Privacy Policy

1. Who we are and scope of this Policy

This Privacy Policy explains how EverXCloud Inc., a Delaware corporation ("EverXCloud", "we", "us", "our") collects, uses, discloses and otherwise processes personal information in connection with the everxcloud.ai website, the Portal, the EverXCloud application programming interface, our support channels, our communications and the other Services we provide.

We act as the controller (or "business" under United States state privacy laws) for the personal information described in this Policy. This Policy does not apply to the data that Customers place on Instances or other resources of the Services; we process that data on behalf of the Customer, as described in Section 10 and in the Data Processing Addendum.

This Policy is written to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the GDPR as retained in the law of the United Kingdom ("UK GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the California Online Privacy Protection Act, the Delaware Online Privacy and Protection Act and the other United States state privacy laws that may apply to us. Where a right or obligation below depends on the law that applies to you, we say so.

Capitalised terms not defined in this Policy have the meaning given to them in the Terms of Service, available at everxcloud.ai/legal/terms.

2. Controller and contact details

The controller of your personal information is EverXCloud Inc., a Delaware corporation, registered office: 8 The Green, Suite #19720, Dover, DE 19901, United States.

For any question about this Policy or to exercise your rights, write to [email protected], with "Privacy" in the subject line, or send a letter to the address above, marked for the attention of the Privacy team. We answer privacy requests in English and in the other languages in which the Services are offered.

Individuals in the European Economic Area, the United Kingdom and Switzerland may address any question or request concerning the processing of their personal information directly to us at [email protected]. Doing so does not limit your right to lodge a complaint with a supervisory authority (see Section 20).

3. Personal information we collect

We collect the following categories of personal information. The sources are indicated for each category.

• Account and identity data (from you and from our authentication provider): name, email address, password or credentials of the sign-in method you choose (managed by our authentication provider; we never receive your password), account and organisation identifiers, role within an organisation, preferred language, acceptance of our terms and the date and version accepted.
• Business and billing data (from you): customer type (Individual Customer or Business Customer), company name and legal name, company registration number, VAT or other tax identification number and the result of its validation, billing address, billing email address, country and region, preferred currency.
• Payment and transaction data (from you, from our payment processor and generated by the Services): top-ups, Prepaid Balance movements, Orders, Spot Orders, Reservations, Hour Packs, Promotional Credits, invoices and credit notes, payment status and the limited payment method details made available to us by our payment processor (for example card brand, last four digits and expiry date). Full card numbers are collected and stored by our payment processor, never by us.
• Identity verification and due diligence data (from you and, where used, from our identity verification provider): when our verification thresholds are reached, verified name, date of birth, country and type of identity document and, where reviewed manually, a copy of the identity document; for Business Customers, company registration documents and the names, dates of birth, nationalities, countries of residence and ownership percentages of beneficial owners.
• Sanctions and geographic compliance data (generated by us): the result of screening names and countries against public sanctions lists, any potential match and its review, and the country associated with the IP address from which the Services are accessed.
• Usage and technical data (generated by the Services and collected automatically): IP address, approximate country derived from it, browser and device information, request logs, error reports, Instance and API usage records, API key and SSH public key metadata, security and audit events.
• Website audience and advertising data (collected by the tools described in the Cookie Policy, only with your consent): pages viewed, referring page, click identifiers of advertising networks, browser and device information and IP address.
• Sign-up source data (from the link you follow): campaign parameters, referring domain and landing page, the name of the advertising network when the link carries a click identifier and, with your consent to advertising cookies, that click identifier, as described in Section 5.
• Support data (from you): the content of support requests, messages, attachments, satisfaction ratings and conversations with the support assistant, together with your name and email address when you contact us without an account.
• Form data (from you): data submitted through the contact form, the capacity request form or the data center application form, such as name, email address, company, country, the content of your message and, for anti-abuse purposes, your IP address.
• Business contact data (from public business sources, commercial business data providers and from you): see Section 6.
• Communications data (from you and generated by us): emails we send you and their delivery status, your communication preferences and unsubscribe requests.

You are not required to provide personal information to visit the website. Account, billing and, where requested, identity verification data are necessary to open and operate an account; if you do not provide them, we may be unable to provide the Services.

4. Purposes and legal bases

We use personal information only for the purposes below. For individuals in the European Economic Area and the United Kingdom, the legal basis under Article 6(1) of the GDPR and of the UK GDPR is indicated for each purpose.

