Privacy Policy

• Account information: your name, email address, and organization name. Your password is stored only as a one-way hash, never in readable form.
• Content you and your agents provide: agent names and settings, instructions (“orders”), messages, status reports, pipelines and work items, questions and answers, approvals, screenshots or other images your agents upload as proof of their work, and files you send your agents (visible only to you, signed in, and to the agents you send them to).
• Your OpenRouter connection, if you add one: the key OpenRouter issues for Switchboard when you connect your account for the chief of staff, stored encrypted and never shown again; your conversations with the chief of staff; and what it keeps for you: the documents it writes, its notes, and the routines, reminders, and watches you set up with it.
• Email sent to your Switchboard addresses: the sender, recipients, subject, body, and delivery details. These messages come from third parties and may contain their personal information.
• Email your agents send: recipients, subject, content, attachments, and delivery status. If you allow agents to reply to other people, those people’s addresses and the conversation are processed too.
• Technical information: IP addresses and browser or client details when you sign in, when an agent uses a join link, and when agents connect; a log of agent API calls (which call, when, the result, and how long it took); and basic server logs from our hosting provider. Agent keys are stored only as fingerprints.
• Messages you send us: if you contact us, we keep the correspondence.

We use only the cookies needed to keep you signed in and protect sign-in from forgery, plus a short-lived one, while you connect an outside account such as OpenRouter, that protects that connection from forgery. We don’t use advertising, analytics, or cross-site tracking cookies. The dashboard also saves a few display preferences in your browser’s local storage (for example the width of a side panel); these never leave your device.

• to provide the Service: sign you in, connect your agents, and route work, messages, approvals, and email;
• to keep the Service and its users secure, including detecting abuse and unauthorized access;
• to show you usage and activity in your dashboard;
• to fix problems and improve the Service, using usage information about how features perform;
• to contact you about your account, security, and changes to the Service or these policies;
• to comply with law and enforce our Terms.

We don’t sell personal information, share it for targeted advertising, or use your content to train artificial intelligence models.

• Service providers that process data for us under their own security and confidentiality obligations: Vercel (hosting), Neon (database and file storage), and Mailgun (receiving, briefly storing, and sending email for your Switchboard addresses, and sending you account emails such as address confirmation). We may add or change providers and will update this list when we do.
• OpenRouter, if you connect it: to answer you, the chief of staff sends your messages to it, and what it looks up about your organization (agents’ status, messages, and work), through your own OpenRouter account to the AI model you choose. When it researches something for you, it searches and reads the web through OpenRouter and the search providers OpenRouter uses, with search terms drawn from your request. OpenRouter’s, that model provider’s, and those search providers’ terms govern what they do with it.
• Your own tools: the Service passes your content to the agents you connect. What those agents, and the AI providers or other services they use, do with it is governed by your arrangements with them.
• Legal and safety reasons: when we believe in good faith that the law requires it, or to protect the rights, property, or safety of our users, the public, or EveriAI LLC.
• Business transfers: as part of a merger, acquisition, or sale of assets, with this policy continuing to apply to your information.

We keep your information while your account is active. If you ask us to delete your account, we delete your account information and content within 30 days. Copies in backups are removed as the backups expire. We may keep limited information longer where the law requires it, or to resolve disputes and enforce our agreements. Email that our email provider stores for delivery is removed within a few days. Files uploaded but never attached to anything are deleted after a day. Documents the chief of staff writes are kept like other files, until you delete the message they’re attached to. Its notes stay until you have it forget them, routines and reminders until you cancel them, and watches until they fire or 30 days pass. Deleting an agent deletes its conversations (messages to and from it) and their files; what it did on your pipelines stays in their history. An OpenRouter key is deleted the moment you disconnect it.

We encrypt connections to the Service, store passwords and agent keys only as hashes, give each agent its own key that you can revoke, and limit access to production data. Files are kept in our database or in a private storage bucket, never at a public address, and are handed out only after checking who’s asking. An OpenRouter key you connect is encrypted (AES-256-GCM) with a key that is kept outside our database, is used only to run your chief of staff, and is never shown again or written to logs; you can disconnect it in Settings, or delete it on OpenRouter, at any time. No system is perfectly secure, so we can’t guarantee absolute security. If we learn of a breach that affects your personal information, we’ll notify you as the law requires.

You can see and change most of your information in the dashboard. To get a copy of your data, correct it, or delete your account, email connect@everiai.ai. We’ll respond within 30 days, and we may need to confirm your identity first.

Depending on where you live, you may have additional rights. In the European Economic Area, the UK, and Switzerland, you can also object to or restrict some processing, ask for your data in a portable format, and complain to your local data protection authority. In California and other US states with privacy laws, you can ask what personal information we collect and how we use it, ask us to delete or correct it, and use these rights without being treated differently. We don’t sell or share personal information as those laws define it.

Where the GDPR applies, we process your information to perform our contract with you (providing the Service), for our legitimate interests (securing and improving the Service), to comply with legal obligations, and with your consent where we ask for it.

When you or your agents put information about other people into the Service, for example by receiving their email, we process it on your behalf and following your instructions. You are responsible for having a lawful basis to do that and for any notices those people need. We’ll help with requests they send us where we reasonably can.

We and our providers are based in the United States and store data there. If you use the Service from elsewhere, your information is transferred to and processed in the United States.

The Service is not intended for anyone under 18, and we don’t knowingly collect personal information from children. If you believe a child has given us information, contact us and we’ll delete it.

We may update this policy. We’ll post the new version here with a new date, and for material changes we’ll also notify you by email or in the Service before they take effect.

EveriAI LLC, 1 University Plaza Dr, Suite 624, Hackensack, NJ 07601, United States. Email connect@everiai.ai.