Privacy Policy

Overview of This Privacy Policy

This Privacy Policy describes how Everbook, Inc. (“Everbook”, “we”, “us”, or “our”) collects, stores, shares, and uses personal information in the operation of our business and our SaaS platform for event venues and event vendors (the “Platform” or “Services”).

This policy is organized into the following sections:

• First, we explain what this Privacy Policy does and does not cover.
• Second, we describe the types of data we collect, from whom, and how we keep that data secure.
• Third, we discuss how we use, store, and share your data.
• Last, we explain how you can exercise your legal rights over personal information we hold about you.

We may revise this policy to reflect changes in the law, our Platform, and our business operations. We will notify you of material changes through a message on our website or Platform, or by another reasonable means. The date this policy was last revised appears at the top of this page. Your continued use of the Platform after we revise this policy means you accept those changes, so please check this page periodically for updates.

If you have any questions about this policy or our data privacy practices, please contact us at privacy@everbook360.com.

What This Privacy Policy Does (and Does Not) Cover

What does this Privacy Policy cover?

This Privacy Policy covers personal information we collect and process:

• Directly from you when you visit our website at everbook360.com, register for an account on our Platform, subscribe to our Services, contact us for support, or interact with inquiry forms hosted by Everbook.
• Automatically when you browse or use our website or Platform, including through cookies, server logs, and device metadata.
• From third parties, including our venue customers (“Event Operators”), who upload end-client and event-guest data into the Platform, and payment processors who return transactional confirmations.

What does this Privacy Policy not cover?

This policy does not cover:

• Information collected offline or through any other Everbook products or services not described here.
• Information you provide to or that is collected by third parties, including third-party websites, services, or content that may be linked to or accessible through our Platform. These third parties have their own privacy policies, which we encourage you to read.
• Information that Event Operators collect and manage independently of the Platform, except where Everbook processes such information on the Event Operator’s behalf.

Who is a controller and who is a processor?

This distinction matters because it affects how rights requests are handled:

• Everbook is the controller for personal information we collect directly from website visitors, Event Operator users, billing contacts, job applicants, and our own employees.
• Everbook is the processor (acting on behalf of the Event Operator) for personal information about end clients (people booking events), event guests, vendors in the venue’s network, and Event Operator employees processed through our white-labeled payroll feature (powered by Check Embedded). In these cases, the Event Operator (the venue) is the controller.

When Everbook acts as a processor, rights requests — such as access, deletion, or correction — should be directed to the relevant Event Operator, not to Everbook. Everbook will assist Event Operators with fulfilling these requests as required under our standard processor obligations.

What Types of Data Do We Collect?

We collect personal information through three pathways: direct collection from individuals, automatic or passive collection, and collection from third parties.

Information you provide to us directly

When you visit our website, register for an account, or use our Platform, we may ask you to provide:

• Identifiers and contact information: name, username, postal address, email address, phone number, or birth dates.
• Customer and transaction data: subscription and license type, event booking records, order history, payment status (tokenized), and customer preferences captured by the venue or Event Operators.
• Communications: in-app messaging transcripts (i.e. speech-to-text transcripts), email correspondence, and customer support or technical support communications.
• Event registration and RSVP data: information entered by Event Operator staff or end clients via venue-branded inquiry forms, including guest names, contact details, and dietary restrictions and allergies (see Washington Consumer Health Data below).
• Employment data: For Everbook’s own team, standard HR records (resume, employment history, education, references) collected when hiring. For Event Operator employees, payroll linkage data (employee name tied to Event Operator account, pay-period summary, shift hours). All payroll-sensitive data (SSN, banking, tax documents) flows through Check Embedded and is not stored by Everbook directly.
• Financial and payment data: payment tokens, billing history, and employer identification numbers (EINs) of billing contacts. Raw credit or debit card data is held exclusively by our payment processor and never touches Everbook’s systems.
• Vendor data: information entered by Event Operator staff on behalf of vendors in the venue’s network.
• Photographs and files: event photos, signed contracts, menus, floor plans, mood boards, vendor certificates of insurance, and other files uploaded by Event Operators. Event photos may incidentally include identifiable persons.

Information we collect automatically

As you navigate our website and Platform, we may automatically collect:

• Usage details: browsing activity within the Platform, search history, clickstream data, page views, referring URL, app usage patterns, and log files.
• Device information: device type, browser type, operating system, mobile network information, and IP address.
• Approximate location: location derived from IP address, and shipping and billing addresses.