• Creating and administering your account, authenticating you and providing the Services you order (Instances, Spot Orders, Reservations, Hour Packs, API access): performance of a contract with you, or our legitimate interest in performing the contract with the Business Customer for which you act.
• Processing top-ups, managing the Prepaid Balance, issuing invoices and credit notes and calculating taxes: performance of a contract and compliance with legal obligations (accounting and tax law).
• Verifying identity and business information, screening against sanctions lists and enforcing geographic restrictions required by export control and sanctions laws: compliance with legal obligations to which we are subject and, where those obligations arise under laws other than EU or UK law, our legitimate interest in complying with the laws that apply to our business and in preventing financial crime.
• Preventing fraud, abuse and security incidents, enforcing the Acceptable Use Policy and protecting the Services, our Customers and Providers: legitimate interest.
• Responding to support requests and operating the support assistant: performance of a contract or, for visitors without an account, our legitimate interest in answering your request.
• Sending service and transactional communications (for example payment confirmations, low-balance warnings, incident notices): performance of a contract and legitimate interest.
• Answering contact, capacity and data center application requests: steps taken at your request prior to entering into a contract, or legitimate interest.
• Measuring the performance of our acquisition channels in aggregate form: legitimate interest.
• Measuring the audience of the website with Google Analytics, and measuring the results of our advertising and showing it to relevant audiences with the advertising networks listed in the Cookie Policy, including by reporting sign-ups and first payments linked to a click identifier: your consent.
• Business-to-business prospecting: legitimate interest, as described in Section 6, or your consent where the law requires it.
• Improving, monitoring and debugging the Services: legitimate interest.
• Establishing, exercising or defending legal claims and responding to lawful requests from public authorities: legitimate interest and compliance with legal obligations.

Where we rely on legitimate interest, we have weighed our interest against your rights and freedoms; you may obtain more information on that assessment and object at any time as described in Section 16. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

We do not use personal information to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, except as described in Section 7, which provides for human review.

5. Sign-up source

When you create an account, we record how you reached us: the campaign parameters of the link you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the domain of the referring website and the first page you visited on this website. These values travel in the sign-up link and are stored with your account, without any cookie or browser storage, and never include your name or email. We use them for aggregate statistics on our channels (legitimate interest).

If the link that brought you to the website carried a click identifier added by an advertising network (for example gclid for Google Ads or msclkid for Microsoft Advertising), the sign-up link carries the name of that network, which does not identify you, and we record it with your account. If you also accepted advertising cookies in the consent banner, the sign-up link carries that identifier too, and we record it with your account; until then, it is kept with your sign-up details at our authentication provider, which removes it once it has been recorded. We may then report to that network that the click led to a sign-up or to a first payment, so that it can measure the results of our advertising (your consent). Such a report contains only the click identifier, the type of event, its date and time and, for a first payment, its amount and currency; it does not contain your name, email or account details. Without that consent, or if your browser sends a Global Privacy Control signal, no click identifier is passed or recorded. Withdrawing consent does not affect reports already sent.

These values are kept for as long as your account exists and are deleted or anonymised with the account. The click identifier is deleted no later than 90 days after the visit that brought it.

6. Business contacts and prospecting

To find organisations that may need GPU compute capacity, we maintain a database of business contacts. It contains the name of the organisation, its website, sector, size, country and city and, where available, the name, job title, professional email address, professional telephone number and public professional profile address of a contact person, together with notes on our exchanges.

We obtain this information from the following categories of sources: information that organisations and professionals make publicly available for business purposes (such as company websites, press releases and professional directories), commercial providers of business contact data, contacts we meet in the course of our business, and people who contact us or submit a capacity request.

We process this information on the basis of our legitimate interest in promoting our Services to organisations whose activities relate to them, limited to contact details related to the professional function of the person concerned. Where the law of the country of the recipient requires prior consent for electronic marketing, we do not send marketing emails without that consent. We do not sell or rent this database.

Every prospecting email identifies EverXCloud, states how we obtained the contact details and contains a link to this Policy and a one-click unsubscribe link. You may object at any time, free of charge and without giving reasons, by using that link, by replying "STOP" or by writing to [email protected]. After an objection, we keep only the minimum information necessary to ensure that you are not contacted again.

