Legal
Privacy Policy
How EverReady collects, uses and protects your personal data, in line with the GDPR.
Version 3.0 - September 2026
EverReady, a French simplified joint-stock company (SAS) registered with the Nanterre Trade and Companies Register under SIRET number 879 848 919, with its registered office at 21 rue Saint Vincent — 92700 Colombes, France (“EverReady”, “we”), attaches great importance to the protection of personal data.
This policy explains what data we process, for what purposes, on what legal bases, for how long, with whom we share it and what rights you may exercise. It applies to our website everready.ai, to our platform at app.everready.ai, to our mobile applications, to our Salesforce integration and to our commercial communications.
It is made available to the individuals concerned and may be updated. The date of the current version appears at the top of this document.
1. Our two roles: controller and processor
This distinction governs everything else in this document. It determines who decides on the processing, and therefore whom you should contact to exercise your rights.
EverReady acts as a controller
For the processing we determine ourselves:
- visitors to our website and individuals completing our forms;
- our prospects and the contacts of our customers, in the course of our commercial activity;
- account, billing and technical usage data necessary to manage the contractual relationship, to ensure security and to keep the service in operational condition;
- job applicants and our partners.
EverReady acts as a processor
For all data processed through our platform on behalf of our customers: the content of business emails and calendars, call logs, CRM data, meeting recordings and transcripts, and content generated by artificial intelligence.
In that context, our customer — the organisation that has subscribed to the service — is the controller. It determines the purposes, activates or deactivates each module, configures access rights and sets retention periods. We act only on its documented instructions, formalised in the data processing agreement entered into with it under Article 28 of the GDPR.
If your data has been processed because you deal with an organisation that is an EverReady customer — you have exchanged emails with one of its salespeople, taken part in a meeting with them, or appear in its CRM — your rights are exercised with that organisation. If you do not know which organisation is involved, write to us at gdpr@everready.ai: we will identify it, subject to its agreement, or forward your request to it.
2. Who is concerned
- Website visitors: anyone browsing everready.ai or completing a contact or demo request form;
- Prospects and business contacts: the professionals we approach or who approach us;
- Platform users: employees of our customers who have been granted access to the service;
- Meeting participants: anyone taking part in a video conference recorded by a user, whether they belong to the customer organisation or are external to it;
- Business counterparties of our customers: individuals appearing in our customers' CRM, mentioned in their exchanges, or whose business contact details are identified by our contact discovery agent.
3. Data processed, purposes and legal bases
Processing for which EverReady is the controller
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to requests submitted through our forms | Surname, first name, business email, company, job title, subject of the request | Pre-contractual steps taken at your request |
| B2B commercial outreach | Business contact details, job title, company, history of exchanges | Legitimate interest in developing our business, with a right to object at any time |
| Account management, billing and contractual relationship | Identity and business contact details, billing data, permissions | Performance of the contract, and legal and accounting obligations |
| Security, abuse prevention and technical monitoring | Connection and activity logs, IP address, performance metrics | Legitimate interest in ensuring the security and availability of the service |
| Website audience measurement | Aggregated browsing data, with no identifier stored on your device | Legitimate interest in improving our website |
| Sending product information and content | Business email address, preferences | Legitimate interest in a professional context, with an unsubscribe link in every message |
Whether the information requested is mandatory or optional is indicated at the point of collection.
Processing for which our customers are the controller
Where you use the platform, or where your data is processed on behalf of a customer, the purposes are determined by that customer: automatic updating of its CRM, visibility over its sales activity, recording and summarisation of its meetings, enrichment and analysis of its opportunities. The legal basis for that processing is its responsibility.
4. Business emails, calendars and call logs
Where a customer activates our automation module, the platform connects, with its authorisation and that of its administrators, to its users' Google Workspace or Microsoft 365 mailboxes, to their calendars and, where applicable, to the call logs of their business telephones.
The following data is analysed: sender, recipients, date, time, subject, message body, signature and attachment names for emails; organiser, participants, date, time, title and description for calendar events; number dialled, direction of the call, date, time and duration for calls, excluding the content of conversations, which is never recorded.
This data is processed in memory and is not stored on our servers. Only the technical identifiers and dates of the records created or modified in the customer's CRM are retained.
EverReady's use and transfer of information received from Google APIs, and in particular the Gmail APIs, complies with the Google API Services User Data Policy, including its Limited Use requirements. The same applies to information received from the Microsoft 365 APIs. We do not use this data for advertising purposes, we do not sell it, and no human access takes place beyond what is strictly necessary for technical support requested by the customer or to comply with a legal obligation.
5. Meeting recording and transcription
This section is of particular relevance to individuals external to our customers who take part in a recorded video conference.
