everreach Privacy Policy

Who Are We?

everreach is a trading style and registered trademark of Everreach Limited ("Everreach", "us" or "we"), a company incorporated under the laws of England and Wales with its registered address at 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX. We're registered with the UK Information Commissioner's Office under registration number ZB094962.

Some of the information we obtain through or in connection with your use of the everreach services may enable you to be identified ("Personal Information"). Any Personal Information Everreach collects from you will be processed in accordance with this Privacy Policy.

For your account, billing, marketing and website usage data, Everreach is the data controller. For the communications that flow through the service — your organisation's calls, voicemails and contacts — Everreach acts as a data processoron behalf of your organisation. In that role we act on your organisation's instructions, and your organisation remains the controller for the rights of the people who contact you.

How do we use information collected from you?

We want to give you and all of our users the best possible service and a positive user experience. We use the Personal Information we collect from you in the following ways:

• To provide, maintain, tailor and improve the everreach service;
• To send you essential service communications — things like service or security notices, billing messages and account-related updates. These aren't marketing and we send them to every customer while their account is active.
• To send you marketing emails about other everreach products and offers, where you've opted in to receive them. You can update your preference at any time from your account settings.
• To help you with questions you may have about the everreach service;
• To protect Everreach and people that use our services;
• To anonymise and aggregate information about how you and other everreach users use the service ("Aggregate Data"), so we can identify trends and better understand how our product is being used. Aggregate Data doesn't contain information from which you can be personally identified or contacted.

We keep your information safe using appropriate technical and organisational measures — including encryption in transit and at rest, role-based access controls and regular testing.

Our lawful basis for processing

Under UK data protection law we need a legal reason to process your Personal Information. We rely on:

• Performance of our contract with you — for registering and running your account, taking payment, providing the everreach service (including storing voicemails), and handling your support queries.
• Our legitimate interests in running and improving a reliable service — for product analytics, error monitoring, Smart Voicemail transcription and analysis, fraud and abuse prevention, and keeping our service secure. You can object to any of this at any time.
• Your consent — for non-essential cookies, marketing emails, and anything else we specifically ask you to opt in to. You can withdraw consent whenever you like.
• Legal obligation — where the law requires us to keep or produce records, for example tax records or responses to lawful requests from authorities.

What information do we collect from you?

We collect information that you give us and information that we get from your use of the everreach service:

• Registration Information. When you sign up for everreach, we will ask you to give us your full name, your email address, your company name and address, your phone numbers and a password.
• Payment Information. When you sign up for everreach, we ask you for your credit card details and we keep this in order to manage your monthly subscription. We ask for your postal address as it helps reduce fraudulent transactions. All your payment information is kept securely with our payment processor.
• Your Activity. When you use the everreach service, we collect information about your activity such as your communication history. We store basic information about every call – the number that called in (unless withheld), the duration of the call and if appropriate the number to which we forwarded that call. This information is available to you, so that you can see how your customers are contacting you.
  We also use this information in an aggregated form to understand which features people find most useful and to improve the service. Our staff don't access your records unless they're helping you with a support query. We don't record the content of live calls.
• Voicemail recordings. When someone leaves you a voicemail, we record and store the message so you can listen to it. Voicemails are stored securely for at least 30 days, after which they may be automatically deleted.
• Smart Voicemail (AI transcription and analysis). We use AI to summarise the content and intent of each voicemail. You can turn this off per number in your settings — if you do, we'll still record voicemails but we won't transcribe or analyse them. Voicemail content may occasionally include special category information (for example about health). Your organisation, as controller of the communications that flow through the service, remains responsible for ensuring it has a valid basis for processing such information and for informing callers where appropriate.
• Other users. As part of the everreach service you can add other individuals who are part of your organisation and enable them to use the everreach service. You can add or remove any of these individuals at any time during your subscription to the service. Other users must provide their details and agree to the terms and conditions as well as this privacy policy.
• Correspondence. When you contact us for support, we keep a record of the conversation (including any information you share in it) to help us answer your question and improve how we handle future queries. We use Zendesk to manage support tickets.

What is our cookie policy?

When you browse the everreach website we receive some information automatically from your browser. This is done in the form of cookies, small text files that we send to your browser which are then stored on your device. When you visit our site again, your browser automatically sends these files back to our servers allowing us to recognise your device. We use cookies in a few different ways:

• site functionality - some cookies are required for our website to function correctly and to give you access to all of the services that we offer. If you choose to block cookies on your device, that will mean certain functions of our website cannot operate properly and the usability of our service will be affected.
• third party cookies - we use some third party services that help us to understand how users interact with our site - for instance we measure the number of visitors we have, which pages are most popular and how people navigate around our site. To do this, we use a number of third-party services which may also utilise cookies.
  • PostHog helps us understand how people use our website and app — which features they try and where they get stuck — so we can improve the service. PostHog is hosted in the European Union, and we've configured it to discard your IP address.

  If we introduce other third-party analytics or advertising tools in future, we'll update this list and make sure they're covered by the same consent-gated flow.