We do not collect precise GPS location, Wi-Fi or Bluetooth location data, or in-event location tracking. We do not use advertising tags, session replay, or Wi-Fi or Bluetooth tracking technologies.

Information we collect from third parties

We may receive personal information from:

• Event Operators, who upload end-client and event-guest data into the Platform on behalf of their own customers.
• Payment processors, who return tokens, transaction confirmations, and decline reasons.
• Publicly available business contact data sourced through tools such as Apollo, Hunter, Clay, and LinkedIn, used solely for outbound B2B sales prospecting.
• Check Embedded, which holds all payroll-sensitive data and returns summary information to Everbook.

We do not purchase lead lists, use data brokers, or receive data from affiliates or franchise systems.

Sensitive and Special-Category Data

Sensitive personal information

We collect limited categories of sensitive personal information through specific channels:

• Social Security numbers: via Check Embedded only, for payroll processing. Everbook does not store SSNs directly.
• Government-issued identifiers (driver’s license, state ID, passport): via Check Embedded only, for I-9 employment verification of Everbook’s own employees.
• Financial account credentials: tokenized via payment processor; bank and routing data held by Check Embedded only.
• Account login credentials: hashed passwords.
• Citizenship or immigration status: collected via I-9 verification only.

Via Event Operator-uploaded data, we may also process:

• Religious or philosophical indicators: dietary preferences such as kosher or halal, as indicated on event guest lists.
• Personal data of a known child: event guest lists may include minor attendees (see Children’s and Minors’ Data below).

We do not collect: precise geolocation, racial or ethnic origin data, union membership, genetic data, biometric data, mental health information, sex life or sexual orientation data, or the contents of communications not directed to our business.

Children’s and minors’ data

Everbook does not direct our services at children under 13, and the Platform is not likely to be accessed by minors. Our marketing site and B2B Platform are directed at event vendors and venue operators (i.e. adults).

However, children’s data may appear incidentally in event guest lists uploaded by Event Operators — for example, a wedding guest list that includes children. In these cases:

• The Event Operator (venue) is the controller and bears responsibility for obtaining any required parental consent.
• Everbook treats the data as the Event Operator’s responsibility to manage with appropriate consent.
• Everbook does not use children’s data for advertising, profiling, marketing, or AI training.

The same approach applies to minors aged 13–17 who may appear in event guest lists.

How Do We Use Your Data?

We use the personal information we collect for the following purposes:

• Providing the Platform and its services, including event booking, event management, vendor coordination, staff scheduling, kitchen costing, margin tracking, and payment processing.
• Processing payments for subscriptions and events.
• Maintaining customer accounts and authentication.
• Customer support, including responding to inquiries and resolving issues.
• Fraud prevention and security.
• B2B marketing communications, sent only with consent. You may unsubscribe at any time.
• Legal compliance, including tax, employment, and regulatory obligations.
• Business purposes, including delivery of the services associated with the Platform.
• Employment administration for Everbook’s own team and Event Operator employees via Check Embedded.
• Recruiting, when we are actively hiring.
• Vendor management for data entered by Event Operator staff.
• Support of payments functionality.
• AI-assisted recommendations for margin optimization and vendor or event management generally. These are decision-support tools for business operations — they do not constitute automated decisions about individuals with legal or similarly significant effects.
• Analytics and product improvement, using deidentified and aggregated data wherever possible.

What we do not do with your data

• We do not sell personal information for any purpose.
• We do not share personal information for advertising purposes.
• We do not use personal information for targeted advertising or cross-context behavioral advertising.
• We do not use identifiable customer data to train AI models or to improve services for other customers. Our AI architecture uses per-tenant inference: each venue’s own data is used as context to generate recommendations for that venue only. No cross-customer model training occurs. Our AI provider is contractually prohibited from using customer data for training.

Who Do We Share Your Data With?

We share personal information only with subprocessors necessary for service delivery, and as required by valid legal process. We do not share data with advertising networks, social media platforms (for advertising purposes), or data brokers.

Our subprocessors

Each subprocessor is contractually obligated to keep personal information confidential and to use it only for the purposes for which we disclose it. Everbook will utilize reasonable efforts to update this Privacy Policy from time to time related to vendors acting in a Provider capacity as set forth above.

Other disclosures

We may also disclose personal information:

• To a buyer or successor in the event of a merger, divestiture, restructuring, or other sale or transfer of some or all of Everbook’s assets, whether as a going concern or as part of bankruptcy or similar proceeding.
• With your consent.
• To fulfill the purpose for which you provided the information — for example, if you use a feature that transmits data to a specified recipient.
• To comply with any court order, law, or legal process, including government or regulatory requests.
• To enforce our rights arising from contracts between you and us, including our License Agreement, and for billing and collection.
• When we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Everbook, our customers, or others, including for fraud protection and credit risk reduction.

