Last updated 1 November 2026. This is written in plain words on purpose. If anything here is unclear, write to hello@getcevora.com.
Who we are
Cevora is software for water treatment dealers, made by Cevora, based in Indianapolis, Indiana, USA. This policy covers getcevora.com, the Cevora application at app.getcevora.com and each dealer’s own address under getcevora.com, and the emails and texts the application sends.
Two kinds of people, two kinds of data
Dealers – the businesses that sign up for Cevora and their staff. We hold your account details (name, email, phone, business name and address), your billing details, and what you put into the application.
A dealer’s customers and leads – the people whose details a dealer enters or collects through Cevora: names, addresses, phone numbers, emails, water test results, quotes, contracts, payments, and the messages exchanged. For this data the dealer is the controller and Cevora is the processor: we store and process it on the dealer’s instructions, to run their business, and for nothing else. If you are a dealer’s customer and want your data changed or removed, ask the dealer; we will help them do it.
What we collect on getcevora.com
Pages visited and basic device information, through privacy-respecting analytics. If you fill in the demo form, the details you enter (name, business, phone, email, what you told us) become a lead in our own Cevora account and we will contact you about Cevora. If you text us, standard text-message rules apply – see the texting policy.
What the application collects
What you type in. Sign-in records. The text and email messages sent and received through your connected accounts, including delivery status. Payment events from your connected Stripe account – we hold the record of what was charged, not your customers’ card numbers, which stay with Stripe. Signatures on quotes, with the signer’s name, time and IP address, because a signed contract needs that.
Who else touches the data
Cevora runs on services that process data for us under contract: Supabase (database and authentication), Vercel (hosting), Stripe (payments), OpenPhone (texting and calling, on the dealer’s own account), Resend (email delivery), and Google or Meta only where a dealer connects their own advertising account to measure leads. None of them may use the data for their own purposes. We do not sell personal data, to anyone, and we do not share a dealer’s customer list with anyone.
Where it lives and how it is protected
Data is stored in the United States. Every dealer’s data is separated from every other dealer’s at the database level. Access inside Cevora is by role and permission; access by Cevora staff is limited to what support needs. Connections are encrypted in transit and data is encrypted at rest.
How long we keep it
For as long as the dealer’s account is open. When a dealer closes their account, they can export everything first; we delete the account’s data within 90 days of closure except where the law requires a longer hold (for example payment records). Backups age out on their own schedule after that.
Your rights
Dealers can see, correct, export and delete their data from inside the application or by asking us. A dealer’s customers should ask their dealer, who can do the same for their record; if you cannot reach the dealer, write to us and we will help. Residents of states with privacy laws (such as California) have the rights those laws give, and we honour them for everyone.
Cookies
The application uses a sign-in cookie and settings stored in your browser so it works. The website uses analytics that do not track you across other sites. We do not use advertising cookies on getcevora.com.
Children
Cevora is for businesses. We do not knowingly collect information from anyone under 18.
Changes
If this policy changes in a way that matters, we will tell dealers by email before it takes effect and update the date at the top.
Contact
Cevora, Indianapolis, Indiana. hello@getcevora.com