Privacy policy

1. Controller and scope

Volucap GmbH and its affiliated companies (together, “Volucap”, “we”, “us”, or “our”) are German companies. EVE Browser is a product of Volucap GmbH. Volucap GmbH is the controller responsible for the processing described in this policy unless another entity is expressly identified.

Volucap GmbH
August-Bebel-Str. 26-53
14482 Potsdam
Germany

Email: eve@volucap.com
General contact: eve@volucap.com
Website: evebrowser.com

This policy applies to the EVE Browser website and its subdomains, the EVE Browser account and authentication services, desktop and mobile clients, XR and headset clients, associated networks and online services, software development kits where this policy is referenced, and other EVE Browser services displaying a link to this policy. Together, these are called the “EVE Platform”.

2. Important definitions

Personal data

Any information relating to an identified or identifiable natural person. A person may be identifiable directly or indirectly through a name, identification number, online identifier, location information, or factors relating to their physical, economic, cultural, or social identity.

Processing

Any operation performed on personal data, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.

Controller

The person or organization that determines why and how personal data is processed.

Processor

A person or organization that processes personal data on behalf of a controller and under its instructions.

Consent

A freely given, specific, informed, and unambiguous indication that a person agrees to a particular processing activity. Consent can be withdrawn for the future at any time.

Pseudonymization

Processing that prevents data from being linked to a specific person without separately held additional information.

3. Personal data we process

The data we process depends on the EVE services, devices, permissions, and optional features you use. Where information is required, we identify this at collection. If required information is not provided, the relevant account or feature may not be available.

3.1 Website and server information

When you visit evebrowser.com or an EVE service, our systems may automatically receive technical information needed to deliver and protect the service. This may include your IP address, date and time of access, requested pages or files, referrer URL, browser type and version, operating system, device type, language, internet service provider, response status, and similar log information.

We use this information to deliver the requested content, maintain service stability, diagnose errors, prevent attacks and misuse, and meet security or legal requirements. Security logs are kept separately from information you actively submit where reasonably possible.

3.2 Beta registration and EVE accounts

When you register for a beta or create and use an EVE account, we may process:

• email address;
• professional or personal background, available test devices, and the information you provide about why you want to join the EVE Browser beta;
• EVE user ID and identifiers supplied by a connected platform;
• authentication credentials or credential hashes managed by our authentication service;
• account status, preferences, security settings, and consent records;
• the platforms, stores, devices, or licenses connected to your account;
• beta eligibility, invitations, access status, and participation history;
• registration IP address, date, time, and security events;
• information required to protect the account, recover access, or meet legal obligations.

If third-party sign-in becomes available, the relevant provider may send us the identifier and account information you authorize it to share. We do not receive the password you use with that third party.

3.3 Browser, application, and usage data

EVE Browser is designed to display conventional websites as well as spatial and 3D streaming formats. Depending on the product version and the settings you choose, the application may process:

• application version, settings, feature flags, language, and accessibility preferences;
• CPU, GPU, memory, display resolution, operating system, drivers, and supported XR runtimes;
• headset model, controller or peripheral type, and platform information;
• session time, feature usage, navigation events inside EVE interfaces, crash reports, and diagnostic events;
• network performance, streaming quality, latency, rendering performance, and error information;
• downloads, permissions, bookmarks, history, tabs, site data, cookies, or saved settings where needed to provide browser functions;
• content ownership, purchases, subscriptions, virtual items, or entitlements connected with your account;
• friends, contacts, groups, multiplayer sessions, or social relationships if you actively use social features.

Browser data such as history, bookmarks, open tabs, passwords, and website storage may remain only on your device unless a synchronization, backup, or account feature is enabled. Where a sync feature is offered, the interface will identify the data involved and available controls. Passwords saved by the browser are protected using the security facilities made available by the operating system or device where technically supported.

3.4 Security, session, and abuse-prevention data

We may process usernames, account identifiers, IP addresses, connection times, session identifiers, device signals, and relevant software or integrity signals to authenticate users, protect accounts, enforce our terms, prevent fraud, investigate misuse, and secure EVE services. If multiplayer, commerce, or restricted-content features are offered, additional anti-fraud, moderation, or platform-integrity checks may be used. Such checks are limited to what is reasonably necessary for the relevant feature and device.

3.5 Spatial movement and controller data

When you use EVE Browser on an XR device, the application may receive movement data from the hardware and runtime you have enabled. This can include the relative position, orientation, and movement of your headset, controllers, hands, fingers, body, or other tracked objects. EVE uses this information to render the interface, support interaction, position spatial content, and animate a representation chosen by you.

