Our commitment to your privacy
Zealtouch AB ("we", "us") operates the Everia platform. Protecting your privacy is fundamental to how we build our product. This Privacy Policy applies to our web application (app.everia.io), our marketing website (everia.io), all communications we send, and any related services. We process data strictly as described below and never sell personal data or use your content to train AI models.
1. Data Controller
The registered legal entity and data controller responsible for processing your personal data under GDPR is:
Legal Entity
Zealtouch AB
Trading As
Everia
Registered Address
Baldergatan 10, 195 51 Märsta, Stockholm, Sweden
Privacy Contact
support@everia.ioZealtouch AB is a Swedish limited company (aktiebolag) and operates the Everia platform. It is subject to Swedish law (Dataskyddslagen, SFS 2018:218), which implements GDPR, and is supervised by the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
2. Information We Collect
We collect data in three ways: what you provide, what we collect automatically, and what we receive from third parties.
2.1 Information You Provide
Account & Profile
- Full name
- Email address
- Password (hashed, never stored in plaintext)
- Profile picture
- Job title
- Company name
- Team role
Billing Information
- Company name
- Billing address
- VAT / tax identification number
Workspace Content
- Project documentation
- Tasks, tickets, and comments
- Attachments and file uploads
- Time tracking entries
- Test cases and test runs
- Internal notes and KnowHub pages
2.2 Data Collected Automatically
Usage & Device Data
- IP address
- Browser type and version
- Operating system
- Device type
- Pages visited and time spent
- Referring URL
Log Data
- Login timestamps
- Feature usage events
- Error reports
- Security and audit logs
Cookies & Tracking
- Authentication cookies (strictly necessary)
- Security tokens
2.3 Data From Third Parties
External Sources
- Authentication providers (Google, Microsoft) — only profile basics
- Payment metadata from Stripe (no card details)
- Integrations you explicitly enable (Slack, GitHub, GitLab, Jira, Telegram, WhatsApp)
3. How We Use Your Data
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Provide and operate the platform | Contract (Art. 6.1.b) |
| Improve product features and performance | Legitimate interests (Art. 6.1.f) |
| Security, fraud prevention, and audit | Legitimate interests (Art. 6.1.f) |
| Billing and payment processing | Contract (Art. 6.1.b) |
| Customer support and communication | Contract (Art. 6.1.b) |
| Marketing emails and newsletters | Consent (Art. 6.1.a) — opt-in only |
| Legal and regulatory compliance | Legal obligation (Art. 6.1.c) |
4. Your Rights Under GDPR
As a data subject under GDPR (Regulation EU 2016/679), you have the following rights. These rights also apply to residents of the UK (UK GDPR), Switzerland, and the EEA.
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Correct any inaccurate or incomplete information.
Right to Erasure
Request deletion of your data ("right to be forgotten").
Right to Restrict
Limit how we process your personal data.
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests or direct marketing.
Right to Withdraw
Withdraw consent at any time without affecting prior processing.
Right to Complain
Lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
To exercise any of these rights, contact us at support@everia.io. We will respond within one calendar month as required by GDPR Article 12. If your request is complex, we may extend by a further two months and will notify you accordingly.
You also have the right to lodge a complaint with Integritetsskyddsmyndigheten (IMY), Sweden's national supervisory authority: www.imy.se
5. Data Protection Contact
Zealtouch AB (operating as Everia) has designated an internal data protection contact responsible for overseeing GDPR compliance, handling data subject requests, and liaising with the supervisory authority.
6. International Data Transfers
Some of our third-party sub-processors are based outside the European Economic Area (EEA), primarily in the United States. Whenever personal data is transferred internationally, we apply appropriate GDPR safeguards:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements (DPAs) with all sub-processors
- Adequacy decisions where applicable
Where possible, we prefer EU-based infrastructure to minimise cross-border transfers.
7. Data Retention
| Data Category | Retention Period |
|---|---|
| Account & profile information | Until account deletion |
| Workspace content | While the account is active |
| Security & audit logs | Up to 12 months |
| Standard usage analytics | 30 days |
| Billing & tax records | 6–10 years (Swedish law) |
| Marketing consent records | Until consent is withdrawn |
Billing records are retained for 6–10 years to comply with the Swedish Bookkeeping Act (Bokföringslagen). All other data is deleted promptly once the retention period expires.
8. Security
Everia implements industry-standard technical and organisational measures (TOMs) to protect your data against unauthorised access, loss, or disclosure:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Article 33 and 34.
9. Third-Party Sub-Processors
| Processor | Role | Data Region |
|---|---|---|
| Supabase / AWS | Database & Infrastructure | EU / USA (SCCs) |
| Hetzner | Additional Infrastructure | EU |
| Stripe | Payment Processing | USA (SCCs) |
| Brevo / Resend | Transactional Email | EU / USA (SCCs) |
| OpenAI | AI Features (opt-in) | USA (SCCs) |
All sub-processors are bound by Data Processing Agreements ensuring GDPR-compliant handling of personal data. SCCs = Standard Contractual Clauses.
10. Children's Privacy
11. Changes to This Policy
12. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal data:
Postal Address
Baldergatan 10, 195 51 Märsta, Stockholm, Sweden
We aim to respond within 7 business days and will always meet the GDPR one-month deadline.