Privacy Policy

Welcome to EvoTechTool ("we," "us," or "our"), accessible at https://evotechtool.com. We are committed to protecting your privacy and being fully transparent about our data practices. This Privacy Policy explains how we handle data, server telemetry, cookies, analytics, and advertising when you visit our website and online utility tools.

By accessing or continuing to use EvoTechTool, you acknowledge that you have read, understood, and agree to the collection and use of information described in this Privacy Policy. If you do not agree, please discontinue use of our website. This Policy is incorporated into our Terms of Use.

1. Zero Transmission of Tool Input Data

EvoTechTool operates as a client-side utility platform. When you use our primary tools (including the QR Code Generator, Password Generator, and Username Generator):

• Client-Side Local Processing: All inputs, user options, generated passwords, text strings, and QR code graphics are processed exclusively inside your web browser memory (RAM) via JavaScript.
• No Server Transmission or Ingestion: We do not transmit, record, store, or log your tool input data or generated outputs on any server or third-party database.
• Browser Storage: Local preferences or history (such as QR code scan history) are saved strictly inside your device's browser localStorage. You can clear this at any time by clearing your browser cache.

The only exception is the What's My IP tool, which sends your IP address to third-party geolocation lookup APIs as described in Section 4.

2. Technical Telemetry, Cookies & Ad Data We Collect

A. Web Server Logs

Like all standard websites, our web server automatically generates log files recording connection metadata: your IP address, browser User-Agent string, referring/exit pages, requested URI paths, timestamp, and device operating system.

Retention & Legal Basis: We retain server logs for 30 days, after which they are permanently deleted. Our legal basis under GDPR Art. 6(1)(f) is our legitimate interest in maintaining web application security, preventing DDoS attacks, and diagnosing server performance. We have assessed that this legitimate interest is not overridden by users' privacy interests, given that logs are retained for only 30 days, are not used for profiling, and contain no sensitive data beyond standard connection metadata. Server logs are maintained by our web hosting provider on our behalf under a processor relationship. We select hosting providers that implement industry-standard security measures and are not liable for security incidents originating solely from our hosting provider's infrastructure beyond our control.

B. Google Analytics 4 (GA4)

We use Google Analytics 4 (GA4) to measure aggregated navigation patterns. GA4 uses first-party cookies (_ga, _ga_*) to distinguish browsers and measure aggregated usage (page views, session duration, device types, and coarse regional location). GA4 does not log or store your IP address. It uses IP addresses temporarily to derive coarse geographic location and then discards them immediately — this is automatic behaviour, not a configurable option. GA4 processes pseudonymous browser identifiers; under GDPR, such identifiers are considered personal data. We load GA4 tracking scripts only after you provide explicit consent via our cookie banner.

C. Adsterra Advertising Network & Advertising Cookies

We display advertisements through Adsterra Advertising Network (and its authorized ad demand partners) to keep our tools 100% free:

• Adsterra and its partners may use cookies, web beacons, and device identifiers to deliver, measure, and frequency-cap banner and native advertisements.
• Data collected by Adsterra may include your IP address, device specs, browser type, coarse geolocation, and browsing interactions on our site.
• Explicit Consent Requirement: We set Adsterra advertising cookies and load ad scripts ONLY after you provide explicit consent via our Cookie Consent Banner. If you reject non-essential cookies, Adsterra advertising scripts are blocked entirely.
• Data Processing Relationship: For the purposes of GDPR, Adsterra operates as an independent data controller for advertising data collected via their platform, in addition to acting as our data processor for ad delivery. Our publisher agreement with Adsterra includes GDPR-compliant data processing provisions. You should review Adsterra's Privacy Policy for details on their independent data processing.
• For California residents: Adsterra-powered targeted advertising may constitute "sharing" of personal information under CPRA. See Section 7 for your opt-out rights.

3. Contact Form Data Processing

If you communicate with us via our Contact Form or direct email, we collect your Name, Email Address, Subject, and Message Body. We process this information strictly to respond to your inquiry. Any content you submit via the contact form grants us a non-exclusive, royalty-free licence to use that content solely for the purpose of responding to your inquiry. Our legal basis under GDPR Art. 6(1)(f) is our legitimate interest in providing customer support. We retain contact communications for 6 months, after which they are purged.

4. Third-Party Sub-Processors & Data Retention Summary

To deliver specific features, we utilize trusted third-party sub-processors. Below is our data retention and sub-processor schedule:

5. Data Security & Breach Notification

A. Security Measures

We implement appropriate technical and organizational measures to protect any personal data we process, including:

• HTTPS Encryption: All data in transit between your browser and our website is encrypted via HTTPS/TLS.
• Access Controls: Server infrastructure access is restricted to authorized personnel only.
• Log Rotation: Server logs are automatically deleted after 30 days.
• Minimal Data Collection: We collect only the data strictly necessary for our operations. Tool inputs (passwords, QR content) are never transmitted.
• Consent-Gated Scripts: Third-party analytics and advertising scripts (GA4 and Adsterra) are blocked until explicit user consent is given.

