1. Introduction
Everbind is an AI-assisted workspace for commercial insurance agencies. It can connect to agency management systems (“AMS”), email, file storage, documents, forms, calendars, calls, meetings, and other sources to help insurance teams organize client and placement work, understand account context, prepare work product, and take authorized actions.
This Policy applies to personal data we handle as a controller or business for our own purposes. When we process personal data for an organization customer under its instructions, that organization’s privacy notice and our agreement with it also apply. This Policy does not replace an insurance agency’s own notices to its clients, prospects, employees, or other people.
2. Our role and who controls data
When SmashCo controls personal data
SmashCo generally acts as a controller or business for account, website, sales, billing, security, and support data that we use for our own business purposes. In that role, we determine why and how the personal data is processed, subject to applicable law.
When an organization controls personal data
For data that a customer submits to the Service or makes available through a connected system (“Customer Data”), the customer generally acts as the controller or business and SmashCo acts as its processor or service provider. We process that data to provide the Service and according to the customer’s instructions, our contract, and applicable law.
If your personal data was provided by an insurance agency, employer, or other Everbind customer, direct questions and rights requests about that data to that organization first. We will support the customer in responding as required by our agreement and applicable law.
3. Scope and eligibility
This Policy applies when you visit our website, communicate with us, create or use an account, connect a third-party service, or otherwise use the Service. It does not apply to third-party websites, products, or services that have their own privacy policies.
The Service is intended for business use by people who are at least 18 years old. It is not directed to children, as described further in Section 18.
4. Personal data we collect
The personal data we collect depends on how the Service is configured and used.
4.1 Account, contact, and organization data
- name, work email address, phone number, and business address;
- company, agency, workspace, team, job title, and role;
- account identifiers, profile details, authentication status, single sign-on information, and administrator assignments; and
- OAuth, OIDC, API, and service-account credentials and tokens, granted permissions, provider identifiers, and connection status.
4.2 Connected-service and insurance data
When authorized by a customer, we may collect and synchronize personal data from an AMS, email provider, file-storage service, communications platform, calendar, or other connected system, including:
- client, prospect, insured, contact, employee, and carrier information;
- policy, coverage, quote, premium, exposure, claims, loss-run, application, certificate, and placement information;
- email and message content, headers, participants, timestamps, attachments, labels, folders, and related metadata;
- files and document content, filenames, paths, permissions, versions, forms, spreadsheets, images, and extracted text or structured data;
- calendar events, meeting details, call or meeting recordings and transcripts, participants, notes, and action items, where the customer has the right to provide them; and
- source identifiers, synchronization state, change history, associations, and audit information.
Customer Data can contain personal data about people who do not use Everbind directly. Depending on what a customer connects or uploads, it may also contain sensitive personal data such as government identifiers, driver’s-license information, financial information, account credentials, health information, or the contents of private communications. Customers are responsible for deciding what data they are authorized to provide and for configuring access appropriately.
4.3 Service content and generated data
- prompts, instructions, questions, conversations, feedback, and files users submit directly to the Service;
- AI-generated answers, summaries, comparisons, drafts, forms, proposals, certificates, tasks, and other outputs;
- workspace records, placements, checklists, notes, statuses, comments, assignments, approvals, and actions; and
- classifications, associations, search indexes, embeddings, and other derived information used to organize, retrieve, and personalize Customer Data for the customer’s workspace.
4.4 Usage, device, and system data
- IP address, browser and device type, operating system, language, approximate location derived from IP address, and timestamps;
- feature usage, pages or screens viewed, clicks, searches, session activity, and preferences;
- application, integration, synchronization, performance, model usage, error, diagnostic, and audit logs; and
- session cookies, local-storage identifiers, and similar technologies used for authentication, security, preferences, and analytics where enabled.
4.5 Billing and transaction data
- billing contact, billing address, subscription, order, invoice, usage, payment status, and transaction history; and
- limited payment-method information supplied by a payment processor. We do not store full payment-card numbers.
4.6 Sales, support, and communications data
- demo requests, support tickets, emails, calls, survey responses, feedback, and other communications with us; and
- communication preferences and records of service or marketing messages sent to you.
5. Sources of personal data
We collect personal data:
- directly from you when you use or communicate with us;
- from a customer, workspace administrator, teammate, employer, client, or other person who provides data to the Service;
- from Connected Services, such as AMS, Google Workspace, Microsoft 365, email, file-storage, calendar, and communications providers, when access is authorized;
- automatically from browsers, devices, applications, integrations, cookies, logs, and similar technologies;
- from payment, security, analytics, support, and other service providers; and
- from public business sources or partners for sales and business development, subject to applicable law.
