Privacy policy

The short version: your workspace data is yours, lives in its own database, and we don't track you. Here's the longer version.

What we collect

• Account details: your email, organization name, and workspace address, collected at signup to create and administer your workspace.
• Billing: handled entirely by Stripe. Card numbers never touch our servers; we receive only subscription status and receipts metadata.
• Workspace content: whatever your team puts in your workspace, including mail you receive or import. It's stored in your own isolated database and processed only to provide the service.
• Connected account data, only if you connect one: your Google or Microsoft sign-in details, the access tokens we are given, and the calendar events you choose to sync. See Connected accounts.
• Notification subscriptions, only if you turn notifications on: an address for each device that receives them. See Push notifications.
• Operational logs: standard server logs (IP, timestamp, request path) kept briefly for security and reliability.

What we never do

• No cookies for tracking, no advertising trackers, no cross-site tracking, here or in your workspace. This site runs no analytics at all: no measurement script, no analytics cookies. The only record of your visit is the standard server log described above.
• No selling, pooling, or mining of your data, and no sharing of it beyond the service providers named under Who else sees it, which handle it only to run the service.
• No training of AI models on your content.
• No third-party cookies.

Connected accounts (Google and Microsoft)

You can connect a Google or Microsoft account to your workspace. Connecting is always your choice. Nothing is requested from Google or Microsoft until you choose Connect, and nothing in this section happens to you if you never connect an account. Connections are being switched on workspace by workspace, so you may not see a Connect button in yours yet.

What we ask Google for

If you connect a Google account, we request these permissions and no others:

• Sign-in details (your email address and name), to show which Google account is connected.
• Calendar events on calendars you own (the calendar.events.owned permission), to show your Google Calendar events in your workspace calendar, so the booking page can treat the events you organize as busy time, and to keep the events you sync in step in both places.
• Sending email from your Gmail address (the gmail.send permission), so you can send email from your Gmail address inside the EVERJUST webmail. This is available only if you connect your Gmail account. It is send only: EVERJUST never reads, lists, or deletes your Gmail messages, and we do not ask for any permission that would.

What we ask Microsoft for

If you connect an Outlook or Microsoft 365 account, we request these permissions and no others:

• Sign-in details (your email address and name), to show which Microsoft account is connected.
• Calendar events (the Calendars.ReadWrite permission, read and write), to show them in your workspace calendar and keep synced events in step.
• Sending email from your Outlook or Microsoft 365 address (the Mail.Send permission), so you can send email from that address inside the EVERJUST webmail. This is available only if you connect the account, and we use it only to send messages you choose to send.

We do not ask Microsoft for permission to read your mailbox, and importing mail from an Outlook or Microsoft 365 account is not offered yet.

We update this page before we ask for any additional permission.

How we use and protect it

• Only to provide the feature you connected: showing your events, working out your availability, and sending messages you choose to send. Nothing else.
• Stored in your own workspace. Access and refresh tokens are stored in your own workspace database, never in a shared one, and are readable only by workspace administrators and the service. Calendar events you sync become workspace content like any other, under your workspace's own access rights.
• The secret stays with us. The secret that identifies EVERJUST.APP to Google and Microsoft is held only by our central control plane service, not by any workspace. That service passes your tokens straight to your workspace and does not keep them.
• Deleted when you leave. Tokens are deleted when you disconnect the account and when the workspace is deleted.

Google API Services User Data Policy

EVERJUST.APP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can read that policy at developers.google.com/terms/api-services-user-data-policy.

In plain terms, for everything we receive from your Google account:

• We do not sell it, and we do not use it for advertising.
• We do not share it with anyone except service providers that help us run EVERJUST.APP under contract (see Who else sees it), or when the law requires it.
• No person at EVERJUST.APP reads it unless you give your consent, it is needed for security (for example to investigate abuse), or it is needed to comply with the law.
• We do not use it to develop, improve, or train artificial intelligence or machine learning models.

Events you organize in your workspace are sent to the calendar you connect, and that includes bookings people make with you through your booking page: the booking name (the appointment type and the customer), the time, the customer's notes and the place. The customer is not added as a guest of the copy, so their email address is not sent with it.

Disconnecting and revoking access

• In your workspace: open your Profile Settings, then Connections (in the webmail, Settings, then Connections), or open Calendar and use the menu on the account under Connected calendars, and choose Disconnect. Syncing stops and the stored tokens are deleted. Events already copied into your workspace are workspace content like any other, and you can delete them in Calendar.
• At Google: remove EVERJUST.APP's access at myaccount.google.com/permissions.
• At Microsoft: for a personal account, use account.live.com/consent/Manage. For a work or school account, remove the app from your organization's app permissions; your administrator can do this too.

