Privacy Policy

Plain-language draft. This policy describes, in good faith, what Everform actually does with data today. It has not yet been reviewed by counsel; if anything here is unclear, ask us before relying on it.

Who is responsible

The data controller is Hidle Everform, org. nr. 936 448 003, Norway — operated by its founder. The working contact channels below reach the person who is accountable, directly; a registered postal address will be added with counsel review.

What we collect

• Account data (from you, at sign-up): your email address and, if you sign in with Google or GitHub, the name and avatar that provider shares.
• Workspace content (from you, as you use the product): the context, documents, and workflow descriptions you give Eve, and the workflows, scores, and evidence records the platform produces from them.
• Operational telemetry (generated by the product): product events such as feature usage and errors, tied to your account where you are signed in. No third-party advertising or analytics trackers run on this site.
• Billing data (from Stripe, if you subscribe): subscription status and invoice references. Card details never touch our servers.

Why we process it, and on what legal basis

• Running the product for you — storing your workspace, generating and scoring workflows, authentication. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Improving and securing Everform — operational telemetry, error diagnosis, abuse prevention. Legal basis: our legitimate interest in operating a reliable, secure service (Art. 6(1)(f)) — weighed against your interests; telemetry contains no advertising profile and is not shared.
• Billing — subscription management and legal bookkeeping. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c)).

We do not sell personal data, run advertising, or build profiles for third parties.

AI processing

Eve is an AI system: whenever you talk to Eve or ask it to draft or evaluate a workflow, you are interacting with an AI. To generate that output, the context you provide is sent to our model provider — currently OpenAI. Everform does not use your workspace content to train models; the data-handling terms of the provider integration are being pinned with counsel and will be stated here with a source. Structural workflow scoring is deterministic, runs entirely on our own infrastructure, and makes no model calls.

Who processes data on our behalf

• Supabase — database and authentication, hosted in the EU.
• Cloudflare— application hosting and delivery. Compute runs on a global edge network; stored data stays in the EU database. Transfers are covered by Cloudflare’s standard data protection terms (including Standard Contractual Clauses where applicable).
• OpenAI— AI model processing (US-based). Where data leaves the EEA, we rely on the provider’s standard contractual protections; the exact transfer mechanism is being pinned with counsel and will be named here.
• Stripe — payment processing.

If this list changes, this page changes with it — the changelog records when.

How long we keep it

• Account and workspace data: for the life of your account, deleted within 30 days of a verified deletion request or account closure.
• Operational telemetry: up to 12 months, then deleted or anonymised.
• Billing records: as long as Norwegian bookkeeping law requires.
• Backups:deleted data leaves automated backups as they roll off the provider’s backup window.

Your rights

You can ask for access, correction, deletion, restriction, portability (export), or object to processing based on legitimate interest. Make any of these requests by replying to any email Everform has sent you (your sign-in emails work) or via the contact details on your Stripe receipt. We verify the request comes from the account owner, fulfil it manually today, respond within 30 days, and confirm by email when done. If you believe we handle your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

Cookies

This site sets only essential cookies: session, authentication, and your theme preference. There are no third-party trackers, which is why there is no cookie banner.

Automated decisions

Everform scores workflows, not people. No decision with legal or similarly significant effect on you is made automatically. Workflow scores are recommendations to a human operator, who decides.

Age

Everform is a business tool for users 18 and over. We do not knowingly process children’s data.

If something goes wrong

If a breach affects your personal data, we notify Datatilsynet within 72 hours where required, and affected users without undue delay, with what we know and what we are doing about it.

Contact

Reply to any email Everform has sent you, or use the contact details on your Stripe receipt. We are an early-stage company — a human founder answers.