1. The short version
- We store an inventory of your clients’ digital assets. We never store passwords, API keys, recovery codes, or any other secret — the product is built so that there is nowhere to put one.
- We use your email address to sign you in and to send the reminders you asked for. We do not send marketing email, and we do not sell or share your data with advertisers.
- We set no analytics or advertising cookies. The only cookies are the ones that keep you signed in.
- You can delete your entire account yourself, at any time, and it is removed immediately.
2. Who is responsible for what
Everkey holds two different kinds of personal data, and our role differs for each.
Your own account data — your email address and name. We are the controller of this data. This policy describes what we do with it.
The data you record about your clients — their names, business names, and contact email addresses. You are the controller of that data and we act as your processor: we hold and display it on your instructions and do nothing else with it. You are responsible for having a lawful basis to record it, and for telling your clients about it where you need to. If you need a data processing agreement, email us and we will provide one.
3. What we collect
Data you give us
| Data | Why we hold it |
|---|---|
| Email address | To sign you in and send service email. Required. |
| Name | To address you in the app and in email. |
| Client records: name, business name, contact email, client-owned identity email, credential location(a text pointer such as “in the client’s 1Password”), an optional link to that location, and your notes | This is the service. You entered it; we store and display it. |
| Asset records: type, provider, owner email, login method, ownership status, renewal date, cost and currency, credential location pointer, notes | Same. |
Data we generate
| Data | Why we hold it |
|---|---|
| Sign-in codes and links | Single-use, and they expire 10 minutes after they are issued. |
| Session records | To keep you signed in. Sessions last up to 90 days. |
| Sign-in attempt counters, keyed to your email address | To rate-limit sign-in abuse: five failed attempts per 15 minutes, five codes sent per hour. |
| A share token per continuity pack, and when it was created | To serve the pack at an unguessable URL, and to let you rotate or disable it. |
| Reminder log: which asset, which renewal date, which reminder threshold, and when it was sent | So a retry never sends you the same reminder twice. |
| Billing references: customer ID, subscription ID, plan status, and renewal date | To know which plan your account is on. These are opaque identifiers, not payment details. |
| Standard server logs, including IP address, browser user agent, and requested paths | Generated by our hosting provider for security and troubleshooting. |
Data we deliberately do not collect
We do not store passwords, API keys, private keys, two-factor seeds, or recovery codes — not yours, and not your clients’. This is enforced in the database design, not merely as a policy: there are no columns for them. Automated verification scripts run against the live database and assert that the number of secret or password columns is zero.
Your handover readiness score is calculated when a page is rendered and is never written to the database.
4. Why we are allowed to hold it (legal bases)
Where the UK or EU GDPR applies, we rely on:
- Performance of a contract — to provide the service you signed up for, including sign-in, storage of your records, renewal reminders, and continuity packs.
- Legitimate interests — to keep the service secure and available: rate limiting, abuse prevention, server logs, and duplicate-send protection. We have considered your interests and think these are limited and expected.
- Legal obligation — to keep records required for tax and accounting. Payment records are held by Paddle (see below), not by us.
We do not rely on consent for anything today, because we send no marketing and run no tracking. If that ever changes, we will ask first.
5. Who else processes it
We keep this list short on purpose. These are our sub-processors:
| Provider | What they do | Where |
|---|---|---|
| Neon | Hosts our PostgreSQL database — this is where your account, client, and asset records live. | AWS ap-southeast-1, Singapore |
| Vercel | Hosts and serves the application; generates server logs. | United States, with a global delivery network |
| Resend | Sends transactional email: sign-in codes, sign-in links, and renewal reminders. Receives the recipient address and the message content. | United States |
| Paddle | Merchant of record for subscriptions. Collects your billing name, address, payment method, and tax location directly. We never see your card details. | United Kingdom and European Union |
We do not use advertising networks, data brokers, or third-party analytics. We do not sell personal data, and we do not use your data — or your clients’ — to train machine-learning models.
We may disclose data if the law requires it. If we receive a legally binding request for your data, we will tell you unless we are prohibited from doing so.
6. International transfers
We are based in Malaysia. As the table above shows, data is processed in Singapore, the United States, and the United Kingdom or European Union. Where personal data of UK or EU residents is transferred outside those regions, our providers rely on Standard Contractual Clauses or an equivalent transfer mechanism.
7. Cookies
Everkey sets only strictly necessary cookies: a session cookie that keeps you signed in, and the security cookies our authentication library uses to protect the sign-in flow.
There are no analytics, advertising, or tracking cookies, which is why you are not asked to dismiss a cookie banner. If we later add product analytics, we will use a privacy-respecting, cookieless tool and update this policy before doing so.
8. How long we keep it
- Your account and records are kept for as long as your account exists. We do not delete them for inactivity, and we do not delete them if you stop paying — see section 8 of the Terms of Service.
- When you delete your account, we remove it immediately and permanently: your freelancer record, every client and asset, reminder logs, sessions, sign-in records, and outstanding sign-in tokens. Deletion is confirmed by typing your own email address, and it cannot be undone. Export first if you want a copy.
- Encrypted database backups held by our database provider may contain residual copies for a short period after deletion. These are overwritten within 30 days.
- Sign-in codes expire after 10 minutes. Sessions expire after at most 90 days.
- Server logs are retained by our hosting provider for a short period under their own retention policy.
- Payment and tax records are held by Paddle for as long as tax law requires, typically seven years. That retention is theirs, not ours, and deleting your Everkey account does not erase it.
9. Your rights
Wherever you live, you can ask us to:
- give you a copy of the personal data we hold about you;
- export your data in a portable format — download your clients and assets as a CSV from Settings at any time, or email us for a full export of everything we hold and we will send it within 30 days;
- correct anything inaccurate;
- delete your account and its data, which you can also do yourself in Settings;
- restrict or object to processing based on legitimate interests.
Email support@geteverkey.com from the address on your account. We will respond within 30 days and will not charge you for it.
If you are in the UK or EU and think we have handled your data badly, you can complain to your national data protection authority. If you are in Malaysia, you can raise it with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi). We would rather you told us first.
10. Continuity packs are public links
When you enable a continuity pack for a client, Everkey creates a page at an unguessable URL that anyone holding the link can open without signing in. The page carries instructions telling search engines not to index it and is excluded from our sitemap, but it is not password protected.
That page shows the client and asset information you have recorded, including your notes. It never shows credentials, because we hold none. You can rotate the link — which immediately breaks the old one — or disable it entirely, at any time.
11. Security
- All traffic is served over HTTPS. Data is encrypted in transit and at rest by our database and hosting providers.
- Every read and write is scoped to the signed-in account, so one user cannot reach another’s clients or assets. This is verified by automated tests against the live database.
- Sign-in is by one-time code or link, with rate limiting on both failed attempts and sends. There are no passwords to steal.
- The strongest control is architectural: the most sensitive data in this category — credentials — is never in the system at all.
No service can promise perfect security. If a breach affects your personal data, we will tell you without undue delay, and notify the relevant regulator within 72 hours where the law requires it.
12. Children
Everkey is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
13. Changes to this policy
If we make a material change, we will email account holders at least 14 days before it takes effect and update the date at the top of this page. Minor clarifications may be made without notice.
14. Contact
MRAT Enterprise
Sole proprietorship registered in Malaysia · SSM 003542568-X
support@geteverkey.com
If you need a postal address in order to exercise a data protection right or serve a formal notice, email us and we will provide one.