Importing mail from other providers

You can copy mail you already have into a mailbox in your workspace in two ways. You can upload an .mbox or .eml file, for example a Google Takeout export. For a file import, your browser reads the file and sends its messages to your workspace in small batches; the file itself is not uploaded or kept. Or you can import directly from another account over IMAP: Gmail, Yahoo, iCloud, Fastmail, or another provider that offers IMAP. Importing from Outlook or Microsoft 365 is not offered yet. Importing directly from another account is on unless an administrator has switched it off for your workspace, and an administrator can limit who may use it.

• Your credentials are used only for the import. The password you give us to read the other mailbox, an app password where your provider offers them, is used while the import runs and is never stored. For each folder listing and each batch of messages we keep a record of who ran it, which mailbox, the provider, the kind of folder, the counts, how long it took and the outcome. It holds no password, no server name, no user name, no folder name and no message content. Only mail administrators can read these records, and records older than 30 days are deleted the next time anyone in your workspace lists the folders of an account to import, so they can stay longer in a workspace that stops importing.
• It is a copy. We read the other mailbox without changing or deleting anything in it. The copy is stored in your own mailbox, in your workspace database, like mail you receive, and from then on it is workspace content under this policy. It is a one-time copy, not an ongoing sync.
• Only mailboxes you own or are authorised to access. Import only mail you have the right to import.

Push notifications

The webmail can notify you of new mail in your browser, or in the web app installed on your device, even when the page is closed. Notifications stay off until you allow them in your browser or device, and until an administrator has switched the feature on for your workspace.

• What we store. When you allow notifications, your browser or device gives us a push subscription: an address at its maker's push service, and the keys needed to encrypt notifications to that device. We store one for each of your devices, against your user, in your workspace database, and use it only to send you notifications.
• What passes through the push service. The notification is encrypted to your device. The push service (run by your browser or device maker, for example Google, Mozilla, or Apple) relays it and sees only the encrypted payload.
• Previews. Under Settings, Notifications, you can choose to show the sender and subject, or only "New message" and the mailbox name. With previews hidden, the sender and subject are not sent in the notification at all. You can also choose to be notified of nothing.
• Stopping. Block notifications in your browser or device settings, or choose Nothing under Tell me about. To have a stored subscription deleted, email us.

The EVERJUST iPhone app has its own push token, described in the iPhone app section below.

Administrators and mailbox access

Workspace administrators can read every mailbox in the workspace, including a mailbox that belongs to one person. This comes with the administrator role and is not a setting an individual can turn off. The webmail shows an administrator only their own mailboxes, but the administrator screens in Settings, and anything acting with an administrator's access, such as an API key or an AI agent connected as that administrator, can open any mailbox.

If you use a mailbox in a workspace run by your employer or another organization, assume its administrators can read it. What they do with that access is between you and your organization.

Cookies & on-device storage

You can change these choices anytime via Cookie preferences in the footer.

Where your data lives

Each workspace runs on its own dedicated PostgreSQL database, with no shared tenancy and no cross-workspace queries. Traffic is encrypted in transit (TLS), passwords are stored as salted hashes, and every workspace database is backed up before every platform update. More in Security & data.

Who else sees it

We use a small number of service providers to run EVERJUST.APP. Each handles your data only to provide its part of the service, under its own agreement with us. We name them here, and we update this page when we add or change one that receives your content.

• Amazon Web Services (United States) hosts the platform and every workspace database. For workspaces that use the built-in mail, Amazon SES delivers and receives the email.
• Stripe takes payments and holds billing records. Card numbers never touch our servers.
• Resend sends system email from EVERJUST.APP, such as account and notification messages.
• OpenAI, L.P. runs the AI model behind the agent in the EVERJUST iPhone app. It receives content only through that app, as described in the iPhone app section below.
• Google and Microsoft, only if you connect an account. We exchange data with them as described under Connected accounts, and send them nothing else.
• Your browser or device maker's push service (for example Google, Mozilla, or Apple), only if you turn notifications on. It sees only the encrypted notification.
• Optional integrations that an administrator switches on, such as calling or text messaging, send the data they need to the provider that integration uses. They are off until an administrator sets them up.

We do not give any of them your data for advertising. We disclose data when the law requires it.

Keeping and deleting your data

Step by step instructions for deleting your data, including how to revoke access at Google and Microsoft, are on the data deletion page.

