only place a business can opt in to automatic replies, on the Growth and Agency plans and only for the topics it chooses.

Comments, messages and reply history are retained for 180 days from when we receive them, then removed automatically. Post- and account-level performance figures are retained for 24 months. Disconnecting stops new collection but does not delete history already collected. You can delete that history on its own at any time from Settings, separately from disconnecting or deleting your account.

Who we share it with

Your data is processed by the providers we run on. Each processes data on our behalf under its own security and privacy commitments; none of them uses your data for its own purposes.

  • Supabase: database, authentication and file storage.
  • Microsoft Azure: hosting of the application and background workers, AI text and image generation, and transcribing WhatsApp voice notes.
  • Stripe: subscription billing and payment details.
  • Brevo: sending the emails we send you.
  • ipinfo.io: receives your IP address once, when you create your account, and returns your approximate town and country.
  • Meta (Facebook and Instagram): receives the content and images you approve for publishing, and is the source of any comments or messages the Inbox collects.
  • LinkedIn and Google: receive your authorisation and, where API access is granted, the content you approve for publishing to those platforms.
  • YouTube (Google) and TikTok: receive the videos, titles and captions you approve for publishing to your own channel or account.
  • Threads (Meta): receives the posts you approve, and is the source of replies the Inbox collects.
  • WhatsApp (Meta): carries the messages between a business's connected number and its customers, and receives the message templates the business submits.
  • GitHub: hosts our source code and deployment pipeline. No customer data is stored there.

How we protect your data

We treat the access tokens for your connected accounts (Google/YouTube, Meta, LinkedIn, TikTok), your customers' messages and your account details as sensitive data, and protect them with the measures below.

  • Encryption in transit: every connection to Evolamate and between Evolamate and the platforms it works with uses HTTPS (TLS). We never accept or send your data over an unencrypted connection.
  • Encryption at rest: access and refresh tokens for connected accounts are encrypted by our application with AES-256-GCM before they are stored, using a key held separately from the database. The database, file storage and backups are also encrypted at rest by our hosting providers (Supabase and Microsoft Azure, AES-256).
  • Tokens never reach your browser: tokens are decrypted only on our servers, at the moment a post is published or data is fetched, and are never sent to the browser or written to logs.
  • Separation between customers: database row-level security limits every query from the app to the business it belongs to, so one customer can never read another's data. Actions that bypass it run only in server code after checking that the signed-in person belongs to that business.
  • Least-privilege access: we request only the permissions each feature needs (for YouTube, upload and read-your-channel only). Inside Evolamate, team roles limit what each member of your business can do. Administrative access is limited to named staff by role, and every administrative action is recorded in an audit log.
  • Secrets management: encryption keys, API keys and app secrets are stored as protected secrets in our hosting environment, never in our source code.
  • Passwords and payments: passwords are held only as salted hashes by our authentication provider (Supabase); card details are handled entirely by Stripe and never touch our servers.
  • Backups: the database is backed up nightly to encrypted storage in Microsoft Azure's Australia East region, kept for 35 days and then deleted automatically.
  • Revocation and deletion: disconnecting a channel deletes its stored tokens immediately and, for Google and TikTok, revokes our access with the platform; deleting your account removes your data as described below.
  • If something goes wrong: if we become aware of a data breach that is likely to cause serious harm, we will contain it, notify affected customers promptly and notify the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Meta (Facebook, Instagram, Threads and WhatsApp) platform data

When you connect a Facebook Page, its linked Instagram professional account, or Threads, we receive and store the Page, account and profile IDs and names, encrypted access tokens, the posts we publish for you, and, if you use the Inbox and Insights, comments, direct messages and replies on your own accounts with the sender's name and ID, and post and account performance figures. We use this data only to publish what you approve, to show you your messages and results, and to draft replies you choose to send. We do not sell it, share it with advertisers or data brokers, or use it to train AI models.

Messages and comments are kept for 180 days and performance figures for 24 months, then deleted automatically. To delete Meta data: press Disconnect in Channels (tokens are deleted immediately), use Settings to delete your inbox history or your whole account, or remove Evolamate from your Facebook or Threads settings, which sends us a deletion request that we act on automatically. Instructions and status are on our data deletion page.

