Last updated 10 September 2026 · Governed by PIPEDA, Canada's federal privacy law
Everly is made by Everly AI, a company based in Ontario, Canada. In this policy, "we" and "us" mean the company. "Everly" means the product.
We are subject to Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how we handle personal information in the course of commercial activity.
Our Privacy Officer is accountable for everything in this policy and can be reached at shabari@helloeverly.ai with any question, request, or complaint. The company accountable for your information, and the one to name in any complaint, is 1001719226 Ontario Inc., operating as Everly AI.
Your name, your email address, and the name of your business, given when you sign up.
The facts you tell her about your business, documents you upload, your website if you ask her to read it, the conversations you have with her, and the working notes she keeps so she remembers your business between conversations. All of it sits inside your workspace and nowhere else.
If you connect Google, Everly asks for the narrowest permissions that let each feature work: reading your Gmail so she has the context to draft a reply, composing and sending a message you have approved, and creating or updating calendar events you have approved. You can disconnect at any time, and nothing about Everly requires you to connect anything at all.
Drafts, summaries, proposed calendar events, and any images she makes for you, along with the instruction she wrote to make them, kept so you can see and revise her reasoning.
Your plan, your usage, and your payment history. Card details are handled by Stripe, our payment processor. We never see or store your card number.
Sign-in records, product usage events, error reports, and a per-workspace record of the computing each request consumed, which is what your usage allowance is measured against.
Only to run Everly for you: to answer you with your business in mind, to prepare the drafts and events you ask for, to carry out the actions you approve, to bill you accurately, and to find and fix problems.
We do not use your information for advertising. We do not build profiles of you to sell to anyone. We do not share what we learn about your business with any other business, including your competitors.
If a use of your information would not obviously help you, we are not doing it.
Creating an account is your consent to the handling described here. Connecting Google is a separate, explicit consent that you give at the moment you connect it, and it is the only thing that gives Everly any reach into your mail or calendar.
You can withdraw either at any time. Disconnecting a connected account is self-serve and immediate: we stop reaching it and revoke our access tokens on the spot. Closing your account withdraws the rest, and we delete your information on the schedule in section 8.
Everly answers you using large language models. Your question, together with the parts of your business context needed to answer it, goes to the model provider, the answer comes back, and nothing stays behind. We do this under business agreements that forbid the provider from retaining your information or training on it. Your business does not become anyone's training data.
Everly is an AI, and she says so. Every message she helps you send on your behalf carries that disclosure. We do not offer a mode that hides it, and we will not build one.
Everly's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide the features you asked for. It is never used for advertising, never sold, and never read by a human except for security purposes, to comply with the law, or with your explicit permission, for example when you ask our support team to look at something.
Everly runs as a separate workspace for every business she works with. What she learns about your business is available only inside your workspace. Another business cannot reach it, and what she learns working for them never reaches you.
If we ever want to learn from patterns across businesses in a way that could touch your information, we will ask you first, in language you can act on, and a no will cost you nothing.
Some of what you say to Everly is about other people: a patient, a client, a customer. That information belongs to them as much as to you, so the default is that she does not keep it.
Where your work involves confidential records, in health, legal, and financial services, Everly offers a setting that lets her retain details about the individuals you serve. It is off unless you turn it on, and before it turns on she asks you to confirm that the people concerned have agreed. If you ask her directly to remember something, she remembers it, because that is an instruction rather than an accident.
You may have privacy obligations of your own to the people you serve. Everly is built so that using her does not quietly put you in breach of them. The choice is yours to make, on purpose, once.
While your account is active we keep what you have taught Everly, because that is what makes her useful. When you close your account or ask us to delete your information, we delete it from live systems within 30 days, and it ages out of our backup copies within 90 days.
| Information | How long we keep it |
|---|---|
| Account details | While the account is active, then deleted within 30 days |
| Business facts and uploaded documents | While the account is active. You can edit or delete any fact yourself, at any time |
| Conversations | While the account is active, then deleted within 30 days |
| Connected account tokens | Revoked immediately on disconnect or closure |
| Gmail and calendar content read for a task | Not warehoused. Fetched to do the work, then dropped. Only facts you confirm and drafts awaiting your approval persist |
| Items waiting for your approval | Until approved or declined, then swept |
| Error and usage logs | 90 days, rolling |
| Billing records | Seven years, as Canadian tax law requires |
Deleted information is never restored except in a disaster recovery, and if a backup is ever restored we re-apply every deletion that had been made.
We use a small number of service providers to run Everly: cloud hosting and databases, network security, AI model providers under the no-training terms in section 5, payment processing, transactional email, and error monitoring. Some of them process information in the United States, which means it may be subject to lawful access requests in that country.
We choose providers whose contractual protections are comparable to what PIPEDA requires, we bind them to use your information only to provide their service to us, and we remain accountable to you for your information while it is in their hands.
We will tell you exactly which providers we use, by name, on request to shabari@helloeverly.ai.
You can ask us at any time to:
Write to shabari@helloeverly.ai. We acknowledge within seven days and answer within 30, which is the deadline PIPEDA sets. We may need to confirm your identity first, because handing your information to someone impersonating you would be its own kind of breach.
If you are not satisfied with how we handle your request, you can complain to the Office of the Privacy Commissioner of Canada. We will tell you that in our answer, not bury it.
Encryption in transit. Credentials for your connected accounts encrypted at rest. Separation between workspaces enforced in the system itself, not by convention. Access by our team limited to what is needed to support you and fix problems, and logged when it happens.
And one safeguard built into the product rather than the infrastructure: nothing leaves your business without your explicit approval. No email sent, no calendar invitation issued, no record changed. Everly drafts and proposes, you decide.
We keep a record of every breach of our safeguards, whether or not it is reportable, for at least 24 months, as PIPEDA requires. Where a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as soon as feasible, and tell you plainly what happened, what it affected, what we have done, and what you should do.
Everly is a tool for businesses, offered to people aged 18 or over acting for a business. She is not directed at children, and we do not knowingly collect information from anyone under 18. If we learn that we have, we delete it.
If this policy changes in a way that matters to you, we will tell you inside the product before the change takes effect, not by quietly editing this page and moving the date. The date at the top always reflects the current version.