Only strictly necessary cookies are set automatically. Non-essential cookies (including those used by the third-party services above) are set only if you accept them through the cookie banner shown on your first visit. You can review and change your choices at any time from the cookie preferences link in our website footer.

Who do we share your Personal Information with?

We don't share your Personal Information with other organizations or individuals outside of our company, except:

• With the trusted business partners that help us run the service or that collect, store or process information on our behalf. We only provide them with the information they need to do their specific job, and we require them to act on our instructions and keep your information secure in line with this Privacy Policy. All of them are covered by written data processing agreements that meet the requirements of Article 28 of the UK GDPR. We'll update this list on our website if we add or replace any of these companies; business customers on a Data Processing Agreement will be notified in line with that agreement. The main companies we work with are:
  • AssemblyAI (European Union) — converts voicemail audio into text for Smart Voicemail. Your data stays in the EU and isn't used to train AssemblyAI's models.
  • OpenAI (United States) — analyses voicemail transcripts to generate summaries, caller names, intents and suggested actions. Does not use your information to train its own models.
  • Anthropic (United States) — may be used in place of OpenAI for the voicemail transcript analysis described above. Does not use your information to train its own models.
  • Amazon Web Services (United Kingdom and United States) — hosts our service and stores recordings.
  • Cloudflare (United Kingdom and United States) — delivers our website and app, provides DNS and protects against malicious traffic.
  • Stripe (United Kingdom and United States) — processes subscription payments.
  • Postmark (United States) — sends transactional emails from us to you.
  • Sentry (European Union) — helps us detect and fix technical errors, and records a short replay of the moments leading up to an error (with all text and media automatically masked) so we can reproduce bugs.
  • PostHog (European Union) — product analytics.
  • Zendesk (United States) — runs our support ticketing system and stores correspondence when you contact support.
  • Atlassian Statuspage (United States) — publishes our service status page; if you subscribe to status updates, stores your contact details for that purpose.
• When we have a good-faith belief that it is reasonably necessary to:
  • meet any applicable law, regulation, legal process or enforceable governmental request.
  • enforce applicable Terms of Service, including investigation of potential violations.
  • detect, prevent, or otherwise address fraud, security or technical issues.
  • protect against or prevent harm to the rights, property or safety of Everreach, our users or the public as required or permitted by law.
• With a company that buys us in the event that we are involved in a merger, acquisition or asset sale, in order to continue serving you and others.

Everreach is based in the United Kingdom. Some of the companies listed above are based in the United States or elsewhere outside the UK. When we transfer your information overseas we use safeguards approved by the UK Information Commissioner's Office — for example the UK International Data Transfer Agreement, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified — so that your information continues to be protected to UK standards.

How long do we keep your Personal Information?

We hold different types of information for different periods:

• Account and registration data — while your subscription is active, then deleted or anonymised shortly after account closure unless we need to keep part of it for one of the reasons below.
• Billing and payment records — for the period required by UK tax and accounting law (currently six years from the end of the relevant tax year).
• Call metadata (the number that called in, the duration, the number we forwarded to) — for the life of your account, so you can see your own history.
• Voicemail audio — retained for at least 30 days; older recordings may be deleted after that point.
• Smart Voicemail transcripts, summaries and extracted information — stored alongside the voicemail audio and removed with it.
• Support correspondence in Zendesk — retained for as long as we use Zendesk as our support system, so we have a history of past queries to refer back to.
• Website analytics and error-monitoring data — as described in the cookie and sub-processor sections; no longer than necessary to investigate trends and bugs.
• Backups — may contain snapshots of the above for a limited period after the primary data has been deleted.

Where the law requires us to keep information for longer — for example, in response to a lawful request from a UK authority — we will.

Changes

We may update this Privacy Policy from time to time. We will post any Privacy Policy changes on our Website. If the changes are significant, we will provide a more prominent notice (for example, an email informing you of Privacy Policy changes).

Your rights over your information

Under UK data protection law you have the right to:

• ask us for a copy of the information we hold about you;
• ask us to correct anything that's wrong;
• ask us to delete your information, where we no longer need it;
• ask us to stop or limit how we use it;
• object to us using it in certain ways — including direct marketing, which you can opt out of at any time from your account settings or by clicking the unsubscribe link in any marketing email;
• withdraw any consent you've given us (for example, for non-essential cookies or marketing emails) at any time;
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you — we don't currently make any such decisions about you.

To exercise any of these rights, or to ask us anything else about this Privacy Policy, email us at support@everreach.co.uk. Exercising your rights is free of charge. We'll usually respond within one month, and we may need to ask for proof of identity before we act. In some cases we may not be able to carry out your request — for example, if doing so would be technically impractical, would risk someone else's privacy, or would place a disproportionate burden on us. If you're unhappy with how we've handled your information, you can also complain to the Information Commissioner's Office at ico.org.uk.

If you're not a direct customer of everreach — for example, you've called or left a voicemail for one of our customers — the rights above relate to information that our customer (the controller) holds about you. Please contact that organisation in the first instance. We'll support them in responding to your request.