We may disclose aggregated or deidentified information that does not identify any individual or device without restriction.

Global Privacy Control (GPC)

We will implement and honor Global Privacy Control signals. Since we do not sell or share personal information for advertising purposes, the practical effect of a GPC signal on our Platform is limited — but we respect the signal and will not process your data for any purpose that GPC is designed to restrict.

How Long Do We Keep Your Data?

We retain personal information only as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Our retention schedule is as follows:

A formal written retention schedule will be finalized concurrently with this Privacy Policy. Vendor obligations to delete data at the end of services are addressed through standard data processing agreement (DPA) terms.

How Do We Keep Your Data Secure?

Security controls in place

We have implemented the following measures to protect your personal information:

• Encryption in transit: TLS 1.2 or higher for all data transmitted between your device and our servers.
• Encryption at rest: AES-256 encryption for all stored data (Supabase default).
• Password protection: Hashed passwords.
• Role-based access control: Event Operator users have permissions scoped to their role. Internally, access to sensitive data is granted on a need-to-know basis.
• Audit logging: Sensitive data access within the Platform is logged.
• Subprocessor security: Subprocessors maintain security under SOC 2 or comparable compliance frameworks.
• No paper files: Everbook operates digitally. No physical records containing personal information are maintained.

Your role in security

Where you have chosen a password for access to the Platform, you are responsible for keeping that password confidential. We ask you not to share your password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of information transmitted through our Platform. Any transmission is at your own risk.

What Are Your Privacy Rights?

Rights we extend to all users

Per Everbook’s operating decision, we extend CCPA/CPRA-grade rights to all individuals regardless of their state of residence. This ensures consistent treatment of our various consumers.

You have the following rights:

• Right to know/access: You may request confirmation of whether we process your personal information and a copy of the specific pieces we hold.
• Right to data portability: You may request a portable, machine-readable copy of your personal information. Our Platform supports data export.
• Right to delete: You may request deletion of your personal information, subject to retention obligations for billing, employment, contract, and legal compliance.
• Right to correct: You may request correction of inaccurate personal information.
• Right to limit use of sensitive personal information: You may request that we limit our use of sensitive personal information to what is necessary to provide the services you requested.
• Right to appeal: You may appeal a denied rights request.
• Authorized agent requests: You may designate an authorized agent to submit requests on your behalf.

Rights that do not apply (because the underlying activity does not occur)

Because Everbook does not sell personal information, does not share it for advertising, and does not use it for targeted or cross-context behavioral advertising, the following rights are technically available but have no practical effect:

• Right to opt out of sale of personal information
• Right to opt out of sharing or targeted advertising

A “Do Not Sell or Share” link may be displayed on our website, even though no such activity occurs.

How to exercise your rights

To exercise any of these rights, contact us at privacy@everbook360.com. An in-app rights request flow may be available but is not operational as of the publication date of this notice. Identity verification will be proportionate to the sensitivity of the data requested. All requests are logged and tracked to completion within statutory deadlines.

Point of Collection Notices

Throughout the Platform, Licensed Software, or generally when visiting our website, you understand that you may encounter additional notices “at point of collection”. These notices are intended to reference and complement this Privacy Policy and Everbook’s License Agreement and are herein incorporated by reference. These notices may serve as general reminders, provide instructions, or additional terms that may require review and consent / agreement. These notices are generally designed to be displayed at a time when data is collected, but such notices will not always be displayed when data is collected (for example, a notice may be displayed prior to the commencement of an activity when data is collected but the notice will not be repeatedly displayed during the course of the activity). These notices may collect information, such as recording your consent to the notice, in addition to notifying you of other specific aspects of data collection or usage. Notices are subject to change and update. In the event of a conflict between any notice and this Privacy Policy or the attached License Agreement, the Privacy Policy and attached Agreement shall control.

General information, personal information, product or organizational information, feedback, and / or other requests for information may be found in point of collection notices. You generally consent to the use of information for its stated and intended purpose in such notice (e.g. using your personal information to contact you in response to a submission).

Point of collection notices will generally be displayed when data is to be collected and / or as a static notice in the footer of your Platform homepage dashboard. A copy of Everbook’s Point of Collection Notice may also be found below.