Where open and click measurement is enabled for a prospecting campaign, we record whether a message was opened or a link was clicked. Contacts that do not become customers are deleted three years after the last activity concerning them.

7. Identity verification, sanctions screening and geographic restrictions

Because we provide GPU compute capacity worldwide, we are required to comply with United States export control and sanctions laws and we apply the sanctions programmes of the European Union and the United Kingdom. For that purpose:

• we determine the country associated with the IP address of each request to the Portal and the application programming interface, using a geolocation database hosted on our own servers, and we refuse access from countries and regions where we do not provide the Services. Only the country is recorded, not the IP address, for this purpose;
• we screen the names of account holders, organisations, verified individuals and beneficial owners, and billing countries, against the sanctions lists published by the United States Office of Foreign Assets Control, the United Kingdom and the European Union;
• when the value of your purchases reaches thresholds that we set, we ask you to verify your identity and, for a Business Customer, to provide information on the company and its beneficial owners.

When screening identifies a potential match, the account concerned is automatically placed on hold as a precautionary measure, pending review. A member of our staff then reviews every potential match. If the match is dismissed, the hold is lifted; if it is confirmed, we are required to keep the account restricted. You may provide additional information, express your point of view and contest the outcome by writing to [email protected].

Copies of identity documents submitted for manual review are encrypted and their content is deleted once our review is completed. The verified identity data and the screening records are encrypted at rest and kept for the period stated in Section 14.

8. Support and the support assistant

When you contact our support, we process your messages, attachments and contact details to answer you, follow up on your request and improve our support content. Attachments are stored encrypted.

The support assistant available on the website and in the Portal is an automated conversational tool. Its answers are generated by an artificial intelligence model provided by Anthropic, PBC, which processes the content of the conversation on our behalf. Do not share sensitive information or secrets (such as passwords, private keys or API keys) in a conversation. You may ask to speak with a member of our staff at any time. Answers given by the assistant are provided for information and do not modify the Terms of Service or any of our policies.

To alert staff on duty, a short notification containing the category, priority, subject line and reference number of a support request (but not your account details or the content of your messages) may be sent through an instant messaging service.

9. Website and Portal

Without your consent, the everxcloud.ai website sets no cookies other than strictly necessary ones (security and the record of your consent choice). It measures page views using daily counters aggregated by page category, referring domain, device category (desktop, mobile or tablet), language of the page, country and visits. The country is derived from the IP address by our content delivery provider; the IP address is not kept in these counters. For the first page of a visit, the counters also record the campaign parameters of the link, the name of the advertising network when the link carries a click identifier, and whether it carries a referral code, but never the identifier or the code itself. No visitor identifier, cookie, browser storage, IP address, full URL or device fingerprint is retained in these counters. They cannot reconstruct individual browsing journeys. Do Not Track and Global Privacy Control signals disable this collection.

With your consent, given through the consent banner and which you can withdraw at any time with "Manage cookies" at the bottom of each page, the website may also use Google Analytics to measure its audience, and the tools of Google Ads, Microsoft Advertising, Meta, LinkedIn, TikTok, X and Reddit to measure the results of our advertising and show it to relevant audiences. These tools set cookies and send information about your visit (pages viewed, referring page, click identifier, browser and device information and IP address) to their providers, which use it to provide their services to us and, under their own privacy policies, for their own purposes, including advertising. The Cookie Policy lists, for each tool, its provider, its purposes, its cookies and their duration.

The Portal uses only cookies that are strictly necessary for authentication, security, payment and the language you choose. Details are set out in the Cookie Policy, available at everxcloud.ai/legal/cookies.

Our servers and our content delivery and security provider process the IP address and technical information of every request in order to deliver the website and the Portal, protect them against attacks and keep logs needed for security and troubleshooting.

For access security, we also keep daily counters grouped by public IP address, detected country, request category and control outcome. They are restricted to administrators with strengthened authentication and kept for seven UTC calendar days, with deletion every fifteen minutes. They contain neither request content nor full URLs. Audits of administrative blocking decisions follow the security-log retention policy.

To detect anonymising networks and abuse, we consult public lists locally. If the IPinfo and AbuseIPDB connectors are enabled, the public IP address may also be sent to these security services to obtain VPN, proxy or Tor indicators and abuse report scores. We do not send request content or account identity. Results are restricted to administrators with strong authentication, cached for up to six hours, then purged every fifteen minutes. A signal does not trigger automatic blocking.

