Attorney-review draft — not legally approved
This document has been drafted but has not been reviewed by a lawyer. It is published here so you can see our intent and so counsel can review it. It is not a final agreement, and EveryContact Technologies, Inc. does not represent it as legally approved or enforceable.
Privacy Policy
What personal information is collected, why, and what rights people have.
Draft prepared for review · EveryContact Technologies, Inc.
Who we are
EveryContact Technologies, Inc. operates EveryContact. For your business’s own customer data we act as a processor on your instructions; for your business account data we act as a controller.
Information we collect
From the business: account and contact details, business information, business hours, service areas, services, knowledge base content, emergency contacts, billing details (payment card data is handled by our payment processor and never reaches our servers).
From your customers, on your behalf: phone number, the content of messages they send and receive, name and service address where they provide them, details about the property and the problem, appointment times, and consent records with their evidence and timestamps.
Automatically: timestamps, delivery statuses, usage counts, and a salted hash of IP addresses for abuse prevention. We do not retain raw IP addresses.
What we do not do
We do not sell personal information.
We do not use your customers’ conversations to train AI models.
We do not share your data with other businesses using the service. Isolation is enforced at the database level.
We do not write message bodies, addresses or contact names into application logs.
Why we process it
To provide the service you purchased: responding to inquiries, qualifying leads, notifying your team, scheduling appointments.
To comply with messaging law and carrier requirements: consent records exist specifically so that compliance can be demonstrated.
To prevent fraud and abuse, and to control costs.
To bill you accurately.
Sub-processors
Supabase (database, authentication, storage) — United States.
Anthropic (AI model) — United States. Message content is sent for the purpose of generating a response.
Twilio (messaging and call events) — United States.
Stripe (payments) — United States.
Resend (transactional email) — United States.
Google (calendar integration, only where you connect it) — United States.
Vercel (hosting) — United States.
[ATTORNEY REVIEW REQUIRED: confirm this list is complete and current before publication, and whether a DPA is required with each.]
Retention
Retention periods are configurable by the business and default to: conversation transcripts two years, closed leads five years, call records one year, consent records seven years (longer, because they are the evidence for messages already sent).
Deleting a contact removes their records; consent evidence is retained with identifiers redacted, because it evidences communications that already happened.
Rights
A consumer wishing to exercise rights over their data should contact the business they interacted with, which controls that data. We support businesses in fulfilling export and deletion requests.
For account data held about a business, contact support@tryeverycontact.com.
[ATTORNEY REVIEW REQUIRED: specific rights language and response deadlines for CCPA/CPRA, and other state privacy statutes in scope.]
Security
Credentials and OAuth tokens are encrypted at rest. Access between businesses is isolated by database row-level security. Administrative access requires multi-factor authentication and is audit-logged.
No independent penetration test or third-party certification has been obtained as of this draft. We do not claim one.
Open questions for counsel
Published deliberately. These are the points we know we cannot resolve ourselves, listed so a reviewer can start with them rather than discover them.
- Which state privacy statutes apply given the customer base, and the required disclosures and response deadlines for each.
- Whether the controller/processor split is correctly characterized for a service that applies its own safety rules to message content.
- Whether sending customer message content to an AI provider requires specific disclosure or consent beyond this policy.
- Whether the consent-record retention period (7 years) is correct for TCPA statute-of-limitations purposes.
- Required content and format of a "Do Not Sell or Share" notice, if applicable.
- Children’s data: whether any additional measures are needed given the service is business-to-business.