Routing for processor-held data

For end-client and event-guest data — where Everbook acts as a processor and the Event Operator is the controller — rights requests should be directed to the relevant Event Operator (venue or vendor). Everbook will assist Event Operators with fulfillment per standard processor responsibilities.

California residents

California’s Shine the Light law (Civil Code Section § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to third parties for direct marketing purposes. To make such a request, or to submit a request to opt-out of such disclosures, if any, please contact us at privacy@everbook360.com or write us at: 401 Guadalupe St. Unit #1820 Austin, TX 7870.

A California Consumer Privacy Act (CCPA) notice at collection is embedded throughout this Privacy Policy / Notice. Because we extend CCPA/CPRA-grade rights to all individuals regardless of state of residence, California residents receive the same rights described in the What Are Your Privacy Rights? section above.

Nevada residents

Nevada provides its residents with a limited right to opt out of certain personal information sales. You may submit a sale opt-out request to privacy@everbook360.com [or toll-free number]. However, please know we do not currently sell data triggering that statute’s opt-out requirements.

Washington residents

Washington residents have additional rights under the My Health My Data Act (MHMDA) regarding consumer health data, which includes dietary restrictions and allergies collected through our Platform. See the Washington Consumer Health Data — Critical Notice section above. We will obtain opt-in consent before processing consumer health data from Washington residents, and a dedicated Consumer Health Data Privacy Notice will be available on our website.

Texas residents

If you are a Texas resident, The Texas Data Privacy and Security Act (TDPSA) contains many of your privacy and data-related rights. Texas consumers’ rights over their data include the right to:

• know if Everbook is processing their personal data;
• obtain personal data about themselves in a readily usable format;
• opt out from personal data processing for the purpose of targeted ads, selling of personal data, and certain types of profiling;
• correct errors in their personal data;
• delete their personal data;
• submit data-related requests without creating an account; and
• not be penalized for exercising their legal rights

If you wish to exercise your rights as a Texas resident, please contact us at privacy@everbook360.com with your request, question, or comment.

Tracking Technologies and Cookies

We use first-party cookies for session management and analytics on our website. We do not use advertising cookies, advertising tags, or third-party tracking pixels.

You can set your browser to refuse all or some cookies, or to alert you when cookies are being sent. If you disable cookies, some parts of our website or Platform may not function properly.

Our analytics provider collects aggregated, deidentified usage data.

We do not use web beacons for advertising or behavioral tracking. We do not collect information about your activities across third-party websites, apps, or online services (behavioral tracking).

Artificial Intelligence and Automated Decision-Making

AI-assisted features

Our Platform uses AI-assisted features to surface recommendations to Event Operators:

• Margin recommendations: suggestions for pricing and cost optimization based on the venue’s own event data.
• Vendor recommendations: suggestions for vendor selection based on the venue’s own historical data.

These are decision-support tools for business operations. They do not constitute automated decisions about individuals, and they do not produce legal or similarly significant effects on any person. All Platform users are strongly encouraged to recognize that recommendations are not guarantees, may contain errors, and must be verified independently.

Our AI commitments

• Per-tenant inference: Each venue’s own data is used as context to generate recommendations for that venue only. No cross-customer model training occurs.
• No identifiable customer data shared with other venues’ models.
• No provider training: Our AI provider is contractually prohibited from using customer data to train their models.
• No AI training on identifiable data: Everbook does not use customer data to train AI models or to improve services for other customers.

What we do not do

We do not engage in:

• Profiling with legal or similarly significant effects on individuals
• Automated decisions affecting employment, credit, housing, insurance, healthcare, education, or essential services
• Large-scale monitoring, tracking, or location processing
• Biometric identification

Cross-Border Data Transfers

All personal information is stored and accessed exclusively within the United States. Our primary data infrastructure (Supabase, AWS) operates in US regions. Our Event Operator agreements commit to US-only data residency.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes to how we treat your personal information, we will notify you by email to the primary email address associated with your account, and/or through a notice on our website or Platform home page.

The date this policy was last revised is identified at the top of this page. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you and for periodically visiting this page to check for changes.

Contact Us

To ask questions, submit a rights request, or comment about this Privacy Policy and our privacy practices, contact us at:

Email: privacy@everbook360.com
Attention of: Zachary Siegel, Chief Executive Officer
Mailing address: 401 Guadalupe St. Unit #1820 Austin, TX 78701
512-789-2103

Key Definitions

Point-of-Collection Privacy Notice

This Point-of-Collection Privacy Notice (“POC Notice”) supplements Everbook’s Privacy Policy and provides specific disclosures required by state privacy laws. Where applicable, the disclosures below are provided at or before the point of collection of personal information.