Real-time movement data is not used to identify or authenticate you. Raw movement data is normally processed transiently for the active experience. If a particular feature needs to store, synchronize, or share movement information, we will provide additional notice or controls before that feature is used.

3.6 Eye tracking

If you enable an eye-tracking feature and use compatible hardware, EVE may receive relative eye position, movement, or gaze-direction information. This can be used for selection, accessibility, rendering optimization, interface interaction, or avatar animation. EVE does not scan your retina and does not use eye-movement data to establish your identity. Raw eye-tracking data is processed in real time and is not retained unless a separately described feature requires it and you enable that feature.

3.7 Facial tracking and camera input

Optional facial-tracking features may use camera input to detect facial movement and translate that movement into interface actions or animation. Facial tracking is disabled by default unless your device or operating environment clearly indicates otherwise. You can disable it through the available device or EVE settings.

Facial video and the analysis used for real-time animation are intended to remain in temporary device memory only for as long as necessary to provide the feature. They are not used by Volucap to identify you. EVE does not receive or share the raw facial video unless a separate feature expressly explains this and you choose to use it.

3.8 Audio and microphone access

Some EVE features may request microphone or device-audio access for voice input, communication, accessibility, visualization, spatial effects, or media playback. Access is used only for the feature you activate and is subject to device permissions. EVE does not record, store, or transmit microphone audio unless the feature you select requires transmission or recording and this is made clear to you. Other participants may be able to hear or record communications you choose to transmit through a multiplayer or communication service.

3.9 Approximate location

We may infer a general location such as country or region from your IP address for security, legal compliance, language, service availability, and diagnostics. We do not collect precise GPS location through EVE unless a location-dependent feature requests device permission and you grant it.

3.10 Communications and support

If you contact us, submit a support request, participate in research, or provide feedback, we may process your name, email address, account identifier, message, attachments, diagnostic information you choose to send, and the history of our communication. Support requests may be categorized with automated tools so they reach the appropriate team, but important decisions are not made solely from that categorization.

3.11 Images, profiles, and user content

Certain features may allow profile images, spatial assets, screenshots, bookmarks, shared spaces, comments, or other content. We process the content and related metadata to provide the feature, apply your sharing choices, moderate unlawful or abusive material, and enforce our terms. Do not upload personal data about another person unless you are permitted to do so.

3.12 Purchases, subscriptions, and billing

If paid features, subscriptions, virtual currency, or marketplace transactions are offered, payment and store providers may process your billing details. We may receive transaction identifiers, store or platform, currency, amount, tax status, entitlement, subscription status, refund information, and limited billing contact information. We generally do not receive full payment-card details. The payment provider’s privacy policy applies to its independent processing.

3.13 Newsletters, product updates, and marketing

If you request EVE news or marketing communications, we may process your email address, name, areas of interest, subscription status, consent record, and interaction with messages. Where legally required, subscription uses a double-opt-in process. Messages may contain measurement technology that tells us whether a message was opened or a link was selected. You may unsubscribe at any time through the link in the message or by contacting us. Service and security messages may still be sent when necessary for your account.

3.14 Information from platforms and partners

We may receive information from app stores, operating-system providers, XR platform providers, authentication providers, payment services, content providers, analytics or diagnostics providers, and advertising partners. This can include platform user IDs, entitlements, purchase status, device and app information, approximate location derived from IP address, campaign attribution, or connected-account details you authorize. We combine this information only where a lawful basis and a product or security need exist.

4. Websites and third-party content opened in EVE

EVE Browser lets you access websites, web applications, spatial streams, and content operated by third parties. When you visit third-party content, the operator may receive information commonly sent by browsers, including your IP address, browser and device information, requested URL, referrer information, cookies, and data you submit to that operator. The third party—not Volucap—decides how it processes that information under its own privacy policy.

EVE may offer permission controls, blocking tools, private-browsing options, or clearing functions. These controls reduce or manage certain data on your device but cannot prevent a website from processing information you deliberately send or information technically required to establish a connection. Review the privacy notice of each service you use.

5. Cookies and similar technologies

Cookies are small text files stored by a browser. EVE services may use cookies, local storage, session storage, pixels, SDK events, and comparable technologies for authentication, security, preferences, service operation, diagnostics, and— where permitted—measurement or marketing.

The public evebrowser.com landing page currently uses essential local storage to remember that its cookie notice was dismissed and does not use advertising or analytics cookies. The EVE authentication service uses strictly necessary technologies to sign users in and protect accounts. Additional services may use different technologies as described at the point of use and in our Cookie Policy.

You can delete or block website storage through browser settings. Disabling necessary cookies may prevent authentication or other requested functions from working correctly.

6. Why we process personal data

We process personal data for the following purposes:

• to provide the EVE website, accounts, browser clients, spatial rendering, streaming, synchronization, communication, and requested features;
• to register users, manage beta access, authenticate accounts, and maintain user preferences;
• to render interfaces and spatial content using movement, controller, eye, face, audio, or other device input that you enable;
• to secure accounts and services, prevent fraud and abuse, investigate incidents, and enforce our agreements;
• to process purchases, subscriptions, entitlements, refunds, and legally required financial records;
• to respond to questions, provide support, and communicate administrative or security information;
• to diagnose faults, maintain compatibility, measure performance, improve EVE, and develop new features;
• to understand service usage, personalize permitted aspects of the experience, and evaluate beta releases;
• to send newsletters or marketing where you have requested them or where otherwise permitted by law;
• to establish, exercise, or defend legal claims and comply with lawful requests and statutory obligations;
• for another purpose described when information is collected, provided a valid legal basis exists.

7. Legal bases

Where the GDPR or comparable law applies, we rely on one or more of these bases:

• Contract and pre-contractual steps: processing needed to create an account, provide requested EVE services, supply purchases, or take steps you request before entering an agreement.
• Consent: processing you affirmatively authorize, such as optional sensor features, precise location, non-essential cookies, or marketing where consent is required. Consent may be withdrawn for the future.
• Legal obligation: processing required for tax, accounting, consumer-protection, law-enforcement, sanctions, or other statutory duties.
• Legitimate interests: operating and improving EVE, protecting services and users, preventing misuse, responding to communications, understanding product performance, and establishing or defending claims. We balance these interests against your rights and do not rely on them where your interests override ours.
• Vital or public interests: processing necessary to protect life or comply with a task in the public interest, but only in exceptional situations where the law permits it.

8. When we disclose personal data

We may disclose personal data in these circumstances:

• Service providers: hosting, authentication, software development, security, diagnostics, customer support, email delivery, payment, store, and professional-service providers that need the information to perform work for us.
• Platform and content providers: device manufacturers, XR runtimes, operating systems, app stores, payment platforms, or content services when required to provide a feature you request.
• At your direction: people, services, or applications with which you choose to share information. Their own policies govern their independent use.
• Legal and safety matters: courts, authorities, law enforcement, advisers, or affected parties where required by law or reasonably necessary to protect rights, safety, systems, users, or the public.
• Corporate transactions: a prospective or actual acquirer, investor, successor, or adviser in connection with financing, restructuring, merger, sale, insolvency, or transfer of business assets, subject to applicable safeguards and notice requirements.
• Aggregated information: statistics or de-identified information that does not reasonably identify an individual.

Processors receive only the access reasonably required for their service and are bound by contractual and legal confidentiality, security, and data-protection requirements where applicable.

9. International processing and transfers

We are active in the European Economic Area and prefer to host EVE-controlled data in the EEA. Some providers, stores, platforms, or support services may process information in other countries. Privacy laws in those countries may differ from the laws where you live.

When the GDPR applies and personal data is transferred outside the EEA, we use an approved transfer basis where required, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, binding corporate rules, or a specific statutory derogation. You may contact us for further information about applicable safeguards.

10. Retention

We keep personal data only for as long as needed for the stated purpose, the life of the relevant account or service, security, dispute resolution, and statutory obligations. We then delete, anonymize, or restrict the data. Depending on the feature, indicative maximum periods may include:

• short-lived connection or matchmaking information: generally up to two weeks;
• technical diagnostics associated with a user or device: generally up to 90 days;
• security-related IP information: up to one year after collection or resolution of a related incident;
• product analytics and pseudonymized usage information: generally up to two years;
• support and business communications: generally up to five years after the last contact;
• unsuccessful or expired beta applications: generally up to two years after submission or the end of the relevant beta program;
• account, entitlement, and contractual information: for the account relationship and, where required, up to ten years after the last use or transaction;
• tax, accounting, and transaction records: for the statutory retention period;
• consent records: for as long as needed to demonstrate compliance and resolve claims.

Backups may retain data for a limited additional period before scheduled deletion. Information may also be retained longer where necessary for fraud prevention, litigation, legal holds, or mandatory law. Raw movement, gaze, or facial-tracking data used only for real-time interaction is not intended to be retained by Volucap.

