// legal

Privacy Policy

Last updated:

1. Introduction

This Privacy Policy explains how Everstack Labs Limited ("Everstack", "we", "us", "our") collects, uses, and protects personal data when you use everstack.ai, our APIs, command-line tools, dashboards, and related services (collectively, the "Service").

Everstack is the data controller for personal data we collect about visitors to our website, account holders, and the individual users we administer on behalf of business customers. When we process content that a business customer submits to the Service on behalf of their own end-users, we act as a data processor under that customer's instructions, governed by our Data Processing Agreement.

We are a company registered in Ireland. We operate the Service from infrastructure located in the European Union.

This policy applies to personal data covered by the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. Defined terms in those laws (for example, "personal data", "processing", "controller", "processor") have the same meaning in this policy.

2. Information We Collect

Information you provide

  • Account details - name, email, organisation name, role, and password (stored as a salted hash).
  • Billing information - billing contact, billing address, VAT number, and payment-method details handled by our payments processor. Card numbers and CVCs are never stored on our servers.
  • Content and configuration - prompts, system messages, evaluation datasets, agent definitions, sandbox files, and any other content you submit to the Service.
  • Support and communication - messages you send to our team, including by email, in-product chat, or our community channels.

Information collected automatically

  • Service telemetry - IP address, user-agent, device and browser details, request paths, latency, status codes, and error events.
  • Product analytics - page views, feature interactions, and session metadata collected through our analytics provider, PostHog, hosted in the EU. We do not use third-party advertising trackers.
  • Cookies - see Section 5 below.

Information from third parties

  • Identity providers - when you sign in with Google, GitHub, Microsoft, or another supported identity provider via WorkOS, we receive your name, email, profile picture, and a unique identifier so that we can authenticate you.
  • Payment processor - Stripe shares transaction status, last four card digits, and dispute information so we can manage your billing.

3. How We Use Your Information

We use personal data to:

  • provide, maintain, and secure the Service, including authentication, billing, support, and abuse prevention;
  • operate the LLM gateway, route inference requests to providers you select, and surface observability data back to you;
  • send transactional communications (account verification, security alerts, billing notices, service updates);
  • send product and marketing communications, where you have opted in or where we have a legitimate interest and you have not objected;
  • analyse usage patterns to improve product quality, reliability, and security;
  • detect, prevent, and respond to fraud, abuse, and security incidents;
  • comply with legal obligations, including tax, accounting, and lawful requests from authorities.

4. Legal Bases for Processing

We rely on the following GDPR Article 6 legal bases:

  • Contract performance (Art. 6(1)(b)) - to deliver the Service, manage your Account, process payments, and provide support.
  • Legitimate interests (Art. 6(1)(f)) - to secure the Service, prevent abuse, analyse usage, develop new features, and send product communications to existing customers, balanced against your rights and freedoms.
  • Consent (Art. 6(1)(a)) - for non-essential cookies and marketing emails sent to non-customers. You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)) - to retain billing records and respond to lawful requests.

For special categories of personal data (Art. 9), we rely on explicit consent or another available basis only where strictly necessary. We discourage you from submitting special-category data to the Service.

5. Cookies and Similar Technologies

We use a small number of cookies and similar technologies:

  • Essential - session cookies that keep you logged in and protect against cross-site request forgery. These cannot be turned off without breaking the Service.
  • Analytics - first-party cookies set by PostHog to measure feature usage and aggregate session behaviour. You can opt out of analytics via the cookie banner or your browser's Do Not Track signal.

We do not use third-party advertising or cross-site tracking cookies.

6. Sharing and Subprocessors

We do not sell personal data. We share it only with the categories of recipient listed below, and only as needed to provide the Service.

| Subprocessor | Purpose | Location | Privacy policy | | --- | --- | --- | --- | | Cloudflare | DNS, CDN, R2 object storage | Global | cloudflare.com/privacypolicy | | OVHcloud | Compute and managed Kubernetes (k3s) | EU (France) | ovhcloud.com | | Resend | Transactional email delivery | EU/US | resend.com/legal/privacy-policy | | PostHog | Product analytics (EU-hosted instance) | EU | posthog.com/privacy | | WorkOS | Authentication and SSO | US | workos.com/privacy | | Stripe | Payments and billing | EU/US | stripe.com/privacy | | LLM Providers (Anthropic, OpenAI, Google, etc.) | Inference requests you choose to route | Varies | Their own policies |

When you route inference traffic through the Service to a third-party LLM Provider, that provider receives the prompt, context, and any tool outputs needed to fulfil the request. Their handling of that data is governed by their own terms and privacy policy.

We may also share personal data with professional advisers (lawyers, accountants, auditors) under confidentiality obligations, and with regulators, courts, or law-enforcement authorities where required by law.

If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred. We will notify you before any transfer becomes subject to a different privacy policy.

7. Data Retention

We retain personal data only for as long as we need it for the purposes described in this policy:

  • Account data - kept while your Account is active. After cancellation, we retain it for up to ninety (90) days to allow for reactivation and export, then delete or anonymise it.
  • Prompt and response logs - retained according to your tenant's configured retention window. Default is thirty (30) days, maximum 365 days. You can shorten this in your settings.
  • Telemetry and analytics - aggregated indefinitely; raw event data retained for up to 12 months.
  • Billing and tax records - retained for seven (7) years to comply with Irish statutory accounting requirements.
  • Backups - encrypted backups are rotated on a rolling 35-day cycle and overwritten in the normal course.

We may retain information longer where required by law, to resolve disputes, or to enforce our agreements.

8. International Transfers

Primary processing takes place in the European Union. Where personal data is transferred outside the EEA (for example, to a subprocessor based in the United States), we rely on legally recognised transfer mechanisms, including the European Commission's Standard Contractual Clauses, supplemented by additional safeguards where appropriate.

You can ask us for a copy of the transfer mechanism in place for a specific transfer by emailing [email protected].

9. Security

We take security seriously and apply layered controls, including:

  • TLS 1.2+ in transit and AES-256 at rest for stored data;
  • least-privilege access controls, single sign-on, and audit logging for our internal systems;
  • segregated tenant data with explicit tenant-scoping checks on every request path;
  • regular dependency and infrastructure patching;
  • periodic penetration testing by an independent assessor; and
  • a documented incident-response process.

No system is perfectly secure. If you suspect a vulnerability, please disclose it responsibly to [email protected].

10. Your Rights

Subject to applicable law, you have the right to:

  • Access - request a copy of the personal data we hold about you.
  • Rectification - ask us to correct inaccurate or incomplete data.
  • Erasure - ask us to delete your personal data, where one of the legal grounds applies.
  • Restriction - ask us to limit how we process your personal data while a request is resolved.
  • Portability - receive your personal data in a structured, commonly used, machine-readable format.
  • Objection - object to processing that we conduct on the basis of legitimate interests, including direct marketing.
  • Withdraw consent - withdraw any consent you previously gave, without affecting the lawfulness of prior processing.
  • Lodge a complaint - complain to your data-protection supervisory authority. In Ireland, this is the Data Protection Commission (dataprotection.ie).

To exercise any of these rights, email [email protected]. We will respond within one month and may ask you to verify your identity before we act.

If you are an end-user of a business customer (for example, your employer uses Everstack), please direct your request to that customer first. We will assist them in responding.

11. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [email protected] so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version at this URL and update the "Last updated" date below. For material changes, we will give at least thirty (30) days' notice by email or in-product notification before the changes take effect.

13. Contact

For privacy questions, data-subject requests, or exercising any of the rights above: