Privacy Policy

The short version

• We only process what you fill in when you send an enquiry, plus your IP address for a brief spam check.
• We keep your enquiry for no more than 6 months, then delete it unless it leads to working together.
• Your IP address is gone within 3 hours at most. Technical logs are kept for 14 days and contain no IP addresses or form contents.
• No cookies, no analytics, no third-party scripts or embeds.
• The website runs on Amazon Web Services (AWS) in Ireland. Enquiries arrive in our mailbox at Google Workspace.
• We do not sell your data or use it for advertising.

1. Who we are

This privacy policy covers the website withever.ai. Ever is a trade name of Ever Services. Ever is the controller of the personal data collected through this website. For anything privacy-related, reach us at privacy@withever.ai.

2. What data we process

When you send an enquiry through the contact form

• your name;
• your email address;
• your company name (optional);
• your message.

We also record the language of the page and give your enquiry a random reference number so we can find it again. Please include only what your question needs. We do not ask for special categories of personal data, such as health or religion.

When you visit the website
Your IP address, used briefly to prevent spam and abuse (see sections 3 and 4). We use no cookies or local storage, no analytics, and no third-party scripts, fonts or embeds. Everything loads from withever.ai itself.

3. Why we process it, and on what basis

Purpose	Data	Legal basis (GDPR)
Answering your enquiry and getting in touch	Form data	Your request for contact, prior to a possible contract (Art. 6(1)(b))
Preventing spam, duplicate submissions and abuse of the form	IP address (as a hashed code), a fingerprint of the submission	Legitimate interest: a secure, usable website (Art. 6(1)(f))
Running and securing the website and fixing faults	Technical logs, without IP addresses or form contents	Legitimate interest: availability and security (Art. 6(1)(f))

How the spam check works. A firewall (AWS WAF) allows at most 10 submissions per 5 minutes per IP address and blocks oversized submissions. The server then turns your IP address into a hashed code. That code limits the number of attempts per visitor, and per visitor combined with an email address. To recognise duplicate submissions we keep a fingerprint of the submission, not the message itself. All of this exists only in the server's working memory and is never written to a database or disk.

We make no decisions about you based solely on automated processing. At most, the spam check temporarily blocks new submissions, and you can always email us instead.

4. How long we keep data

Data	Retention
Enquiries sent through the form	No more than 6 months after receipt. If it leads to working together, we keep the data for as long as that requires and as long as the law obliges us to.
Hashed IP code for the spam check	Up to 15 minutes
Fingerprint against duplicate submissions	Up to 1 hour
Firewall sample (IP address, requested page, technical headers)	Up to 3 hours
Technical server logs (without IP addresses or form contents)	14 days

Data held only in working memory also disappears immediately whenever the server restarts.

5. Who we share data with

We do not share your data with third parties for their own purposes, and we do not sell it. We work with two service providers that process your data only on our instructions:

Amazon Web Services (AWS): hosting, CDN, firewall and email sending

• Amazon CloudFront delivers the website to your browser.
• AWS WAF protects the website and the form against abuse.
• AWS Lambda (Ireland region) runs the website and processes the form.
• Amazon SES (Ireland region) forwards your enquiry by email to our mailbox.
• Amazon Route 53 provides DNS for withever.ai.

Google (Google Workspace): our mailbox
Your enquiry arrives in a shared Ever mailbox at Google Workspace, with your email address as the reply-to address so we can answer you directly.

Both providers are bound by data processing terms under the GDPR. Beyond that, we only disclose data when the law requires us to.

6. Data outside the European Economic Area

The website runs, and the form is processed, in the AWS Ireland region. CloudFront delivers pages through servers in Europe, North America and Israel, usually the one closest to you. If you are outside Europe, your request may therefore be handled outside the EEA. Israel is covered by an adequacy decision of the European Commission.

AWS and Google are US companies, so data may be processed in the United States, including in the Google mailbox. Both are certified under the EU-U.S. Data Privacy Framework, and their data processing terms also include the European Commission's Standard Contractual Clauses as a safeguard.

7. Cookies

withever.ai sets no cookies and uses no local storage, analytics or other tracking technologies. If that changes, we will update this policy and, where required, ask for your consent first.

8. Links to other services

The "Workfloor login" link takes you to a separate Ever service (demo.hq.withever.ai). This privacy policy covers only the website withever.ai, not that service.

9. Security

We take appropriate technical and organisational measures to protect your data. Traffic to the website is encrypted (HTTPS). A firewall protects the form. Only the people who handle enquiries have access to the mailbox. And we keep no more data, for no longer, than we need.

10. Your rights

You have the right to:

• access your data;
• have incorrect data corrected;
• have your data deleted;
• restrict processing;
• object to processing based on legitimate interest;
• receive your data in a common format (portability).

Send your request to privacy@withever.ai. We respond within one month and may first ask you to confirm the request really comes from you. We need your name, email address and message to answer your enquiry. Your company name is optional.

11. Complaints

If you are unhappy with how we handle your data, please tell us first at privacy@withever.ai. You always have the right to lodge a complaint with a supervisory authority. In the Netherlands, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You can also complain to the authority in the EU country where you live.

12. Changes

We may update this privacy policy, for example when the website or our service providers change. The date at the top shows when it was last updated. We will make significant changes clear on the website.