Privacy Policy

Everrun is operated by [[PLACEHOLDER: legal entity name]], [[PLACEHOLDER: registered address]], registration number [[PLACEHOLDER: company registration number]], VAT ID [[PLACEHOLDER: VAT ID]] (“Everrun”, “we”). For anything in this policy, contact privacy@everrun.dev.

We wear two hats, and your rights differ under each:

Controller— for your own account data: your sign-in email, your agency name, your team’s invitations, your billing status. We decide how this data is handled, and this policy governs it.

Processor — for the data you enter about your own clients: client records, contact details, notes, and the names of the automations we monitor for you. You decide why that data exists; we only process it to run the service, under the Data Processing Addendum that forms part of our Terms.

Account and team.Your email address (your sign-in identity) and your agency’s name. If you sign in with Google, our authentication provider (Supabase) receives your Google name and profile picture alongside your email and keeps them in its authentication records — the Everrun application itself never reads or displays them; it uses only your email address. When you invite a teammate, we store the invited email address so the invitation can work.

Signup attempts.If a signup is submitted for an address that already has an account, we email that address a notice and keep a hashed record of the address for 30 days so repeat submissions don’t trigger repeat emails. The hash is derived from the address, and we treat it as personal data.

Client records you create. Client names, contact names, contact email addresses, and free-text notes. You author this content; only the client name is required.

Monitoring metadata.Connection names and instance URLs, automation names (as named on your platform), run statuses, timestamps, durations, and sanitised error messages (see the next section for exactly what “sanitised” means).

Alert settings. The email addresses you choose to receive alerts and digests — these can be any addresses you enter, not just registered users.

Billing. Your plan, billing interval, trial and subscription status, and pseudonymous Stripe reference IDs. Payment details go directly to Stripe and never reach us (see below).

Collected automatically. An authentication session cookie (see Cookies, below). Our authentication provider, Supabase, keeps security records of sign-ins — timestamps and IP addresses — in its authentication audit log. Our hosting provider, Vercel, keeps standard request logs, which include IP addresses. We run no advertising trackers. We do use product analytics (PostHog) — a handful of product events and masked session recordings from the app UI, described in full in the next section. When something in the product breaks, an error report (error message, stack trace, request URL) is sent to Sentry, our error-monitoring service — see the sub-processor table.

This is the most important section of this policy, so it comes before the legal machinery:

We never fetch or store your automations’ execution payloads — the content your workflows actually process. We store status metadata — succeeded, failed, when, how long — and error messages with credential-shaped content stripped and length-capped. One honest qualifier: error text is authored by your own workflows, so if a workflow puts personal data into its error message, a fragment of it can appear in the stored, sanitised message and in the alert email about that failure. We strip credentials, tokens and secrets from these messages; we do not rewrite their remaining words.

We never see card numbers. Payment happens on Stripe-hosted pages. No payment-instrument data of any kind touches our code or our database.

We run no advertising trackers. No third-party scripts load on any page. Fonts are served from our own domain.

We do use PostHog for product analytics, configured to collect as little as we could make it: three product events (signing up, creating a connection, upgrading), page views, and session recordings of the app UI with all text and inputs masked. It stores nothing on your device — no cookie, no local storage — IP addresses are discarded on arrival, events travel through our own domain to PostHog’s EU (Frankfurt) cloud, and recordings are deleted after 30 days.

We do use Sentry for error monitoring: when something in Everrun breaks, a report of the failure goes to Sentry’s EU (Frankfurt) region so we can fix it. That report includes the error message, stack trace and request URL, along with technical context such as browser, environment and a trail of the recent actions that led to the failure. Cookies and authentication headers are stripped before it leaves our systems, and error messages pass through the same sanitiser that strips credentials from errors we store. As with those stored errors, an error report can incidentally contain personal data that appeared in the underlying failure. Error reports are sent only when something fails; they are not analytics.

Connection credentials are for reading only. For n8n and Make, the API keys you connect are used solely to read workflow and run metadata from your instances — Everrun never writes to your systems. For Zapier, we never connect to your account at all: your Zaps send us a heartbeat, and the only credential involved is an inbound token that authenticates those pings to us.

