What this is
This addendum forms part of the terms of service between you (the customer) and retriv, Inc. (“EveryPage”, “we”, “us”). It covers the personal data we process for you when your site's visitors use EveryPage. It applies automatically when you use EveryPage.
- You are the controller. We are your processor.
- It is written to meet GDPR Article 28, UK GDPR, and US state privacy laws such as the CCPA (we act as your “service provider”).
The processing
- Subject: running search and the Ask box on your site.
- Data subjects: visitors to your site who search or ask a question.
- Data: the text of questions (which may contain personal data a visitor chooses to type), answers, cited pages, timestamps, and thumbs up or down. No IP addresses or identifiers are stored with them.
- Special categories: none intended. Do not ask visitors for sensitive data in the Ask box.
- Also processed: the public pages of your site, which may name people (for example staff pages).
- Duration: questions are deleted after 90 days; everything else while your account is active.
- Transient data: visitors' IP addresses are used briefly in memory to enforce rate limits, and are not stored.
What we promise
- Process the data only to provide EveryPage, following your documented instructions (these terms, and your settings).
- Never sell it, or use it to train AI models or for our own marketing.
- Make sure everyone with access is bound by confidentiality.
- Keep it secure (see “Security” below).
- Help you answer data subject requests and with impact assessments, where reasonable.
- Tell you without undue delay, and within 72 hours, after we become aware of a personal data breach affecting your data.
- Delete the data when your account ends (see “Ending”).
- Give you the information you need to show compliance, and allow reasonable audits, by written request, at most once a year.
What you promise
- You have a lawful basis to use EveryPage on your site.
- Your privacy notice tells visitors that questions typed into the Ask box are processed by a provider and kept for 90 days.
- You do not invite visitors to type sensitive personal data into the Ask box.
Sub-processors
You authorise us to use these sub-processors. We will give you at least 30 days' notice of a new one by email, and you may object; if we cannot resolve it, you may cancel.
| Provider | What for | Where |
|---|---|---|
| Microsoft Azure | Hosting, databases, storage, email (Azure Communication Services) | USA (Central US) |
| SearchStack | Search index of your pages; stores questions and feedback; serves search and answers | USA |
| Anthropic, PBC | Writes answers (Claude Haiku) from your pages and the visitor's question | USA |
| Stripe, Inc. | Customer billing only (no visitor data) | USA |
International transfers
Data is processed in the United States. For data from the EEA, UK or Switzerland, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum, which are incorporated by reference.
Security
- Encryption in transit (HTTPS/TLS) and at rest (Azure storage encryption).
- Questions are stored without IP addresses or visitor identifiers.
- Each customer's widget uses its own key, limited to reading that customer's search results.
- Access to production is limited to the people who run EveryPage, with multi-factor sign-in.
- Automatic deletion: questions after 90 days, demo sites after 24 hours.
Ending
- When your account ends, we delete your sites, crawled pages and visitors' questions, about 30 days after a paid plan ends, or straight away if you delete your account.
- Until then you can read your questions in the Console or through the EveryPage API.
- Backups are overwritten on their normal cycle.
Other terms
- If this addendum and the terms of service conflict on personal data, this addendum wins.
- Liability under this addendum is subject to the limits in the terms of service.
- Questions: support@everypage.dev.