Privacy Policy

Last updated: August 19, 2026

This policy covers residents in the United States, the European Economic Area (EU GDPR), and the United Kingdom (UK GDPR / Data Protection Act 2018). View our Data Processing Agreement (DPA) or submit a data subject request.

Evolve Edge (“Evolve Edge,” “we,” “us,” or “our”) is operated by Strong Redemption LLC, a Maryland limited liability company. We are committed to protecting your privacy and handling your personal data with transparency and care.

1. Information We Collect

We collect the following categories of information:

• Account data: Your name, email address, organization name, and credentials when you create an account.
• Usage and analytics data: Pages visited, features used, session duration, and interaction events within the platform.
• Evidence files and audit data: Documents, assessments, control evidence, and audit logs that you upload or generate within the platform.
• Billing information: Payment method details and transaction history processed by our payment provider, Stripe. We do not store full card numbers.
• Communications: Messages you send us via email or contact forms.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process billing and manage your subscription
• Power compliance workflows, AI risk assessments, and audit delivery
• Send transactional emails (account setup, report delivery, renewal reminders)
• Improve and develop the platform through aggregate, anonymized analytics
• Comply with legal obligations and enforce our Terms of Service

We do not use your Customer Data to train third-party AI models, and we do not sell your personal information to third parties.

3. Lawful Basis for Processing (EU & UK GDPR)

If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following lawful bases:

4. Third-Party Sub-Processors

We share data with the following sub-processors to operate the Service. All sub-processors are bound by data processing agreements and are required to implement appropriate technical and organizational safeguards.

5. International Data Transfers (EU & UK)

Evolve Edge is headquartered in the United States. If you are located in the EEA or UK, your personal data will be transferred to and processed in the United States. We rely on the following safeguards for these transfers:

• EU Standard Contractual Clauses (SCCs): For transfers from the EEA to the US, we use the European Commission’s approved Standard Contractual Clauses (Commission Implementing Decision 2021/914).
• UK International Data Transfer Agreement (IDTA): For transfers from the UK to the US, we use the UK IDTA approved by the UK Secretary of State.
• Sub-processor SCCs: All US-based sub-processors are required to execute SCCs or equivalent transfer mechanisms as a condition of our engagement.

You may request a copy of our SCCs by contacting info@evolveedgeai.com.

6. EU & UK Representatives

As required by Article 27 of the EU GDPR and UK GDPR, Evolve Edge is in the process of appointing a Representative in the European Union and a Representative in the United Kingdom. Representative details will be published here upon appointment. In the meantime, EU and UK data subjects may contact us directly at info@evolveedgeai.com.

7. Data Retention

We retain your account and usage data for as long as your account is active or as needed to provide the Service. Compliance evidence files and audit reports are retained according to your organization’s configured retention policy. The default retention period for compliance data is 7 years, consistent with typical regulatory requirements for SOC 2 and related frameworks. You may request deletion of your data by submitting a data subject request.

8. Security

We implement appropriate technical and organizational security measures to protect your information, including:

• Encryption in transit using TLS for all data transfers
• AES-256-GCM field-level encryption for sensitive compliance data at rest
• Password hashing using strong one-way hash algorithms (bcrypt)
• Comprehensive audit logging of all access events and data changes
• Role-based access controls limiting data access to authorized personnel
• Regular security reviews and vulnerability assessments

9. Cookies

We use the following categories of cookies:

• Strictly necessary cookies: Session authentication cookies required for the platform to function. These cannot be disabled.
• Analytics cookies: Aggregate, anonymized usage data collected via PostHog to help us improve the platform. You may opt out via our cookie consent banner or by contacting us.

We do not use advertising or cross-site tracking cookies.

10. Your Data Subject Rights

Depending on your location, you have the following rights regarding your personal data:

To exercise any of these rights, please submit a data subject request or email info@evolveedgeai.com. We will respond within 30 days (or within 72 hours for breach notifications as required by GDPR Art. 33).

UK residents may lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk. EU residents may contact their local Data Protection Authority.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where required by law, by email. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

12. Contact & Data Controller

Data Controller: Strong Redemption LLC (DBA Evolve Edge AI)
11400 Robinwood Drive, Hagerstown, MD 21742, USA
info@evolveedgeai.com