IRIS privacy
Last updated 22 October 2026
This policy explains what personal data IRIS processes, why, who receives it, how long it is kept, and the choices and rights you have.
Who we are
IRIS is provided by Sufi Plugins, LLC, Maryland, USA, the controller of the personal data described here. Contact: help@eveniris.com.
What we process, why, and for how long
Most of what IRIS creates is stored on your phone. Data leaves your phone when a feature needs it: to transcribe speech, generate responses, back up your data, or provide your subscription. Where the table says “not stored by us”, the data is processed by our service providers to handle the request and is not kept on our servers afterwards.
| Data | Purpose | Retention |
|---|---|---|
| Audio of conversations and dictation while IRIS is listening, including other people’s speech | Transcription, and voice conversations with IRIS when you use voice mode | Not stored by us, unless you turn on session recordings |
| Transcripts, together with relevant parts of your modes, memories, profile, documents and files; search queries derived from them | Generating cues, answers, summaries and searches | Not stored by us, except as described in this table |
| Your IRIS data: sessions, transcripts, summaries, memories, modes, to-dos, preferences and chats | Providing the app; on Pro, cloud backup and restore (on by default), and showing it to you on IRIS on the web when you sign in there | On your phone until you delete it. The cloud backup is kept until you turn backup off or ask us to delete it, and expires 2 years after the last backup. A searchable copy made from the backup for IRIS on the web is deleted with it |
| Sound from your computer’s microphone and from the computer itself (for example the other side of a call) while IRIS for desktop is listening, including other people’s speech | Transcription, cues and the answers you ask for | Not stored by us. A session you save is kept with your IRIS data, as above. The app keeps only its sign-in and window settings on your computer |
| IRIS on the web and IRIS for desktop sign-ins: a coded form of the sign-in token, when it was created and last used, and the browser's or app’s name | Keeping you signed in to IRIS on the web and IRIS for desktop | 30 days after the browser's last visit, or until you sign out, turn cloud backup off, or ask us to delete your data. Sign-in links expire after 15 minutes |
| Documents you add (Pro) | Answering from your files | Until you remove them |
| Session audio recordings (Pro, off by default) | Playback | Until you delete them |
| Voiceprints | Telling speakers apart | On your phone only; see Voiceprints |
| Your Ask and “Hey Even” questions and IRIS’s answers (Pro) | Quality review | Up to 48 hours |
| Session review results (Pro) | Quality review | See Session review |
| Requests, captures and replies handled while the app is closed (“Hey Even”, your connected agent), reminders, and content sent from the browser extension | Delivering them to your app, agent, glasses or email | Until delivered, or until the reminder or event has passed, then up to 14 days |
| Live sessions waiting to reach your phone, and recent session context for “Hey Even” (Pro) | Saving the session to your library; answering about the session you are in | Until delivered or the session ends; at most 30 days |
| Account and billing: email address, licence key, subscription id, plan and status, and records of your acceptance of the Terms | Providing Pro, billing, account email and support; legal compliance | While you are a customer, then as long as needed for tax, accounting and legal claims |
| Usage and abuse-prevention records: usage and cost counters, install identifiers, free-session and trial records, and an email address you give for a free summary | Usage limits, preventing abuse, sending what you asked for | Up to 2 years |
| Diagnostics: app events, errors and timings, with an install identifier and licence key (on by default; in the EEA, the UK and Switzerland, only anonymous first-party usage and performance measurement is on by default — no licence key, a rotating identifier, kept up to 13 months — and everything else is off until you turn it on. The Diagnostics switch turns it all off.) | Finding and fixing faults; measuring how IRIS is used and performs | Up to 30 days; aggregated totals longer |
| Credentials for services you connect through our server (for example a home-automation token or your agent’s address and key) | Running that connection | Until you remove the connection; unused home-automation tokens expire after 400 days |
| Approximate location derived from your IP address | Time, place and weather context; regional restrictions on recordings | Not stored against your account |
| Support messages and anything you send us, such as a debug log | Support | As long as needed to handle your request |
| Audience Q&A: questions, optional names and votes from participants | Running the Q&A | Deleted 12 hours after the event’s last activity |
We receive data from you, from your device (including the speech of people around you while IRIS is listening), and from our payment processor (your email address and subscription status). If you use your own API keys or connect other services, data goes from your device to those services under their terms, and we do not receive it.
You are not required to give us personal data, but some features cannot work without it (for example, Pro needs an email address).
IRIS on the web sets one cookie, which keeps you signed in. It is not used for advertising or analytics.
Our website does not use advertising or analytics cookies and does not allow third parties to track you across sites, so it does not respond differently to “Do Not Track” signals.
Security
We use technical and organisational measures appropriate to the risk to protect personal data, including encryption in transit.
Quality review
Questions and answers. On Pro, the questions you put to IRIS in Ask and to “Hey Even”, and IRIS’s answers, are kept for up to 48 hours to review answer quality. Turn this off in Settings → About & help → Privacy & legal.
Session review. On Pro, sessions recorded from 28 September 2026 — what was said, and IRIS’s cues and answers — may be reviewed, including with the help of our AI service providers, to find problems and to test and improve IRIS. This applies only while cloud backup and session review are both on. Turn it off in Settings → About & help → Privacy & legal → Session review. Review results are kept for up to 30 days; excerpts selected to test changes are kept only as long as they are needed for that.
Voiceprints
To tell speakers apart, IRIS creates voiceprints (biometric data) from speech: yours, if you record one; other people’s, if you choose to save them; and temporary profiles of speakers in a session. They are created, matched and stored on your phone. They are not included in the cloud backup, and we do not receive, sell or disclose them.
Saving another person’s voice requires you to confirm that you have their permission, and you are responsible for obtaining it where the law requires. Retention: temporary profiles of unnamed speakers are deleted after 30 days; other voiceprints are kept until you delete them in the app or uninstall IRIS.
Recording other people
IRIS transcribes everyone it hears. You are responsible for complying with recording and privacy laws where you use it, including getting consent where required. Session recordings are not available in some places that require all-party consent.
Who receives data
We share personal data only with the following categories of recipients, each processing it on our behalf unless stated otherwise:
- cloud hosting and storage providers;
- AI model, web-search, speech-to-text and text-to-speech providers;
- a weather service (approximate location only);
- our email delivery provider;
- our payment processor, which acts as an independent controller;
- authorities or others where required by law or to protect our rights, and a successor if the business is transferred.
Services you choose to connect or use yourself (including Even Realities, your own AI providers or agent, and integrations) receive what you send them under their own terms.
International transfers
We are in the United States, and our providers process data in the United States and other countries. Where the law requires a transfer mechanism, we rely on the European Commission’s standard contractual clauses (with the UK addendum) or another lawful mechanism. Contact us for more information.
Legal bases (UK and EU)
- Contract — providing IRIS and your subscription.
- Legitimate interests — security, preventing abuse, diagnostics, quality review and improving IRIS, and telling customers about IRIS. You can object at any time.
- Consent — voiceprints, session recordings, and anything else where the law requires consent. You can withdraw it at any time by turning the feature off.
- Legal obligation — tax and accounting records.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
Your choices
Settings → About & help → Privacy & legal lets you turn off cloud backup (which deletes the stored copy), the 48-hour question log, session review, diagnostics and session recordings, individually or all at once with Private mode. Turning off cloud backup also signs out every browser using IRIS on the web and deletes the copy made for it. You can delete sessions, memories, recordings and voiceprints in the app. You can unsubscribe from product emails at any time; account emails (such as your licence key and billing notices) are sent while you are a customer.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or receive a portable copy of your personal data, to object to processing (including direct marketing), and to withdraw consent. To exercise them, email help@eveniris.com. We may need to verify your request, and we respond within the time the law requires. If we decline your request, you may appeal by replying to our decision. In the UK or EU you can also complain to a data protection supervisory authority.
US state notices
The categories of personal information we collect, their sources, purposes, recipients and retention are described above. We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising. You will not be treated differently for exercising your rights.
Consumer health data
This section is our consumer health data privacy policy (including under Washington’s My Health My Data Act and Nevada law). IRIS does not seek health information, but conversations, transcripts, summaries and memories you create may contain it, and voiceprints and audio from which they can be derived may be treated as consumer health data. We collect it from you and your device for the purposes described in this policy — providing IRIS, cloud backup, and quality review — and share it only with the categories of service providers listed above, or as you direct. We do not sell it. You can confirm, access, delete, or withdraw consent for our processing of it as described under Your rights.
Children
IRIS is for people aged 18 or older and is not directed to children. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it. Contact help@eveniris.com.
Changes to this policy
We may update this policy. We will post the new version on this page with a new “Last updated” date.
Sufi Plugins, LLC, Maryland, USA · help@eveniris.com · Terms · Fair use · IRIS