Privacy policy

EverFlow Automations provides AI automation services for businesses. For the purposes of this policy, EverFlow Automations is the controller of information you send to us directly, and a processor of customer information that a client business stores in its workspace.

Information we collect

When you contact us

• Your name, email address, phone number if you provide one, company name, and message.
• The date you submitted the inquiry and your consent record.
• A rate-limiting fingerprint derived from your IP address and browser. We do not keep the raw IP address for this purpose.

When you use the platform

• Account name, email address, role, and a password stored only as a salted hash.
• Session data, including a hashed session token, creation time, expiry, and browser user agent.
• A hashed device identifier used to send an alert when a new browser signs in.
• Two-factor authentication data: an encrypted TOTP secret, keyed recovery-code hashes, and short-lived login challenges.
• Audit events for sign-ins, configuration changes, tool calls, and workflow runs.
• Billing status, plan, setup-payment status, and Stripe customer and subscription identifiers. Card details are entered directly into Stripe Checkout and are not stored by EverFlow.

Customer data in a client workspace

Client businesses store customer names, contact details, conversations, appointments, and lead information in their own isolated workspace. We process that information on the client's instructions. If your information is in a client's workspace and you want it corrected or deleted, contact that business first. We will assist them.

How we use information

• To reply to inquiries and prepare proposals.
• To provide, secure, and maintain the platform.
• To generate assistant replies and perform permitted actions in a client workspace.
• To send transactional messages that a client has configured.
• To detect abuse, prevent duplicate messages, and maintain audit logs.
• To process plan payments, setup fees, renewals, and billing support through Stripe.
• To meet legal, tax, and accounting obligations.

We do not sell personal information, and we do not run advertising trackers on this site.

AI processing

Assistant conversations are sent to the AI model provider selected for that workspace. Depending on the client's configuration, that provider may be OpenAI, Anthropic, Google, or a self-hosted or compatible provider. Message content is processed to generate a reply and decide whether a permitted tool should run.

We do not use client workspace data to train AI models. Each provider's handling of data is governed by that provider's terms. Client businesses choose their provider and should review those terms before enabling an assistant.

AI assistants are instructed not to request payment card numbers, government identification, passwords, or detailed medical information. Please do not send sensitive information through a chat widget.

Legal bases

Where applicable, we rely on: performance of a contract, our legitimate interest in operating and securing the service, your consent for optional communications, and compliance with legal obligations.

Service providers

We use service providers for hosting and storage, AI model inference, telephony and SMS, email delivery, CRM synchronization when a client connects one, and payment processing. Stripe processes checkout and subscription payments; we send it the account email, selected plan, and a workspace reference, and it returns billing and subscription status. They receive only the information needed for the service they provide. The specific providers enabled for a client workspace are visible in that workspace's integration settings.

Retention

• Contact inquiries are kept for up to 24 months unless a business relationship continues.
• Platform audit logs are kept for up to 12 months.
• Workspace conversations and customer records are kept while the client account is active, then deleted or returned within 30 days of a written request, unless a legal obligation requires otherwise.
• Session records expire after 14 days, or after 24 hours without activity. Two-factor login challenges expire after 10 minutes; unused recovery codes remain until replaced or 2FA is disabled.

Security

Passwords are hashed with PBKDF2-SHA256. Sessions use HTTP-only cookies. Integration credentials are encrypted before storage. Access to workspace data is checked on the server for every request, not only in the interface. No system is perfectly secure, and we cannot guarantee absolute security.

Your rights

Depending on your location, you may request access, correction, deletion, restriction, or portability of your personal information, and you may object to certain processing or withdraw consent through the account controls in your workspace or the process in your service agreement. We will respond within the period required by applicable law. You may also complain to your local data protection authority.

International transfers

Our service providers may process information outside your country. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

Children

The platform is intended for businesses. It is not directed to children, and we do not knowingly collect information from children.

Cookies

We use an essential session cookie for sign-in, an essential device-recognition cookie for new-device alerts, and a short-lived 2FA challenge cookie when two-factor authentication is enabled. Read the cookies policy for details.

Changes

We may update this policy as the service changes. The date at the top of the page shows the latest version. Material changes will be communicated to account holders.

Contact

Questions about this policy are handled under your service agreement.