What is processed
Where a customer activates our note-taking module, video conferences are recorded and transcribed. The following are then processed: the audio and video recording, including the image and voice of participants who have enabled their camera or microphone as well as any content shared on screen; the full transcript of the exchanges with speaker attribution; the identity and business email address of participants; the meeting metadata; and the summaries produced by artificial intelligence.
Who decides
The decision to record belongs exclusively to the customer, which must inform you beforehand, obtain your consent where the applicable law so requires, and allow you to object or to request that the recording be stopped, without adverse consequence. We provide the corresponding technical means, in particular visible signalling of the recording where the video conferencing platform allows it.
If you take part in a recorded meeting and wish to object or to obtain deletion of the recording, please contact the organisation that arranged the meeting. We act without delay on the deletion requests it forwards to us.
Where the data goes
Capture, recording and transcription are carried out by our provider Recall.ai (Hyperdoc Inc.), on its infrastructure located in Frankfurt, Germany. Content is deleted from its servers as soon as the recording ends, after transfer to our platform hosted with Amazon Web Services in the European Union.
Recordings and transcripts are then retained, at the customer's choice, in our storage located in the European Union or in its own, and synchronised into its Salesforce environment. The default retention period is six months, extendable to up to twenty-four months where the customer has subscribed to that option.
Meetings whose subject matter involves sensitive data, data covered by a professional privilege, or meetings of employee representative bodies are contractually excluded from this module.
6. Processing by artificial intelligence
Our platform uses artificial intelligence models to produce transcripts, summaries, suggested field values, qualification analyses and draft messages.
Depending on the configuration selected by the customer, this processing is carried out within its own Salesforce environment, within our environment via Amazon Bedrock in a European Union region, or within the large language model environment it has itself designated.
Your data is not used to train any artificial intelligence model, whether ours or a third party's. Where processing takes place in our environment, model providers have no access to the data, which is not retained once processing is complete and is not used for any other purpose.
The content produced consists of proposals submitted to a user for validation. No decision producing legal effects concerning you, or similarly significantly affecting you within the meaning of Article 22 of the GDPR, is taken solely on the basis of automated processing.
7. Business contact details obtained from external sources
Our contact discovery agent identifies, on behalf of our customers, business contact details from publicly available sources or from specialised business data providers. The data concerned is: surname, first name, job title, employer, business email address, business telephone number and public professional profile.
If you have never been in contact with us and your details were obtained in this way, this section constitutes the information owed to you under Article 14 of the GDPR. That data is made available to the customer, which becomes the controller of it and may approach you in a professional context.
You may object to this processing at any time by writing to us at gdpr@everready.ai. We will act on your request and pass it on to the customer concerned.
8. Recipients and sub-processors
Your data is accessible only to those members of our staff who need it in the performance of their duties, on a least-privilege basis, and to the following providers:
| Provider | Role | Location |
|---|---|---|
| Amazon Web Services EMEA | Hosting of the platform, storage and execution of artificial intelligence processing | European Union — Ireland, Germany, France |
| Hyperdoc Inc. (Recall.ai) | Capture, recording and transcription of video conferences | Frankfurt, Germany |
| Google Ireland (Firebase) | Authentication and notifications | Dublin, Ireland |
We also use customer relationship management, billing and messaging tools for our own administrative and commercial needs. An up-to-date list of our sub-processors is available on request at gdpr@everready.ai.
We do not sell your data to third parties. We do not pass it to any third-party organisation for marketing purposes. We do not use your data for advertising and we do not carry out interest-based advertising based on your browsing.
In the event of a merger, acquisition or transfer of all or part of our assets, your data could be transferred to the acquirer, which would remain bound by this policy. You would be informed.
We may also disclose your data where a legal obligation, a judicial order or a request from a competent authority requires us to do so.
9. Transfers outside the European Union
The hosting and processing of your data take place within the European Union.
Our provider Recall.ai is a company incorporated under the laws of the United States, but hosting and processing of the data take place exclusively on its infrastructure in Frankfurt, Germany. Should remote access from the United States occur for technical support purposes, it would be governed by the Standard Contractual Clauses adopted by the European Commission on 4 June 2021, supplemented by additional measures: encryption in transit and at rest, segregation of environments, restriction and logging of access, and an undertaking not to make any voluntary disclosure to an authority and to redirect any such request to the controller.
We do not rely on any other transfer mechanism, and in particular neither on the Privacy Shield, invalidated in July 2020, nor on the EU-US Data Privacy Framework.
Where a customer chooses to route processing to its own large language model environment or to storage located outside the European Union, the resulting transfers fall within its responsibility.
