Privacy Policy

Who we are

Everloved is operated by Patolix, SIA, registration No. 40203451931, Latvia. For the purposes of applicable data protection laws, Patolix, SIA acts as the controller of personal data processed through the Everloved service.

If you have privacy-related questions or want to exercise your data protection rights, please use our Support page.

Information we collect

• Account information such as name and email address.
• Stories, messages, and files that you choose to upload.
• Beneficiary details you provide, such as name, email, or phone number. This information is usually provided by the account owner, not directly by the beneficiary.
• Subscription and billing identifiers required to manage payments.
• Technical data such as logs, security events, and service diagnostics.
• Information submitted through the public support form, including your email address, optional name, subject, and message. For security and abuse prevention, we also keep limited request metadata such as the user agent, Turnstile result, and pseudonymous network correlation hashes. Raw IP addresses are not stored in the public support audit log.
• Limited, aggregate website usage data from selected public pages and checkout milestones, such as the page path, referrer, browser, device type, approximate location derived from network information, and controlled interaction labels such as CTA location, selected plan, or completed purchase amount and currency.

How we use your information

• To provide access to your Everloved vault and account.
• To store and deliver stories and files according to your handover settings.
• To send account notifications, invitations, and reminders.
• To process subscriptions, billing, and payment events.
• To protect the service, detect abuse, and maintain reliability.
• To understand public website traffic and improve acquisition, content, and usability without tracking people across websites.

Phone numbers and text reminders

Providing a phone number is optional. If you choose to add one, it is used as an additional contact method so Everloved can try to reach you if email reminders are not enough.

If text reminders are enabled, Everloved will use the phone number you provide only for service-related messages such as billing reminders and failed payment alerts related to the service.

SMS messages are not used for marketing. Where required, SMS messages are sent only after you have explicitly opted in. You can withdraw your SMS consent at any time, including by replying STOP to SMS messages where SMS replies are supported. We do not sell or share phone numbers or SMS consent data with third parties for their own marketing purposes. More detail is available on our SMS Notifications page.

Legal basis for processing

• We process account, vault, and handover data as necessary to provide the Everloved service you request.
• We process billing and transaction-related data as necessary to manage subscriptions, payments, and related records.
• We process certain technical and security data to protect the service, prevent abuse, and maintain reliability.
• Where permitted, we process limited public website analytics based on our legitimate interest in understanding and improving the Everloved website. Where consent is legally required, we rely on consent instead.
• Where required, we rely on your consent for optional features such as SMS reminders.
• We may also process data where necessary to comply with legal obligations.

Infrastructure and service providers

Everloved relies on trusted infrastructure providers to operate the service. These include Supabase for authentication, database services, and certain limited storage-related workflows, Cloudflare R2 as the primary file storage provider, Stripe for subscription billing, Resend for transactional email delivery, Twilio for optional service-related SMS delivery, Cloudflare Turnstile for spam protection, Plausible Analytics for privacy-friendly measurement of selected public pages, and hosting or operational infrastructure provided by Vercel, Hetzner, and GitHub Actions.

These providers process data only to the extent necessary to operate the service on our behalf.

Website and conversion analytics

Everloved uses Plausible Analytics to measure aggregate activity on selected public pages and a limited set of checkout and account setup milestones. The integration does not set analytics cookies or create persistent user profiles. It does not collect pageviews from authentication, invitation, checkout, or signed-in application pages. Query strings and URL fragments are removed before analytics events are sent.

Checkout analytics uses only predefined event names and controlled values, such as the selected plan and, after Stripe confirms a completed purchase, its amount and currency. Everloved does not send account identifiers, email addresses, Stripe identifiers, checkout tokens, story content, beneficiary information, passwords, or form content to Plausible.

Plausible processes limited technical information to produce aggregate statistics, including page paths, referral sources, browser and device information, and approximate geographic data. Analytics data is retained only for as long as reasonably necessary to understand and improve the public website, subject to our Plausible account settings and applicable legal requirements.

Data storage and security

Everloved uses secure infrastructure and access controls to protect stored information. Data is transmitted using HTTPS connections and stored using infrastructure-level encryption provided by our hosting providers. Depending on the workflow, files may be handled through Cloudflare R2 and certain limited Supabase storage-related services. Access to stored data is restricted through authentication, authorization policies, and signed storage access mechanisms.

Data retention

Everloved retains user data for as long as the account remains active or as otherwise needed to operate the service. Users may delete their account from within the application, after which associated data is deleted or queued for deletion in line with our technical and operational processes.

Certain information may be retained for longer periods where required for legal, security, fraud prevention, or operational purposes.

Accepted public support requests are normally retained in the application's support audit for up to 90 days. Minimal records of blocked or duplicate public support requests and related rate-limit counters are normally retained for up to 30 days.

International data transfers

Some infrastructure providers used by Everloved may process data outside the European Economic Area. When this occurs, we rely on appropriate safeguards provided by those providers to protect personal data.

Your rights

Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal data. You may also have the right to object to certain processing activities or request portability of your data. Most account information can be managed directly within the Everloved application. You may also have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been processed unlawfully.

Cookies and similar technologies

Everloved uses essential cookies and similar technologies required for authentication, session management, and security. Additional details about cookies and related technologies can be found in our Cookie Policy.

Children's privacy

Everloved is not intended for use by children. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that such data has been provided, we will take steps to remove it.

Contact and support

If you have questions about this Privacy Policy or your data, please use the support form available on our Support page.