• Workspace content, including imported mail, stays in your workspace until you or an administrator delete it. Deleting a mailbox deletes the messages and attachments in it.
• Connected account tokens are deleted when you disconnect the account and when the workspace is deleted.
• Import credentials are never stored, so there is nothing to delete.
• Backups. A backup of every workspace database is taken before every platform update. We do not expire these backups automatically, so a backup can still hold data you deleted after it was taken. If you ask us to delete a workspace, we also remove it from the backups we hold and tell you when that is done.
• Deleting a workspace. On cancellation your workspace stays available through the period you have paid for, so export what you need first. We delete workspace data on request. A person at EVERJUST.APP does this and confirms when it is done.

Your rights

• Access & export: export records from any list view, bulk-download files, export a mailbox as an .mbox file, or request a full export.
• Correction & deletion: edit or delete your data in the workspace anytime, and ask us to delete a workspace, as described under Keeping and deleting your data and on the data deletion page.
• Control of connections: disconnect an account, or turn off notifications, whenever you like, and revoke access directly at Google or Microsoft.
• Questions or requests: email company@everjust.co and a human will handle it.

The EVERJUST iPhone app

This section applies only if you use the EVERJUST iPhone app — the one where you text an agent that does work in your workspace. If you only use EVERJUST in a browser, nothing below happens to your data. Everything above still applies either way.

Policy version 2026-07-01 — this is the version the app records when you accept the disclosure on first run. It changes only when what you agreed to changes, which is not the same as the last-updated date below.

What the app processes

• Your messages to the agent, and the workspace records the agent reads or writes to act on them — the customers, invoices, leads, tasks or email drafts it had to open to answer you.
• Sign-in and session data — the email address you sign in with, an account identifier derived from your workspace and user number, and an encrypted key scoped to your workspace so the agent can keep working while your phone is asleep. Your password is passed straight to your own workspace to authenticate you and is never stored.
• A device push token, if you turn notifications on, and a random per-install identifier so signing out can be scoped to one device. Neither is an advertising identifier; the app contains no advertising or analytics code of any kind.
• Operational logs and token counts — errors and usage totals, so we can run the service and show you what you have used. Message contents are not written to logs.

Who else sees it

OpenAI, L.P. is the AI model provider behind the agent. Your messages, and the workspace records the agent read in order to answer, are sent to OpenAI's models to produce each reply. This data is not used to train models — OpenAI's API terms do not train on business API data. The app shows you this before anything is sent and our server refuses to forward a single message until it has recorded your acceptance.

OpenAI is the only third party that receives your content. There are no advertising networks, no analytics vendors, and no crash reporting service. Processing happens in the United States.

Which provider runs the agent is a deployment setting, and this paragraph is the one place that names the current one. If we ever add or change a provider, this page changes in the same breath — a provider we have not named here is a provider we are not allowed to send your data to.

How long it is kept

We do not age anything out automatically. Conversations, the records the agent quoted back to you, and your encrypted workspace key are kept until you delete them or delete your account. The service has automatic retention windows built in and they are deliberately switched off, because deleting your work on a timer you did not choose is worse than keeping it. If we ever turn one on we will state the period here first.

Backups taken for disaster recovery can still contain data for a period after you delete it. They are never used to answer you.

Deleting it

Settings → Account → Delete account removes your app footprint: your conversations and their history, the encrypted workspace key, your device token, and your saved settings. Deleting a single conversation removes it and any action still waiting for your approval inside it. Settings → Data and privacy also exports everything the app holds about you, in one file.

Two things deliberately survive deleting your account, and neither holds any of your content:

• your account identifier, kept as a tombstone so a session issued before the deletion can never be replayed against us; and
• the consent record — the account identifier, the policy version you accepted, the install you accepted it on, and when. It is the record that this disclosure was actually shown to you, so it has to outlive the account it is about.

Your underlying business data lives in your workspace and is governed by the rest of this policy and your EVERJUST agreement. Deleting the app, or your app account, does not delete your workspace.

What the agent remembers

The app can list, and let you delete, short facts the agent has noted about how you work. That feature is not switched on in this deployment: the agent is noting nothing, and the list in Settings → Memory is empty for everyone. The screen ships first on purpose — being able to see and delete what is stored is the precondition for storing anything. If we turn it on, this section changes before it does.

What the app will not do without you

• The AI provider key never ships inside the app. Your workspace key is stored encrypted and used only to carry out your instructions.
• Every action that changes a record, deletes anything, or sends mail stops and asks you first, naming exactly what it is about to do. Nothing happens until you tap approve, and declining costs nothing.
• The agent can only reach what your own workspace login can reach. It is not an administrator.

Changes

If this policy changes materially, we'll note it here and, for significant changes, email workspace administrators. We update this page before we ask Google or Microsoft for any additional permission.

Last updated: 2 October 2026