Privacy Policy

Who This Policy Is For

Everwood Tech LLC builds software for small local businesses. Two groups of people interact with us:

• Business customers, the business owners and staff who create an account and use our dashboard and products. During the current Everwood Inbox release, only an authorized business owner may connect or access Gmail.
• End customers, the people who book an appointment or leave feedback through a business that uses our tools.

For most end-customer information, the business you interacted with is the data controller, and Everwood Tech is the data processor that stores and handles data on that business's behalf. End customers should direct access or deletion requests to that business. We help the business honor those requests.

Information We Collect

Contact Forms

When you contact us, we collect the information you provide, such as your name, email, and message. We use it to respond. For spam and abuse prevention, we may also look up the approximate city, state, and country associated with your IP address.

Business Account Information

When you create an account, we collect:

• Email address and password, with passwords handled by our authentication provider and never stored in plain text
• Business name, contact details, time zone, and time-format preference
• Business configuration, branding, and customization settings
• Product access and subscription records

Booking and Customer Information

When the Booking product is used through the chat assistant, booking wizard, or embedded widget, we store information needed to schedule and manage appointments on the business's behalf. This can include customer name, optional phone number and email, selected services and add-ons, selected or assigned team member, appointment date and time, party size, status, and notes or preferences.

We also store each business's services, availability schedules, and worker profiles, which may include a name, contact details, photo, short bio, and social links.

Chatbot and AI Conversation Data

Our Booking product includes an AI-assisted chat experience. We store conversation messages, extracted booking context, and the IP address associated with the session. Conversation content is sent to OpenAI to generate responses, and some sessions may use an internal knowledge-base service. These practices do not apply to Gmail data from Everwood Inbox. Gmail data is not sent to OpenAI or used to train Everwood's general AI features.

Review Capture Information

Review Capture may store a star rating, optional written comment, the QR code or link used, approximate location, a one-way hashed IP value for abuse prevention, and whether the customer continued to a Google or Yelp review page. Lower-rating notifications may be sent to the business through our automation provider.

Support Communications

If you submit a support request, we collect the subject, message, and follow-up correspondence. Do not include Gmail message content unless support confirms that a specific excerpt is necessary and you give explicit permission for that access.

Cookies, Logs, and Technical Data

We use essential cookies for site, dashboard, and authentication functions. With explicit analytics consent, our marketing site records limited pseudonymous interactions such as page views and selected signup, demo, or successful contact-form milestones. We do not send contact-form contents, account data, authentication values, payment information, free-text fields, or sensitive query strings to marketing analytics. Analytics consent can be declined or changed through Cookie Preferences. We process limited technical data such as IP address and browser details for security, rate limiting, and approximate geolocation. Our error-monitoring and structured-logging controls are configured to filter sensitive fields and Gmail content.

Google Account and Gmail Data

Connecting Google is optional. Everwood Inbox requests read-only access to Gmail so an authorized business owner can view email inside Everwood Business OS. One Google account may be connected per business during the current release.

Inbox loads Gmail information on demand to show the connected owner's inbox and selected messages. This information is processed temporarily by Everwood's application hosting and network infrastructure and displayed only to the authorized owner. Gmail data is not added to customer CRM records, marketing profiles, analytics datasets, or Everwood AI features.

Accessed from Google

• Connected Google account identity, including the mailbox email address
• Gmail threads and messages
• Sender and recipient information
• Subject lines and snippets
• Timestamps and unread status
• Message bodies and thread structure
• Attachment names, MIME types, sizes, and inline status

Stored by Everwood

• Connected account email address
• Provider, granted scope, and connection status
• Encrypted Google authorization credential
• Credential key version and other safe connection metadata
• Connection, access-health, reconnect, disconnect, and update timestamps
• Limited security, audit, and operational information that does not contain Gmail message content

Not permanently stored by Everwood Inbox

• Gmail message bodies or snippets
• Inbox search results
• Unread status
• Full thread history
• Attachment files or attachment bytes

Read-only and privacy protections

Everwood Inbox cannot send, reply, forward, archive, delete, star, label, snooze, or otherwise modify Gmail. It does not request attachment bytes. Remote images are blocked to reduce tracking, and email HTML is sanitized before it is displayed inside a restrictive sandboxed frame. The stored Google authorization credential is encrypted at rest and is available only to server-side application controls.

Limited use and human access

Everwood does not sell Gmail data or use it for advertising, lending or credit decisions, unrelated profiling, or training general AI models. We do not permit routine human access to Gmail content. Narrowly limited human access may occur only with the user's explicit permission to view specific data, when necessary for a security or abuse investigation, or when required by law. Personnel and service providers must use Google data only to provide and secure the owner-facing Inbox feature.

Everwood's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and revoking access

The owner can disconnect Google from the Everwood Inbox configuration page. Everwood then attempts to revoke access with Google, removes the locally stored authorization credential, and stops future Gmail API access. The owner can also revoke Everwood through the third-party access settings in their Google Account. If Google authorization is revoked, expires, or becomes invalid, the owner may need to reconnect.

Disconnecting does not modify or delete email in Gmail. Limited connection metadata, security records, audit logs, operational records, legal records, or encrypted backup copies may remain according to our retention practices. See Google Data Use and Deletion for step-by-step instructions.

