Privacy Policy

Who we are

everdata ("we", "us") is a service run by everdata, Inc. that brings a business's sales, ads, books and staff data from the tools it already uses into one place. You can reach us about anything in this policy at [email protected].

We play two roles, and this policy covers both:

• For your account (your name, email and how you use everdata) we decide what is collected and why. We are the controller of that data.
• For your business data (everything we read from the tools you connect) you decide what we read and why. We process it only to run everdata for you. You are the controller and we are your processor.

What we collect

When you create an account

• Your name and email address.
• A password, which we store only as a one-way hash, or your Google account ID if you sign in with Google. With Google sign-in we receive only your name, email address and Google account ID.
• Your workspace details: business name, website, sector, country, currency, time zone, and the competitors and keywords you choose to track.
• Billing details. Payments are handled by Stripe. We keep your Stripe customer and subscription IDs and your plan, never your card number.

When you use everdata

• The questions you ask the assistant and its answers, so you can return to a conversation.
• The dashboards, alerts and reports you create, and who should receive them.
• A record of what happened in your workspace (sources connected, refreshes, reports sent) and how much of your plan you have used.

When you connect a tool

We read data from the tools you connect, such as your till, accounting software, online store, payments, staff rota, ad accounts and social media accounts. Depending on the tool this can include sales, orders, products, invoices, ad spend and results, and staff shifts and pay rates. Some tools include personal data about your customers (for example a name and email on an order) or your staff (for example names, shifts, pay and types of leave). We read only what you connect, and everdata only reads: it never changes, posts or deletes anything in your tools.

To connect a tool we keep the access token or key it gives us, encrypted with AES-256-GCM. We never see your password for that tool.

Public market information

If you track competitors, we collect public information about the businesses you name: Google ratings and reviews (including the reviewer's public display name), search volumes, estimated website traffic, and public Instagram and TikTok posts and comment text. We do not store the usernames of people who comment.

Data from Google and Meta

If you connect Google Ads or Meta (Facebook and Instagram) ads, you sign in with that company and choose which ad accounts to share. We ask only for permission to read: for Meta, ads_read; for Google Ads, the Google Ads API scope. We read campaign, ad set and ad names, spend, impressions, clicks, conversions and similar results, and we use them only to show you your own advertising results next to the rest of your business.

everdata's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, use it to train AI models, or let anyone read it except as needed to run everdata for you, to keep it secure, or to comply with the law.

You can remove our access at any time from everdata, from your Google account permissions, or from your Facebook Business Integrations settings. To have the data itself deleted, see Data deletion.

Why we use it

• To run the service you signed up for: build your dashboards, answer your questions, send the alerts and reports you set up, and keep your data up to date. (Performance of our contract with you.)
• To bill you and keep the records the law requires. (Contract and legal obligation.)
• To keep everdata secure and working: preventing abuse, fixing faults and supporting you when you ask. (Our legitimate interest in running a safe, reliable service.)
• To email you about your account: sign-in codes, password resets, invitations, and the alerts and reports you choose to receive. We do not send marketing email.

We do not sell personal data, and we do not use your business data for advertising.

AI

everdata uses AI models to answer your questions, design dashboards and write reports. To do that, the relevant part of your data (for example your question and the figures that answer it) is sent to the AI provider for that request. When we show the AI sample records to work out how a new tool's data is laid out, we first remove names, email addresses, phone numbers, addresses and secrets. We do not use your data to train AI models.

Who helps us run everdata

We share data only with the service providers we need, and only what each one needs:

We also send your own access tokens back to the tools you connected, to read your data from them. We may disclose data if the law requires it.

Where your data is kept

When you sign up you choose where your business data is stored: the European Union (Amsterdam) or the United States (California). Account and billing details are kept in the European Union. Some of the providers above, including the AI providers, may process data in other countries, including the United States. Where data leaves the European Economic Area or the United Kingdom we rely on the safeguards the law provides, such as the European Commission's Standard Contractual Clauses.

How long we keep it

• Your account and business data are kept while your account is open.
• If you disconnect a tool, its data is kept so you can reconnect without losing history, until you choose Delete data for that source.
• When you delete your account (Settings, Account, then Delete account) we delete your account and, if you own the workspace, all of its business data straight away and cancel your plan. Copies in our backups disappear as those backups expire. Stripe keeps the invoices the law requires. We keep only anonymous records of what running your account cost us, which say nothing about you or your business.
• Sign-in sessions last 30 days. Invitations expire after 7 days. Password reset links expire after 1 hour.

Cookies

everdata uses one cookie, ed_session, which keeps you signed in for up to 30 days. It is strictly necessary, so we do not ask for consent. We also keep a few display preferences (such as your selected period and sidebar state) in your browser's own storage. We use no analytics, advertising or tracking cookies, and no third-party trackers.

Security

Access tokens and keys are encrypted with AES-256-GCM. Passwords are stored only as bcrypt hashes. Each workspace has its own separate database schema. Everything is sent over HTTPS.

Your rights

Depending on where you live (for example under the GDPR, the UK GDPR or the California Consumer Privacy Act) you can ask to see, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email [email protected] and we will answer within one month. You can also complain to your local data protection authority.

If you are a customer or employee of a business that uses everdata, that business controls your data. Please contact them first; we will help them answer you.

Children

everdata is a service for businesses and is not meant for anyone under 16.

Changes

If we change this policy we will update the date at the top, and tell you by email before any change that affects how we use your data.