11. Your data-protection rights

Your rights depend on where you live and may be subject to legal conditions and exceptions. Under the GDPR, you may have the following rights:

11.1 Confirmation and access

You may ask whether we process personal data about you and request a copy together with information about purposes, categories, recipients, transfers, retention, sources, and relevant automated decision-making.

11.2 Rectification

You may ask us to correct inaccurate personal data or complete information that is incomplete, taking account of the purpose of processing.

11.3 Erasure

You may ask us to erase personal data where it is no longer necessary, consent has been withdrawn and no other basis applies, a valid objection has been made, the data was processed unlawfully, or erasure is legally required. This right does not apply where continued processing is required by law, freedom of expression, public interest, or legal claims.

11.4 Restriction

You may ask us to restrict processing while accuracy is disputed, where processing is unlawful but you oppose deletion, where we no longer need the data but you need it for legal claims, or while a legitimate-interest objection is being assessed.

11.5 Data portability

Where processing is automated and based on consent or contract, you may request personal data you provided in a structured, commonly used, machine-readable format and, where technically feasible, request transmission to another controller.

11.6 Objection

You may object to processing based on legitimate interests or public interest for reasons relating to your situation. We will stop unless compelling lawful grounds override your interests or processing is needed for legal claims. You may object to direct marketing at any time; we will stop using your data for that purpose.

11.7 Withdrawal of consent

You may withdraw consent at any time for future processing. Withdrawal does not affect processing that was lawful before withdrawal.

11.8 Complaint

You may complain to a competent supervisory authority, including the authority in your country of residence, place of work, or the place of an alleged infringement. You may also contact us first so we can attempt to resolve the issue.

12. Additional regional rights and choices

12.1 United States

Residents of U.S. states with applicable privacy laws may have rights to know, access, correct, delete, or obtain a portable copy of personal information and to opt out of certain targeted advertising, sale, sharing, or profiling. EVE does not sell personal data for money. If a law treats particular advertising disclosures as a “sale” or “sharing”, any applicable opt-out control will be provided where that activity is used. You may have the right to appeal a denied request.

12.2 Brazil

Where Brazil’s LGPD applies, you may request confirmation, access, correction, anonymization, blocking, deletion, portability, information about recipients, review of certain automated decisions, or withdrawal of consent, subject to legal requirements and exceptions. You may also contact Brazil’s National Data Protection Authority through its official channels.

12.3 Verification and authorized requests

To protect users, we may request information reasonably necessary to verify your identity and authority before completing a request. Authorized agents may be required to provide proof of authority. We will not discriminate against you for exercising a privacy right.

13. Product and communication choices

• You can adjust available browser, privacy, permission, sensor, and account settings in EVE or your device.
• You can deny or revoke camera, microphone, eye-tracking, location, hand-tracking, or similar permissions through device settings, although the related feature may stop working.
• You can clear website data, history, cookies, cache, and other locally stored information through EVE controls where offered.
• You can disconnect supported third-party accounts through the relevant account settings.
• You can unsubscribe from marketing through the link in the message or by contacting us. Administrative, transactional, and security notices may continue.
• You may decline optional diagnostic or analytics processing where an opt-out control is offered.

14. Data security

We use technical and organizational measures designed to protect personal data, including access controls, role separation, encrypted transport, protected credentials, logging, update processes, backups, and supplier controls as appropriate to the risk. No internet transmission, device, or storage system is completely secure, so absolute protection cannot be guaranteed. You are responsible for protecting your device credentials and notifying us if you suspect unauthorized account access.

15. Children

The EVE website and general EVE services are not directed to children under 13 or a higher minimum age required by local law. We do not knowingly collect personal data from a child below the applicable age without valid parental authorization. If you believe a child has provided personal data improperly, contact us so we can investigate and delete it where required.

16. Automated processing

We may use automated tools to categorize support requests, detect security events, identify potential fraud or abuse, moderate content, or analyze product performance. We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects for users. If that changes, we will provide the information and safeguards required by law, including a means to request human review where applicable.

17. Changes to this policy

We may update this policy as EVE develops, supported devices and services change, or legal requirements evolve. The date at the top identifies the current version. If a change materially affects your rights or how we use personal data, we will provide reasonable notice through the website, application, account, or email where appropriate.

18. Exercising your rights and contacting us

To ask a privacy question or exercise a right, email eve@volucap.com with the subject “Privacy request”. Please describe the request and the EVE account or service involved. Do not send passwords, authentication codes, or unnecessary identity documents by email.

Volucap GmbH
August-Bebel-Str. 26-53
14482 Potsdam
Germany