10. Retention periods
| Data | Period |
|---|---|
| Requests submitted through our forms | 6 months from the last exchange, unless a commercial relationship begins |
| Prospects and business contacts | 3 years from the last contact |
| User accounts and contractual relationship data | Term of the contract, then deletion no later than 6 months after its end |
| Emails, calendars and call logs analysed | Not stored — processed in memory |
| Meeting recordings and transcripts | 6 months by default, up to 24 months depending on the option subscribed to by the customer |
| Data processed by Recall.ai | Deleted as soon as the recording ends |
| Technical and security logs | 12 months |
| Accounting records and contractual documents | Applicable statutory periods |
Data synchronised into a customer's CRM environment or stored in its own storage remains subject to the periods that it defines itself.
11. Security
We implement appropriate technical and organisational measures: an information security management system certified to ISO/IEC 27001, encryption of data in transit and at rest, multi-factor authentication for access to production environments, logical segregation of data by customer, permission management on a least-privilege basis, access logging, periodic penetration testing by an independent third party, encrypted backups and a documented incident management procedure.
As no system is perfectly secure, we cannot guarantee absolute security. In the event of a data breach likely to result in a high risk to your rights and freedoms, you would be informed in accordance with Article 34 of the GDPR.
12. Your rights
You have the following rights over your data:
- Right of access: to obtain confirmation that your data is being processed and to receive a copy of it;
- Right to rectification: to have inaccurate or incomplete data corrected;
- Right to erasure: to request deletion of your data, within the limits provided by law;
- Right to restriction: to request that the use of your data be suspended;
- Right to object: to object to processing based on our legitimate interest, in particular to commercial outreach;
- Right to data portability: to receive the data you provided to us in a structured, machine-readable format, where the processing is based on your consent or on a contract and is carried out by automated means;
- Right to withdraw your consent at any time, where the processing is based on that ground;
- Right to give directions regarding the fate of your data after your death, where French law applies.
How to exercise them
By email: gdpr@everready.ai — By post: EverReady, 21 rue Saint Vincent, 92700 Colombes, France.
We respond within one month of receiving your request, extendable by two months where the request is complex, in which case we will inform you. We may ask you for an element enabling us to verify your identity.
If your data has been processed on behalf of one of our customers, we forward your request to that customer, which alone is able to act on it as controller.
You may at any time lodge a complaint with the French supervisory authority, the Commission Nationale de l'Informatique et des Libertés, 3 place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, or with the supervisory authority of your place of residence.
Our data protection officer can be reached at gdpr@everready.ai.
13. Cookies and trackers
Our website uses a limited number of cookies and similar technologies:
- Strictly necessary cookies: essential to the operation and security of the site. They do not require your consent;
- Audience measurement: provided without cookies and without storing any identifier on your device;
- Third-party scheduling cookies: when you open our demo booking page, the scheduling tool we use may place its own cookies, solely to operate the booking.
You may accept or refuse non-essential cookies at any time through our consent banner, and manage or delete them through your browser settings. Cookies are not retained beyond six months. Refusing non-essential cookies does not prevent you from browsing the site, but some third-party features may be limited.
We do not use advertising cookies and do not carry out interest-based advertising based on your browsing.
14. Rights of residents of certain US states
Where we process data on behalf of a customer, we act as a “service provider” within the meaning of the California Consumer Privacy Act as amended by the California Privacy Rights Act, and as a “processor” within the meaning of the equivalent laws of Virginia, Colorado, Connecticut, Utah and Texas.
We do not sell or share your personal information within the meaning of those laws, and we do not retain, use or disclose it outside the specific business purpose of providing the service.
If you are a California resident, you have in particular the right to know the categories of personal information collected, their sources, the purposes and the categories of recipients, the right to obtain a copy of it, the right to request its deletion or correction, and the right not to be discriminated against for exercising those rights. Nevada residents have the right to opt out of the sale of their personal information, which we do not engage in.
To exercise these rights, write to us at gdpr@everready.ai, stating the business email address concerned and the precise subject of your request. We respond within forty-five days. Where the data is processed on behalf of a customer, we forward your request to that customer.
15. Changes to this policy
We may amend this policy to reflect changes to our services, to our organisation or to applicable regulations. The version in force is the one published at everready.ai, dated at the top of this document. In the event of a material change, we will inform the individuals concerned by any appropriate means.
16. Contact us
For any question relating to this policy or to the processing of your data:
EverReady — Data Protection Officer
21 rue Saint Vincent, 92700 Colombes, France
EverReady SAS — 21 rue Saint Vincent, 92700 Colombes, France — Nanterre RCS 879 848 919 — everready.ai