By providing your information, you acknowledge that you have read and understood how we will collect and use your data as described below.

Overview

This POC Notice covers the following data collection points on our Platform and website:

1. Website Contact & Demo Request Forms (everbook360.com)

Your rights: You may opt out of marketing communications at any time using the unsubscribe link in our emails. Your personal data is not sold or shared for advertising purposes.

2. Account Registration (Platform Sign-Up)

Your rights: You may access, correct, delete, or export your account data at any time via your account settings or by contacting privacy@everbook360.com.

3. Subscription Checkout (Billing Information)

Your rights: Payment data is held exclusively by our payment processor. You may request deletion of your billing information by closing your account or contacting privacy@everbook360.com.

4. Event Inquiry, Event Management, and RSVP Forms (Hosted by Everbook)

This collection point includes forms where end clients or Event Operators submit event guest information on Everbook’s Platform.

5. Customer Support Communications

Your rights: You may request deletion of your support records by contacting privacy@everbook360.com.

6. Employment Application & Onboarding Submission

Your rights: Applicants may request access to, correction of, or deletion of their application data by contacting privacy@everbook360.com. Please note that some data (I-9, payroll records) must be retained by law.

7. File & Photo Uploads

Important: When uploading photos or documents, you confirm that you have obtained any necessary consents from individuals depicted or have a lawful basis for such upload. Everbook is not liable for third-party claims arising from your uploads.

State-Specific Acknowledgments

California residents. California’s CCPA/CPRA requires businesses to disclose the categories of personal information collected and the purposes for which it is used at or before the point of collection. This POC Notice satisfies that requirement. You may exercise your CCPA/CPRA rights at any time by contacting privacy@everbook360.com. Further, California’s Shine the Light Law (Civil Code § 1798.83) provides that California residents may request information about our disclosures of personal information to third parties for direct marketing purposes by contacting us at privacy@everbook360.com.

Colorado, Connecticut, Virginia, Utah residents. Residents of these states have similar rights to know what data is collected, why it is collected, and how to exercise their rights. This POC Notice provides the disclosures required by state law. Contact privacy@everbook360.com with any questions or to exercise your rights.

Texas residents. Texas consumers have rights under the Texas Data Privacy and Security Act (TDPSA), including the right to know, access, correct, delete, and opt out of certain processing. Contact privacy@everbook360.com with any questions or to exercise these rights.

Nevada residents. Nevada residents have a limited right to opt out of certain personal information sales. You may submit a request to privacy@everbook360.com. However, please note that Everbook does not currently sell data triggering that statute’s opt-out requirements.

Washington residents. Washington residents have rights under the My Health My Data Act (MHMDA) regarding consumer health data (dietary restrictions and allergies). See the Washington Consumer Health Data — Critical Notice section of the Privacy Policy and the dedicated Consumer Health Data Privacy Notice.

Consent Acknowledgment

By submitting information through any of the collection points listed above, you acknowledge that:

• You have read and understood this Point-of-Collection Privacy Notice.
• You understand what categories of personal information are being collected and the purposes for which they will be used.
• You consent to the collection and use of your information as described herein.
• You understand that you may exercise your privacy rights at any time by contacting privacy@everbook360.com.
• You understand that this POC Notice supplements but does not replace the full Everbook Privacy Policy, available at everbook360.com/privacy nor does this POC Notice replace any other agreement you may have with Everbook.

In the event of a conflict between this POC Notice and the Everbook Privacy Policy or License Agreement or Terms, the Privacy Policy and License Agreement and Terms shall control.

How to Exercise Your Rights

To exercise any of your privacy rights (access, deletion, correction, portability, appeal, withdrawal of consent), please contact us at:

Email: privacy@everbook360.com
Attention: Zachary Siegel, Chief Executive Officer
Mailing Address: 401 Guadalupe St. Unit #1820 Austin, TX 78701

Identity verification will be proportionate to the sensitivity of the data requested. All requests are logged and tracked to completion within statutory deadlines.

Global Privacy Control (GPC): We will honor Global Privacy Control signals. Since Everbook does not sell or share personal information for advertising purposes, the practical effect of a GPC signal on our Platform is limited, but we respect the signal and will not process your data for any purpose that GPC is designed to restrict.

Questions or Concerns?

If you have questions about this Point-of-Collection Privacy Notice or our data practices, please contact us at privacy@everbook360.com.

You may also lodge a complaint with the relevant state Attorney General’s Office or data protection authority if you believe your privacy rights have been violated.