10. Customer workload data

The Services provide computing infrastructure. Customers decide what data they place on Instances and other resources, and what they do with it. EverXCloud does not access or inspect that content, except where strictly necessary to provide the Services, to prevent or address a security or technical problem, to enforce the Acceptable Use Policy or to comply with the law.

For any personal data contained in that content, the Customer is the controller (or the business) and EverXCloud acts as processor (or service provider), processing it only on the Customer's instructions. For Business Customers, that processing is governed by the Data Processing Addendum, available at everxcloud.ai/legal/dpa. Instances run on hardware operated by EverXCloud or by Providers, which act as our sub-processors. Individuals whose personal data is processed by a Customer through the Services should address their requests to that Customer.

11. Recipients of personal information

We disclose personal information only to the following categories of recipients, and only to the extent needed for the purposes described in this Policy:

• Service providers acting on our behalf (processors), under written contracts that restrict their use of the information: authentication and user management (Clerk, Inc.); payment processing and, where used, identity verification (Stripe); content delivery, DNS and network security (Cloudflare, Inc.); dedicated server hosting in the United States and encrypted backup storage; the support assistant (Anthropic, PBC); error monitoring (Sentry) and performance monitoring (Grafana Labs); delivery of transactional emails; the business email service used for prospecting; the instant messaging service used for staff alerts.
• Providers operating the hardware on which Instances run, which receive the technical information needed to run your Instance, such as the configuration of the Instance, SSH public keys you register and, where you connect directly to an Instance, your IP address.
• Our payment processor, which also acts as an independent controller for its own purposes, such as fraud prevention and compliance with financial regulations, under its own privacy notice.
• Public authorities and verification services, such as the European Commission's VAT Information Exchange System for the validation of VAT numbers.
• With your consent only, the providers of the audience measurement and advertising tools used on the website (Google, Microsoft, Meta, LinkedIn, TikTok, X and Reddit), which receive information about your visit and, for the advertising networks, the reports described in Section 5. Depending on the tool and the processing, they act on our behalf or as independent controllers for their own purposes, under their own privacy policies.
• Professional advisers (lawyers, accountants, auditors) bound by confidentiality obligations.
• Courts, law enforcement and other public authorities, where we are required by law to disclose information or where disclosure is necessary to establish, exercise or defend legal claims or to protect the rights, property or safety of EverXCloud, our Customers or others.
• A buyer, investor or successor in connection with a merger, acquisition, financing or sale of all or part of our business, subject to confidentiality obligations and to this Policy.

The list of our service providers may change over time. An up-to-date list is available on request at [email protected].

12. Sale, sharing and targeted advertising

We do not sell personal information for money. If you accept advertising cookies on the website, the advertising networks listed in the Cookie Policy receive information about your visit and may use it to measure our advertising and to show advertising, including to you on other websites. Under the CCPA and other United States state privacy laws, this may constitute "sharing" of personal information for cross-context behavioural advertising, a "sale", or processing for "targeted advertising". We do this only after you accept advertising cookies in the consent banner. You can opt out at any time by refusing or withdrawing that consent with "Manage cookies" at the bottom of each page, or by enabling Global Privacy Control in your browser. Apart from these tools, we do not sell or share personal information and we do not process it for targeted advertising. We do not profile individuals in furtherance of decisions that produce legal or similarly significant effects, other than as described in Section 7.

We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

We collect identity document information only to verify identity and to comply with legal obligations, and account credentials only to authenticate users. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA regulations, and we do not use it to infer characteristics about you.

13. International transfers

EverXCloud is established in the United States and our servers are located in the United States. If you access the Services from outside the United States, your personal information is processed in the United States, where data protection laws may differ from those of your country.

Where personal information subject to the GDPR or the UK GDPR is transferred by us to a recipient located in a country that has not been recognised as providing an adequate level of protection, we rely on an appropriate safeguard: the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914), the United Kingdom International Data Transfer Addendum, or, for recipients certified under it, the EU-U.S. Data Privacy Framework and its UK Extension. We assess the laws of the destination country and apply supplementary measures, such as encryption, where appropriate.

The providers of the audience measurement and advertising tools described in the Cookie Policy may process the information they collect in the United States and in other countries, under the safeguards they have adopted, such as the EU-U.S. Data Privacy Framework for certified providers or standard contractual clauses.

You may obtain a copy of the relevant safeguards by writing to [email protected].