WhatsApp messages. Meta has approved Evolamate's WhatsApp access, and WhatsApp is available to every business. When a business connects a WhatsApp Business number (through Meta's Embedded Signup), we receive and store the number's account and phone-number IDs, an encrypted access token, and the messages sent to and from that number: the text, each customer's phone number and WhatsApp profile name, and timestamps. Photos customers send are stored with the chat and read by AI so the reply makes sense. Voice notes are transcribed and kept as text only; the audio is not kept. If the business keeps the number on the WhatsApp Business app, Meta also shares the number's contacts and up to six months of earlier chats, which we bring in so the assistant has context.

We use this data only for the business that connected the number: to show its chats, draft replies (and, where that business has switched on automatic replies, send them), create and track leads, and send the follow-ups, review requests and reminders it sets up. A customer can reply STOP to stop those messages. A person who messages a business on WhatsApp did not sign up to Evolamate; their data is collected because they messaged that business, it is never shared with another business, and it is not used to train AI models. WhatsApp messages, photos and transcripts are kept for 180 days, the same as Inbox messages, then deleted automatically. Disconnecting WhatsApp stops Evolamate reading and replying, discards the access token and cancels pending follow-ups; chats already collected stay until they reach 180 days or you delete your inbox history in Settings, and deleting your account removes them. Messages sent through WhatsApp are also governed by Meta's WhatsApp Business terms and policies.

Lead results sent to your own Meta ad account (Conversions API). On plans that include advertising, when you move a lead on your Leads board (for example to Qualified or Won) we send that stage, and the value of a won job, to the Meta dataset on your own ad account, so your ads learn who your real customers are. The lead's email, mobile, name, suburb and postcode are normalised and hashed (SHA-256) before they are sent; they are never sent in clear, and a lead with no email or mobile is not sent at all. You are the business that collected these details and decides to use them for advertising, so your own privacy notice to your customers should say so. Never record health or other sensitive information in a lead.

Data retention and deletion

We keep your data for as long as your account is active. Generated media (master images and channel derivatives) is retained for 75 days, after which it is removed automatically while the structured record of what was created and published is kept. You can delete your account yourself at any time from Settings. Doing so removes your business, every generated post, every generated image, your uploaded logo and photos, the document text you added and everything we learned from it, your connected-account tokens, your inbox and leads, and your usage history, and then deletes your login. If any part of that cannot be completed, we stop and tell you rather than reporting a deletion that did not happen.

You can also remove a single document from the Business page without deleting your account. Doing that immediately removes the facts we extracted from it, and Evolamate stops using them for any new content. Posts already written are not rewritten. You can email us to request a copy of your data.

Where your data is held

Our primary database and authentication (Supabase) run in the ap-southeast-2 region (Sydney, Australia). Our application runs on Microsoft Azure in the Australia East region (Sydney).

We use Microsoft Azure for AI-generated text and images. Our text models are configured in the Australia East region; our image-generation model is configured in a United States region because Microsoft does not offer it in Australia. Some deployments use Azure's "Global Standard" service tier, which by Microsoft's design may route processing to any Azure datacentre with available capacity. In practice this means the prompts and content you submit for a caption or image may be processed outside Australia as part of how Microsoft operates this service.

Stripe (payments), Brevo (email), ipinfo.io (approximate location at signup, United States), and Meta, LinkedIn and Google (once you connect or approve publishing to them) also process data overseas as part of how those services work, regardless of where our own database sits. We are still confirming the exact overseas-disclosure terms for these providers with a legal reviewer.

What this policy does not yet cover

We would rather tell you what is missing than imply it is settled. This policy does not yet set out our position under the Privacy Act 1988 and the Australian Privacy Principles in full, or a formal complaints procedure. Those are with a legal reviewer, and this page will be updated when that review is complete.

Contact

Questions about this policy: use the contact form, reply to any email you receive from us, or email contact@evolamate.com.