How We Use Information

• Respond to inquiries and provide requested services
• Operate, maintain, secure, and improve our website and products
• Create and manage accounts, product access, and subscriptions
• Schedule and manage appointments for business customers
• Power AI-assisted chat and booking features, excluding Gmail data
• Collect and route customer feedback through Review Capture
• Display live Gmail threads and messages to the authorized business owner through Everwood Inbox
• Send transactional emails such as confirmations, reminders, and account notices
• Prevent fraud and abuse, secure the platform, and provide support

We do not sell or rent personal data or share it with third parties for their own marketing. Gmail data is not used for advertising, lending or credit decisions, unrelated profiling, general AI model training, customer CRM records, or product analytics.

Service Providers We Share Data With

We use service providers to operate our products:

• Google, OAuth authorization and the Gmail API for optional Everwood Inbox access; Google also hosts public review pages customers may choose to visit
• Heroku, application hosting and request processing
• Cloudflare, network routing, security, and encrypted web traffic delivery
• OpenPanel, self-hosted, consent-gated marketing analytics for limited pseudonymous website interactions
• Supabase, database, authentication, storage, encrypted Inbox connection records, audit records, and operational metadata
• Sentry, error monitoring with filtering and masking controls
• Resend, transactional email delivery
• OpenAI, AI chat and booking-assistant responses, not Everwood Inbox Gmail data
• Upstash (Redis), rate limiting and selected short-lived application caching, not Everwood Inbox Gmail data
• ipapi.co, approximate IP-based geolocation, not Everwood Inbox Gmail data
• n8n, internal notifications and selected knowledge-base lookups, not Everwood Inbox Gmail data
• Yelp, a public review site customers may choose to visit

Gmail content passes through Heroku application memory while an Inbox request is processed and through Cloudflare as encrypted web traffic to the authorized owner. Supabase stores encrypted connection credentials and limited connection records, not Gmail message bodies or attachment files. We do not intentionally send Gmail content to the other providers listed above.

We may change providers over time and may disclose information when required by law or necessary to protect users and the platform, subject to the additional limits on Google user data stated above.

Features That Are Not Active Yet

• Text messaging: SMS sending is not active today. Booking currently sends notifications by email.
• Paid billing: Product access is currently free. We will update this policy before introducing billing data practices.
• Calendar connection: We provide add-to-calendar links and do not connect to or read a calendar account.

Data Retention

We keep personal information only as long as needed for the purposes in this policy.

• Account and business data is kept while the account is active and afterward as reasonably needed for legal, security, fraud-prevention, audit, operational, or dispute-resolution purposes.
• Booking and customer records are retained for the business while active so it can manage appointments and history.
• Chat sessions not connected to a booking are automatically deleted after about 90 days. Sessions tied to an appointment are kept with that appointment.
• Review Capture feedback is retained for the business; location and abuse-prevention data may be aggregated or anonymized over time.
• Everwood Inbox does not permanently store Gmail message bodies, snippets, search results, unread state, full thread history, or attachment files. Connection metadata, audit logs, security records, operational issues, provider logs, and backups are retained only as needed for the purposes described here. Concrete Inbox retention periods are under review and will be published when approved.

When information is no longer needed, we delete or anonymize it unless law, security, fraud prevention, an audit need, a legal hold, or backup practices require longer retention.

Account Deletion and Reactivation

You can deactivate a business account from the dashboard. Deactivation signs the owner out and blocks access, but retains records for reactivation, security, fraud prevention, audit, operations, and legal needs.

To request reactivation, account deletion, or data erasure, email support@everwoodtech.tech from the account owner's address and identify the business. We verify and process requests subject to legal, security, fraud-prevention, audit, operational, and backup retention requirements. We do not promise that every retained record or backup is deleted instantly.

Security

We use HTTPS in transit, encrypted Google authorization credentials at rest, server-side access controls, owner-only Inbox authorization, authentication safeguards, rate limiting, and tenant-scoped access. Email remote images are blocked and HTML is sanitized before rendering in a restrictive sandboxed frame. Everwood Inbox does not permanently store Gmail bodies or attachment files. No online service can guarantee absolute security, but we use reasonable safeguards and review them as the service evolves.

Responsibilities of Business Customers

A business using Everwood is responsible for:

• Telling customers how their data is collected and used and obtaining required consent
• Using customer data only for lawful business purposes
• Honoring customer privacy requests
• Having authority and organizational permission to connect and view a Gmail mailbox through Everwood Inbox

Children's Privacy

Our products are intended for businesses and adults. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided information.

Your Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, or receive a portable copy of personal data.

End customers should direct requests to the business they interacted with. Business owners and others making a request directly to Everwood can contact us below. We may verify identity and authority before acting.

Legal Basis, Jurisdiction, and International Processing

Everwood Tech LLC is based in the United States. Where applicable, we process personal data based on the need to provide requested services, legitimate interests, legal obligations, or consent.

Everwood and its providers may process information in the United States and other countries where they operate. Those locations may have different data-protection laws. Where required, we use appropriate contractual or other legal safeguards for international processing.

Changes to This Policy

We may update this policy as products and legal requirements evolve. We will update the date above and provide additional notice when required.