6. How we use personal data
We use personal data to:
- provide, operate, maintain, personalize, and support the Service;
- authenticate users, administer workspaces, manage permissions, and connect and synchronize authorized systems;
- associate communications and documents with the correct client or placement, index and retrieve information, and maintain a shared workspace;
- generate answers, summaries, comparisons, forms, drafts, suggested actions, and other requested features;
- process orders, invoices, payments, subscriptions, and account administration;
- communicate about the Service, respond to requests, and provide support;
- monitor performance, troubleshoot, debug, analyze usage, and improve reliability, safety, and user experience;
- protect accounts, Customer Data, and the Service; prevent fraud, abuse, and security incidents; and enforce our agreements; and
- comply with law, respond to lawful requests, establish or defend legal claims, and complete corporate transactions.
Legal bases
Where applicable law requires a legal basis, we rely on performance of a contract, compliance with legal obligations, our legitimate interests, consent, and other bases permitted by law. Our legitimate interests include operating and securing the Service, supporting users, preventing abuse, understanding performance, improving reliability and usability, and managing our business. Where we rely on consent, you may withdraw it at any time, although withdrawal does not affect prior lawful processing.
7. AI and model usage
Everbind uses AI and automated processing to provide requested features such as search, classification, extraction, summarization, question answering, quote comparison, document preparation, drafting, and workflow suggestions. Customer Data may be sent to AI or inference providers acting as subprocessors under contractual restrictions and only as needed to provide those features.
We do not use Customer Data from Connected Services to train generalized AI models, and we do not permit our AI providers to use that data to train their generalized models. We may use aggregated or de-identified information to operate, secure, measure, and improve the Service when it does not identify a customer or person and is not re-identified.
The Service may maintain workspace-specific search indexes, embeddings, associations, preferences, or other derived data to retrieve and personalize information for that customer. These are used only for the customer-facing Service and are treated as Customer Data while they can be linked to a customer or person.
9. Google Workspace data
Everbind’s use and transfer of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
We use Google Workspace data only to provide or improve user-facing features requested or enabled by the customer, keep the Service secure, comply with law, or as otherwise permitted by Google’s policy. We do not sell Google Workspace data, use it for advertising or creditworthiness, or use it to train generalized or non-personalized AI or machine-learning models.
We do not allow personnel to read Google Workspace user data unless the user has given specific consent for support, access is necessary for security or abuse investigation, the data has been aggregated and anonymized for permitted internal operations, or access is required by law. Access by subprocessors is limited to providing the user-facing Service under contractual restrictions.
10. Enterprise and team accounts
If you use Everbind through an organization, that organization may control your account and Customer Data. Its administrators may provision or remove users, assign roles, configure integrations and retention, manage billing, view usage and audit information, and access, export, correct, or delete Customer Data according to the organization’s policies and our agreement with it.
Other authorized users may be able to view and collaborate on client, placement, communication, document, task, and AI-output data in the shared workspace. Do not use an organization account for personal information you do not want the organization to control.
12. Data retention
We retain personal data only as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, follow customer instructions, comply with law, resolve disputes, enforce agreements, maintain security, and complete routine backup cycles. Retention depends on the data’s nature, sensitivity, source, customer configuration, legal requirements, and the purposes for which it is processed.
Our general practices are:
- Account and organization data is retained while the account or customer relationship is active and afterward as needed for closure, compliance, security, and business records.
- Connected-service credentials and tokens are retained while the connection is active and then revoked, invalidated, or deleted when no longer needed, subject to limited backup retention.
- Customer Data is retained during the subscription and according to customer configuration, source synchronization, and our agreement. Under our standard Terms, customers may request an export before termination or during the 30-day period afterward; we may then delete the data under our standard deletion process.
- Temporary uploads and generated artifacts may have feature-specific expiration periods, while items saved to the shared workspace may remain with Customer Data.
- Usage, security, audit, and diagnostic logs are retained for periods appropriate to troubleshooting, security, compliance, and audit needs.
- Billing and transaction records are retained as required for accounting, tax, chargeback, and contractual purposes.
- Support, sales, and communications data is retained as needed to respond, manage the relationship, and keep reasonable business records.
Disconnecting a source stops future synchronization but does not necessarily delete data already imported into Everbind. Removal or deletion in a Connected Service may be reflected in Everbind when the integration and customer configuration support that behavior. Data retained by a Connected Service is controlled by that provider and the customer. Residual copies may remain in backups until they expire in the ordinary course.