14. Retention

We keep personal information only for as long as necessary for the purposes for which it was collected, then delete or anonymise it. Automated purge routines apply the following periods:

• Account and profile data: for as long as the account exists; after the account is closed, identity, contact and billing profile data are anonymised after five years, except where needed for the records listed below.
• Invoices, credit notes, payment and Prepaid Balance records: seven years after the end of the financial year to which they relate, or longer where tax law requires.
• Identity verification and sanctions screening records: five years after the end of the customer relationship. The content of identity documents submitted for manual review is deleted when our review is completed.
• Security and audit logs: one year, after which IP addresses are erased; records of financial operations in audit logs: five years.
• Server and error logs: generally no more than 90 days.
• Encrypted database backups: daily backups for 35 days and monthly backups for one year.
• Support requests and support assistant conversations: two years after the request is closed or the conversation becomes inactive. IP addresses recorded to limit use of the support assistant: 30 days.
• Contact form requests: one year; capacity requests and data center applications: three years; IP addresses recorded with forms: 30 days (one year for data center applications).
• Records of transactional emails sent: 90 days.
• Advertising click identifiers recorded at sign-up: 90 days after the visit.
• Website audience data in Google Analytics: no more than 14 months; cookies of the audience measurement and advertising tools: as stated in the Cookie Policy.
• Business contacts: three years after the last activity concerning the contact; suppression list entries after an objection: for as long as necessary to honour the objection.

We may keep information for longer where required by law, to establish, exercise or defend legal claims, or while an investigation of fraud, abuse or a breach of our terms is pending.

15. Security

We implement technical and organisational measures appropriate to the risk, including: encryption of data in transit, encryption at rest of identity documents, verified identity data, bank details, tax forms and support attachments, encrypted and access-restricted backups, strict access controls with multi-factor authentication for administrative access, logging and monitoring of administrative actions, network protection and rate limiting, encrypted and ephemeral Instance workspaces that are destroyed at the end of a rental, and contractual security obligations imposed on our service providers and Providers.

No method of transmission or storage is completely secure. If a personal data breach affects you, we will notify you and the competent authorities where and as required by applicable law.

16. Your rights

Depending on where you live and on the law that applies, you have some or all of the following rights:

• to know and access the personal information we hold about you and to receive a copy of it;
• to correct inaccurate personal information;
• to delete personal information;
• to receive personal information you provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller (portability);
• to object at any time to processing based on our legitimate interest, and in all cases to direct marketing, including prospecting;
• to restrict processing in the cases provided for by law;
• to withdraw your consent at any time, where processing is based on consent;
• to opt out of the sale of personal information, the sharing of personal information for cross-context behavioural advertising, targeted advertising and profiling with legal or similarly significant effects (see Section 12: you can do so at any time with "Manage cookies" on the website or with Global Privacy Control);
• to limit the use of sensitive personal information (we use it only for permitted purposes);
• not to be subject to a decision based solely on automated processing producing legal or similarly significant effects, and to obtain human intervention, express your point of view and contest the decision;
• for residents of certain United States states, to obtain a list of the categories of third parties to which we have disclosed personal information;
• to appeal our decision on your request, and to lodge a complaint with a supervisory authority (see Section 20).

In the Portal, you can review and update your account, organisation and billing information at any time. You can also close your account.

These rights are subject to exceptions provided by law, for example where we must keep information to comply with a legal obligation or to establish, exercise or defend legal claims.

17. How to exercise your rights

Send your request to [email protected] or by post to the address in Section 2. Requests may also be submitted through the Portal by contacting support.

We will confirm receipt of a request under United States state privacy laws within 10 business days. We respond within one month for requests under the GDPR and the UK GDPR, and within 45 days for requests under United States state privacy laws. These periods may be extended where permitted by law (by two further months under the GDPR and the UK GDPR, and by 45 days under United States state privacy laws), in which case we will inform you of the extension and the reasons for it.

To protect your information, we verify your identity before acting on a request to know, access, correct or delete. We normally do so by asking you to send the request from the email address associated with your account or to confirm it from your signed-in account. We may ask for additional information where necessary, and we use it only for verification.

You may designate an authorised agent to make a request on your behalf. We may require the agent to provide your signed written permission or a valid power of attorney, and may ask you to verify your identity directly with us.