We process your account, monitoring, alerting and billing data to perform our contract with you — that is the service you signed up for. We process sign-in security records — and our anti-enumeration measures: the notice email we send when someone signs up with an already-registered address, and the hashed 30-day record that prevents repeats — under our legitimate interest in keeping the service secure. We process product-usage analytics — events and masked recordings — under our legitimate interest in understanding and improving the product. We retain billing records where legal obligations (tax and accounting law) require it. We do not send marketing email and do not rely on consent for any current processing. We make no automated decisions about you that produce legal or similarly significant effects.

Your data is stored and processed in the EU: the database and authentication run in Supabase’s Frankfurt (Germany) region, and our application functions are pinned to Vercel’s Frankfurt region. Two narrow, accurate caveats: static page assets and the session-check layer of our web app run on Vercel’s global edge network (that layer reads session cookies and never touches the database), and some sub-processors below are US companies.

Where a sub-processor processes personal data outside the EEA, the transfer relies on an approved safeguard: the EU–US Data Privacy Framework where the provider is certified, or the European Commission’s Standard Contractual Clauses incorporated into the provider’s data-processing terms. A copy of the applicable safeguard is available in each provider’s published legal terms, or from us on request.

These are the third parties that handle personal data to run Everrun — all of them, and what each one actually receives:

We will update this table and notify account email addresses at least 30 days before any new sub-processor handles personal data.

Run history and resolved alertsare pruned daily to your plan’s window: 7 days on Free, 90 days on Growth, 365 days on Scale. Open (unresolved) alerts are kept until resolved.

Account data — your agency, users, clients, connections and settings — is retained until you ask us to delete it, or until your account is terminated for breach — in which case the Terms give you 30 days to request an export before deletion. There is no automatic expiry of accounts.

Backups are encrypted on our own equipment before they are stored anywhere — no storage provider ever holds a readable copy — and are retained for up to 90 days. Data you delete can persist in these encrypted backups until they age out.

Session recordings of the app UI (all text and inputs masked) are deleted after 30 days.

Signup-attempt records (a hash of the submitted address) are deleted after 30 days.

Sub-processors retain data under their own published schedules (for example, Stripe’s retention of billing records required by financial regulation).

Stated as facts about the running system, not aspirations: the API credentials you connect are encrypted at the application layer with AES-256-GCM before storage, and the encryption key is held in our hosting environment, separate from the database. Credentials are decrypted only at the moment of polling. Every tenant table is protected by row-level security, so one agency can never read another’s rows. Error messages are stripped of credential-shaped content before storage. We store no execution payloads. Backups are encrypted before they leave the machine that makes them. All traffic is encrypted in transit. Our own application code deliberately writes no logs; the one exception is error reports sent to Sentry when something breaks, with cookies and authentication headers stripped before sending. The infrastructure logs kept by Supabase and Vercel are described above.

No certification or external audit claim appears here because we do not currently hold one.

You can ask us for access to, correction of, erasure of, restriction of, or a portable copy of your personal data, and you can object to processing based on legitimate interests. Email privacy@everrun.dev and we will respond within one month. Today, erasure and export are handled as a careful manual process by us rather than a self-serve button; deletion removes your data from live systems — except records we are required to keep under tax and accounting law — with residual copies persisting in encrypted backups for up to 90 days as described above.

You also have the right to complain to a supervisory authority — for us that is the Slovenian Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si), or the authority where you live or work.

If we hold your details because an agency entered them — as a client contact, an invited teammate, or an alert recipient — that data came from the agency, not from you. For client records the agency is the controller, so your request is best sent to them, and we will help them respond. For invitation and alert-recipient addresses, contact us directly at the address above.

Everrun sets no analytics or advertising cookies — our analytics deliberately stores nothing in your browser. The complete list:

Everrun is a business tool for agencies. It is not directed at children, and we do not knowingly collect children’s data.

We will post changes here with a new “Last updated” date, and notify account email addresses at least 30 days before material changes take effect.

Terms of Service · Data Processing Addendum