1.1 Key Terms

• “Personal Information” — information that identifies or can reasonably identify an individual.
• “Customer” — any organization or individual using Engage services.
• “Subscriber” — an individual whose personal information is processed through a Customer account.
• “Processing” — any operation performed on personal information including collection, storage, use, disclosure, or deletion.
• “DPA” — Data Processing Agreement governing Engage's processing of personal data on behalf of a Customer.

2.1 When Engage Is a Controller

Engage acts as a Data Controller for: website visitors and prospects, account owners and billing contacts, and recipients of Engage's own marketing communications.

2.2 When Engage Is a Processor

Engage acts as a Data Processor when processing personal data on behalf of its Customers — including email recipients, SMS contacts, CRM contacts, form respondents, and marketing audiences. Customers are responsible for the lawfulness of their data collection. Where required by law, Customers and Engage will execute a DPA.

3.1 Information You Provide

• Account information: name, company, job title, email address, phone number, username, and credentials.
• Billing information: billing address, tax details, and payment transaction metadata (full payment card numbers are processed by our payment processor, not stored by Engage).
• Communications: support requests, survey responses, and feedback.

3.2 Customer Data Processed Through Engage

Customers may upload and process contact-level data including email addresses, phone numbers, names, postal addresses, geographic and demographic information, purchase history, preferences, and behavioral data. Customers control this data and are responsible for obtaining all required consents.

3.3 Information Collected Automatically

• Device information: browser type, device type, operating system, screen resolution, and language settings.
• Usage information: login activity, session duration, feature usage, and workflow events.
• Technical information: IP address, network details, time zone, and error logs.

3.4 Communications Data

When Customers send campaigns through Engage, we process sender and recipient information, message content, delivery status, open and click events, bounce data, spam complaints, unsubscribe requests, and opt-in records.

3.5 Forms and Landing Pages

Data submitted through Customer-created forms and landing pages is processed according to that Customer's instructions.

Engage uses cookies and similar technologies for authentication, preferences, analytics, and security. For users in jurisdictions requiring consent, non-essential cookies are activated only after affirmative consent via our cookie consent mechanism. Full details are in our Cookie Policy at engage.nevtan.com/legal/cookies.

We use the information we collect to:

• Provide, operate, and maintain the Services
• Authenticate users and process payments
• Deliver communications on behalf of Customers
• Improve products and develop new features
• Provide customer support and respond to inquiries
• Conduct analytics and measure platform performance
• Prevent abuse, detect fraud, and protect platform security
• Comply with legal obligations and enforce our agreements

Contract Performance

Processing necessary to provide the Services.

Legitimate Interests

Security, fraud prevention, service improvement, and business operations, where not overridden by individuals' rights.

Consent

For marketing communications and non-essential cookies where legally required. Consent may be withdrawn at any time.

Legal Obligations

Processing required to comply with applicable laws including tax and regulatory reporting.

We do not sell personal information. We may share information with: cloud infrastructure providers, communications providers, payment processors, analytics providers, security providers, professional advisors under confidentiality obligations, and government authorities where legally required. All third parties are required to protect information consistently with this Policy.

Because Engage operates globally, personal information may be transferred to and processed in countries other than your country of residence. When transferring personal information across borders, Engage relies on appropriate safeguards including Standard Contractual Clauses (SCCs), Data Processing Agreements with binding data protection obligations, adequacy decisions where recognized by applicable regulators, and technical and organizational security measures.

Where Customers use AI-powered features, customer data is not used to train publicly available AI models without express opt-in, is not sold to AI vendors, is not shared across customers, and is processed under zero data retention agreements with AI providers. Full details are in our AI & Data Usage Policy at engage.nevtan.com/legal/ai-policy.

• Account and Customer Data: retained for the duration of the subscription, plus up to 90 days following termination.
• Billing and Transaction Records: retained for a minimum of 7 years for tax and audit purposes.
• Security and Audit Logs: retained for up to 12 months.
• Backup Systems: backup copies may persist for up to 90 days following production deletion before permanent purging.

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal information; restrict or object to processing; withdraw consent; and lodge a complaint with your local data protection authority. To exercise rights, contact privacy@nevtan.com. We will respond within the timeframes required by applicable law.

11.1 California Rights (CCPA / CPRA)

California residents may exercise the right to know, delete, correct, limit use of sensitive personal information, and opt out of sale or sharing. Engage does not sell personal information.

11.2 EEA and UK Rights (GDPR / UK GDPR)

EEA and UK residents have rights under Articles 15–22 GDPR including access, rectification, erasure, restriction, portability, and objection. Complaints may be directed to your national supervisory authority (e.g., the UK ICO at ico.org.uk).

11.3 Other Jurisdictions

Engage honors privacy rights under applicable laws in all jurisdictions in which it operates. Contact privacy@nevtan.com for jurisdiction-specific information.

The Services are not directed to children. Engage does not knowingly collect personal information from individuals under 16 (or a lower age threshold where permitted by local law, such as 13 under US COPPA). If such information is collected inadvertently, we will delete it promptly. Contact privacy@nevtan.com if you believe we may have collected a child's information.

Engage maintains administrative, technical, and organizational safeguards to protect personal information. In the event of a security incident, Engage will notify affected Customers within 48 hours of confirmation, as detailed in our Security & Compliance documentation at engage.nevtan.com/security.

We may update this Privacy Policy from time to time. Material changes will be communicated at least 30 days in advance via website notices, in-product notifications, and email to Account Owners. The current version is always available at engage.nevtan.com/legal/privacy.

Privacy Officer
Email: privacy@nevtan.com