If we decline to act on your request, we will explain why. You may appeal our decision by writing to [email protected] with "Privacy appeal" in the subject line within 60 days of our response. We will respond to your appeal in writing within the time required by applicable law (generally 45 or 60 days), stating the action taken and the reasons. If your appeal is denied, you may contact the attorney general of your state of residence.

Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive. We will not discriminate against you for exercising your rights, including by denying the Services, charging different prices or providing a different level of quality.

18. Do Not Track and Global Privacy Control

Third parties collect information about your online activities through our website for advertising purposes only if you accept advertising cookies in the consent banner (Section 12). The Portal does not allow such collection. A "Do Not Track" signal disables our internal page-view measurement; it does not change the choice you make in the consent banner.

We honour Global Privacy Control (GPC) and other legally recognised opt-out preference signals as a valid request to opt out of the sale and sharing of personal information and of targeted advertising, for the browser or device that sends the signal and, where we know who you are, for your account. When your browser sends a GPC signal, the advertising tools described in the Cookie Policy are not loaded and no advertising click identifier is passed to the sign-up page, whatever your choice in the consent banner. GPC also disables our internal page-view measurement. On our payment pages, our payment processor collects device information solely for fraud prevention; this is not used for advertising.

19. Children

The Services are not directed to children and are reserved for persons who are at least 18 years old and have legal capacity to enter into a contract. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it and close the corresponding account. If you believe that a minor has provided personal information to us, contact [email protected].

20. Complaints and supervisory authorities

We would like the opportunity to address your concern first; please contact us at [email protected].

If you are in the European Economic Area, you have the right to lodge a complaint with the data protection supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement. If you are in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office (ico.org.uk). If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner. If you are a resident of a United States state, you may contact the attorney general of your state or, in California, the California Privacy Protection Agency.

21. Notice at collection for California residents

This Section is our notice at collection under the CCPA. It applies to California residents, including business contacts, and summarises the personal information we collect, the purposes for which we use it and how long we keep it. The same information applies to the twelve months preceding the effective date of this Policy.

• Identifiers (name, email address, postal address, account and organisation identifiers, IP address, online identifiers): collected for account management, provision of the Services, billing, security, compliance and support. Retention: Section 14.
• Customer records described in California Civil Code section 1798.80(e) (name, address, telephone number, limited payment information): collected for billing, payment and compliance. Retention: seven years for billing records.
• Commercial information (purchases, Orders, top-ups, Prepaid Balance and usage records): collected to provide and bill the Services. Retention: seven years.
• Internet or other electronic network activity information (logs, request data, interactions with the Portal and the API): collected for security, operation and improvement of the Services. Retention: up to one year.
• Internet activity on the website and online identifiers (cookies, advertising click identifiers), only if you accept the corresponding cookies: collected for audience measurement and advertising, and disclosed to the providers listed in the Cookie Policy. Retention: as stated in Section 14 and in the Cookie Policy.
• Approximate geolocation (country derived from the IP address): collected for sanctions compliance and geographic restrictions. We do not collect precise geolocation.
• Professional or employment-related information (employer, job title, professional contact details): collected for Business Customer accounts and business-to-business prospecting. Retention: Section 14.
• Sensitive personal information (government identity document information; account log-in credentials, which are managed by our authentication provider): collected only to verify identity, comply with law and authenticate users. Retention: five years after the end of the relationship for verification records; document content is deleted after review.
• Other information you provide (content of support messages, forms and support assistant conversations): collected to answer you and provide support. Retention: Section 14.

We disclose these categories for business purposes to the categories of recipients listed in Section 11. Internet activity on the website and online identifiers may be sold or shared, within the meaning of the CCPA, with the advertising networks listed in the Cookie Policy only if you accept advertising cookies (Section 12); we do not sell or share any other category of personal information. We do not use or disclose sensitive personal information for purposes other than those permitted by law. We do not derive inferences from personal information to create a profile about you.

22. Changes to this Policy

We review this Policy at least once a year and may update it. We will publish the updated version on this page with its new effective date. If we make material changes, we will notify account holders by email or through the Portal before the changes take effect. Changes do not apply retroactively to personal information collected under a previous version in a manner that would materially reduce your rights without your consent where consent is required by law.

23. Contact

EverXCloud Inc., a Delaware corporation, 8 The Green, Suite #19720, Dover, DE 19901, United States. Email: [email protected].

Effective date: 25 October 2026. Version 2026-10-25.