However, no internet transmission or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

B. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Art. 33 and applicable law.
• Where the breach is likely to result in high risk to affected individuals, notify those individuals directly without undue delay via email (if held) or a prominent notice on our website, in accordance with GDPR Art. 34.
• Notify affected users in Bangladesh in accordance with the Bangladesh Personal Data Protection Act (PDPA) notification requirements.
• Take immediate steps to contain and investigate any breach and prevent future incidents.

6. Law Enforcement & Legal Disclosure

We may disclose personal data if required to do so by applicable law, court order, government authority, or regulatory body. This includes disclosures required under the laws of Bangladesh, the European Union, or any other jurisdiction where we are legally compelled to act. Where we are legally permitted to do so, we will notify affected users prior to disclosure. We do not sell personal data to governments, law enforcement agencies, or any other third party. We will only disclose the minimum personal data necessary to comply with a legal obligation.

7. Third-Party Links

Our website may contain links to third-party websites, services, and platforms (including Adsterra ad destinations, Google, Discord, and others). We are not responsible for the privacy practices, content, or security of those third-party sites. We encourage you to review the privacy policy of any external website you visit before providing personal information. The presence of a link does not constitute our endorsement of that site.

8. International Data Transfers

Some of our sub-processors (such as Google LLC and Adsterra partners) are located outside the European Economic Area (EEA) and United Kingdom, primarily in the United States or international data centers. Where personal telemetry or cookies are transferred internationally, we rely on appropriate legal transfer safeguards, including the EU-U.S. Data Privacy Framework (DPF), European Commission Standard Contractual Clauses (SCCs), or your explicit consent where required.

9. European Union (GDPR / UK GDPR) Legal Rights

If you reside within the EEA, UK, or Switzerland, you possess the following data subject rights:

• Right to Access: Request details of personal data we process about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of server logs or contact records.
• Right to Restriction & Object: Restrict or object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent for analytics or advertising cookies at any time via our Cookie Settings link or browser settings, without affecting the lawfulness of prior processing.
• Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing. EvoTechTool performs zero automated profiling.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local Data Protection Authority (DPA). In the EU, find your DPA at edpb.europa.eu.

Mapped Lawful Bases:

• Server Security Logs: Legitimate Interest (GDPR Art. 6(1)(f)) — balanced test conducted; interest is not overridden.
• IP Geolocation Feature: Performance of requested service (GDPR Art. 6(1)(b)).
• Analytics (GA4) & Advertising Cookies (Adsterra): Explicit Consent (GDPR Art. 6(1)(a)).
• Essential Cookies (consent preference): Legitimate Interest in operating a functional website.
• Contact Form Response: Legitimate Interest (GDPR Art. 6(1)(f)).

10. California Consumer Privacy Act (CCPA / CPRA) Disclosures

EvoTechTool is a small, free, personally operated website. Based on current thresholds, we do not believe we qualify as a "business" subject to mandatory CCPA/CPRA obligations (annual revenue below $25M, fewer than 100,000 California consumers processed). However, as a matter of transparency and good faith:

• We do not sell personal data. We never have and never will.
• Advertising: We use Adsterra to display ads. Adsterra may process pseudonymous identifiers for targeted advertising only if you have provided explicit consent via our cookie banner. You may withdraw consent at any time via Cookie Settings in our footer.
• Global Privacy Control (GPC): We respect Global Privacy Control (GPC) signals where required by applicable law. A GPC signal from your browser will be treated as an opt-out of targeted advertising cookies.

11. Bangladesh Personal Data Protection Act (PDPA)

As an operator based in Dhaka, Bangladesh, we are subject to and comply with the Bangladesh Personal Data Protection Act (PDPA). Under the Bangladesh PDPA, users in Bangladesh have the right to:

• Access: Request information about personal data we hold about you.
• Rectification: Request correction of inaccurate personal data.
• Erasure: Request deletion of your personal data where we have no lawful basis to retain it.
• Complaint: Lodge a complaint with the relevant Bangladeshi data protection authority.

To exercise any of these rights, please contact us at support.saa.play@gmail.com. We will respond to all verifiable requests within the timeframes required by applicable law.

12. Children's Privacy (COPPA & GDPR Alignment)

Our website is not directed to children under the age of 13 (or under 16 in the EEA/UK). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately at support.saa.play@gmail.com for immediate deletion.

13. Policy Updates

We will post any Privacy Policy revisions on this page with a revised "Last Updated" date and version number. For material updates, we will provide prominent notice on our website or request fresh cookie consent where required by law. Continued use of EvoTechTool after the effective date of any revision constitutes your acceptance of the updated Policy.

14. Data Controller Contact Information

For legal inquiries, privacy concerns, data subject requests, or data breach reporting, please contact our Data Controller:

• Data Controller: MD Shahed Ahmed, operating as EvoTechTool
• Location: Dhaka, Bangladesh
• Email: support.saa.play@gmail.com
• Web Form: Contact Us
• Response Time: We aim to respond to all data subject requests within 30 days (or sooner as required by applicable law).