Privacy policy

Last updated 5 November 2026.

Who we are

Evander is an applicant tracking system for companies, run by [legal entity, address]. You can reach us about privacy at talwe.singh@gmail.com.

Our role

For data about candidates, the customer company that uses Evander is the controller, and Evander processes that data on its behalf. For data about the people who use the app (the customer's team), Evander is the controller.

What we process

• Account data: your name, email address and Google account id, used to sign you in.
• Candidate data that customers or candidates provide: applications, CVs, notes, interview feedback, and email exchanged with candidates.
• Google data, when a user connects their Google account:
  • Gmail: Evander sends mail on the user's behalf and reads mail to find messages about candidates. Rules on the message headers run first. For mail the rules cannot decide, only the headers and Gmail's short preview are read. Mail that is unrelated to candidates is not stored, and its full text is not fetched.
  • Google Calendar: Evander creates interview events and reads free/busy times.
• Slack, when a workspace connects it: team notifications, which may mention candidates.

Google API Services User Data Policy

Evander's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide the features the user enabled.
• It is not used for advertising.
• It is not sold.
• It is not used to train generalized AI models.
• Humans do not read it, except with the user's consent, for security purposes, or as required by law.

To classify mail and score applications, message headers and a short preview, and candidates' applications (CV, answers, profile details) together with the job description, are sent to an AI model provider: Anthropic models, accessed through OpenRouter. To draft replies to a candidate's email, the full text of up to six recent emails between the candidate and the team on that application is sent too, with the candidate's name, the application's stage, the company name and the job description. A draft is only sent once a person on the team approves it. Routing to providers that train on request data is turned off, so this data is not used for training.

Subprocessors

We use these service providers to run Evander. The database and servers run in the US East region.

• Neon: database
• Railway: hosting
• Cloudflare R2: file storage
• Trigger.dev: background jobs
• OpenRouter and Anthropic: AI models
• Resend: notification email to the customer's team
• Sentry: error monitoring
• Google: sign-in, Gmail and Google Calendar
• Slack: team notifications, when a workspace connects it

Retention and deletion

• Each customer sets how long candidate data is kept after a hiring process ends; candidates who were not hired are erased automatically after that.
• Candidate data is erased on request.
• Disconnecting a Google account in Evander revokes Evander's access and deletes the stored token.
• You can also revoke Evander's access at any time at https://myaccount.google.com/permissions.

Your rights

You can ask for access to, export, correction or deletion of your data, through the company that uses Evander or by contacting us at talwe.singh@gmail.com.

Security

Data is encrypted in transit. Tokens for connected accounts are encrypted at rest. Each customer's data is isolated in its own workspace.

Changes

We will update this policy when how we process data changes, and change the date at the top of this page.