13. Security
We maintain administrative, technical, and organizational safeguards designed to protect personal data, including, as appropriate:
- encryption in transit and at rest;
- encryption and restricted handling of OAuth and similar tokens;
- role-based access controls, least-privilege practices, and workspace separation;
- logging, monitoring, vulnerability management, and backups;
- contractual and security review of service providers; and
- incident-response, business-continuity, and recovery practices.
No method of transmission or storage is completely secure. You are responsible for protecting your devices and credentials, using available security controls, and notifying us promptly of suspected unauthorized access.
14. International data transfers
SmashCo is based in the United States, and we and our service providers may process personal data in the United States and other countries. Those countries may have data-protection laws that differ from the laws where you live.
Where required for transfers from the EEA, United Kingdom, or Switzerland, we use recognized safeguards such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. Contact us to request more information about applicable transfer safeguards.
15. Your privacy rights
Depending on your location and our role, you may have rights to:
- know whether and how we process your personal data;
- access or obtain a copy of personal data;
- correct inaccurate personal data;
- delete personal data;
- restrict or object to certain processing;
- receive certain data in a portable format;
- withdraw consent where processing is based on consent;
- opt out of sale, targeted advertising, or certain profiling where applicable; and
- lodge a complaint with a regulator or appeal our response to a request where applicable.
To exercise rights regarding data controlled by SmashCo, email privacy@everbind.com. We may ask for information necessary to verify your identity and authority. Authorized agents may submit requests where permitted by law, subject to verification. We will not discriminate against you for exercising a privacy right.
If we process the data for a Everbind customer, submit the request to that customer first. If you send it to us, we may refer the request to the customer or ask for the customer’s instructions. Rights are not absolute and may be subject to legal exceptions.
16. Supplemental U.S. state notice
This section supplements the Policy for residents of California and other U.S. states with comprehensive privacy laws. In the preceding 12 months, depending on use of the Service, we may have collected the following statutory categories of personal information:
- Identifiers, such as names, business contact information, account IDs, provider IDs, IP addresses, and online identifiers;
- customer-record information, such as contact, signature, policy, claims, financial, government-identifier, and driver information contained in Customer Data;
- commercial information, such as subscription, transaction, invoice, policy, premium, quote, and placement information;
- internet or network activity, such as usage, session, integration, synchronization, cookie, and diagnostic data;
- approximate geolocation, such as a general area inferred from IP address;
- professional or employment information, such as organization, role, title, employer, insured business, and workplace communications;
- audio, electronic, and visual information, such as emails, documents, images, support calls, and authorized call or meeting recordings and transcripts;
- inferences, such as classifications, associations, summaries, and derived account or workflow information; and
- sensitive personal information, such as account credentials, precise contents of communications, government identifiers, financial information, or health data when included in Customer Data.
We collect these categories from the sources in Section 5, use them for the purposes in Section 6, and disclose them to the recipient categories in Section 8. We retain them as described in Section 12.
We do not sell these categories of personal information or share them for cross-context behavioral advertising. We use and disclose sensitive personal information only as reasonably necessary to provide and secure the Service, follow customer instructions, and for other purposes permitted by law. We do not have actual knowledge that we sell or share personal information of people under 16.
17. Automated decision-making
Everbind provides AI-generated analysis, suggested classifications, document preparation, and workflow assistance. SmashCo does not independently make insurance eligibility, underwriting, pricing, coverage, employment, credit, or other decisions on behalf of a customer that produce legal or similarly significant effects. Customers and their qualified personnel are responsible for reviewing outputs and deciding whether to act on them.
If a customer uses the Service to support a decision about you, contact that customer for information about its decision-making practices and any rights you may have.
18. Children
The Service is not directed to children under 18, and we do not knowingly collect personal data directly from children for their own use of the Service. Customer Data may contain information about minors where an insurance agency or other customer is authorized to process it for legitimate business purposes. In those cases, the customer controls the data and is responsible for applicable notices, consents, and legal requirements.
If you believe a child has created an account or provided personal data directly to us without appropriate authorization, contact us so we can investigate.
19. Changes to this Policy
We may update this Policy to reflect changes in the Service, technology, law, or our practices. We will update the “Last updated” date and, where required, provide additional notice by email, in-product message, or another appropriate method. If required by law, we will obtain consent before applying a change to previously collected personal data.
20. Contact us
For privacy questions or requests, contact:
privacy@everbind.comSmashCo, Inc.
1111B S Governors Ave #48638
Dover, DE 19904
USA