Privacy Policy

1. Our Role

EverythingBusiness.ai provides a governed business operating and orchestration layer through which organizations may connect authorized third-party systems, configure workflows, use artificial intelligence services, establish permissions and approvals, and maintain operational records.

When a business customer provides personal information to EB or directs EB to process information from a connected system, the customer generally determines the purposes for which that information is processed. In those circumstances, EB generally acts as a service provider or processor on behalf of the customer.

EB may separately act as a business or controller for information processed for our own business purposes, such as administering customer relationships, providing support, securing the Services, and operating our website and infrastructure.

2. Information We Process

Depending upon use of the Services, EB may process the following categories of information.

Account and identity information

Authentication is currently provided through WorkOS. EB maintains identifiers connecting authenticated identities to EB organizations, actors, memberships, and permissions. EB does not currently store users' passwords or authentication factors in its application database.

Business and organization information

This may include business names, organizational settings, workflow definitions, workspace configurations, roles, permissions, enabled services, connector configuration, governance settings, and administrative information.

Connected-system information

Customers may authorize EB to retrieve information from supported systems. The currently implemented HighLevel connector may retrieve limited contact and location information including contact identifiers, first and last names, email addresses, telephone numbers, location identifiers, location names, and time zones. The current HighLevel implementation is read-only.

Workflow and AI information

This may include workflow instructions, workspace inputs, execution information, model inputs and outputs, approval information, and information generated while executing customer-authorized workflows.

Operational and audit information

EB records various audit, execution, connector, security, configuration, and AI-usage events. These records can include actor identifiers, provider and model information, token usage, execution duration, outcomes, and external request identifiers.

Technical information

The EB application itself does not currently intentionally collect device fingerprints, advertising identifiers, geolocation, browser characteristics, or similar tracking information. Infrastructure and web-proxy logs may contain request information such as IP addresses, URLs, and HTTP headers.

3. Sources of Information

Information may come from:

• authorized users;
• customer organizations;
• customer-configured workflows;
• customer-authorized connected systems;
• identity providers;
• AI and infrastructure providers;
• operational activity within the Services; and
• server and infrastructure systems.

4. How We Use Information

We use information as reasonably necessary to:

• provide and operate the Services;
• authenticate users;
• enforce permissions and tenant boundaries;
• execute customer-authorized workflows;
• access customer-authorized connected systems;
• provide AI functionality;
• apply approvals, limits, policies, and governance controls;
• maintain operational and audit records;
• secure credentials;
• monitor technical performance;
• investigate security or operational incidents;
• provide support;
• administer customer relationships;
• comply with legal obligations; and
• protect EB, our customers, users, connected systems, and third parties.

5. Artificial Intelligence

Certain EB workflows may transmit information to third-party AI providers.

EB currently implements integrations with OpenAI and Anthropic.

Information transmitted to an AI provider may include workflow instructions and data being processed by the relevant workflow step. Depending upon the customer's workflow, that information may contain personal information or information originating from a connected system.

The current OpenAI implementation sends a store: false parameter with applicable model requests. The current Anthropic implementation does not send an equivalent retention parameter.

Provider retention, privacy, and contractual practices may differ and may change independently of EB.

EB does not treat Customer Data as its proprietary generalized AI-training dataset merely because the data is processed through an AI-enabled workflow.

Further detail appears in our AI & Data Use Policy.

6. Connected Systems

Customers determine which supported external systems they authorize EB to access.

Customers are responsible for ensuring they possess the rights, permissions, authorizations, and lawful bases necessary to permit EB to process information from those systems.

EB does not control the independent privacy, security, availability, or business practices of third-party connected systems.

7. Service Providers and Subprocessors

EB currently uses or supports service providers including:

• Hetzner — application and infrastructure hosting;
• WorkOS — authentication and identity services;
• Amazon Web Services — Secrets Manager, KMS, credential-management infrastructure, and optional backup infrastructure;
• OpenAI — AI model inference;
• Anthropic — AI model inference where configured;
• HighLevel / LeadConnector — customer-authorized CRM connectivity.

Additional details appear on our Subprocessors page.

8. Payments

EverythingBusiness.ai does not currently provide self-service checkout or process payment-card or bank-account information through the EB application.

Commercial billing associated with EB is currently handled separately from the EB application.

9. Cookies and Tracking

The authenticated EB application currently uses cookies necessary for authentication and security.

EB does not currently implement advertising cookies, behavioral analytics, tracking pixels, remarketing technologies, or session-recording software.

See our Cookie Notice for additional information.

10. Sale or Sharing of Personal Information

EB does not currently sell personal information.

The EB application does not currently share personal information for cross-context behavioral advertising.

If our practices materially change, we will update this Policy and provide legally required choices.

11. Retention

Retention varies by data category.

Current application controls generally establish:

• protected execution payloads: approximately 30 days;
• completed execution jobs and related execution records: approximately 30 days;
• audit events: approximately 400 days;
• technical usage information: approximately 400 days;
• export artifacts, where implemented: approximately 72 hours;
• local database backups: generally 7 days; and
• off-site backups, when enabled: approximately 35 days.

Legal holds, security requirements, backup cycles, contractual requirements, or applicable law may extend these periods.

Certain organization records, configuration histories, workspace revisions, operational records, audit evidence, security records, or similar records may survive account termination for legitimate operational, security, evidentiary, contractual, or legal purposes.

12. Security

EB uses administrative and technical safeguards designed to protect information.

Current controls include public-edge TLS, authorization and permission controls, PostgreSQL row-level security and tenant isolation, AWS Secrets Manager, KMS-backed protection for designated execution payloads and credentials, input validation, rate limits, security headers, container restrictions, audit records, and backup mechanisms.

Not all application data is encrypted at the application layer, and EB does not represent that every field or record receives identical encryption treatment.

No system can guarantee absolute security.

Our Security page describes these controls in more detail.

13. Privacy Rights

Depending upon applicable law and your location, you may have rights concerning your personal information, including rights to request access, correction, deletion, portability, information concerning processing, restriction, or objection.

When EB processes information solely on behalf of a customer, requests concerning that information should generally be directed to the customer that controls the information.

Requests concerning information controlled directly by EB may be submitted to tech@everythingbusiness.ai.

We may take reasonable measures to verify requests.

California privacy laws provide qualifying consumers with rights that can include knowing what information is collected and why, requesting correction or deletion, and obtaining information concerning disclosure, sale, or sharing.

EB does not currently sell or share personal information through the EB application in a manner requiring a sale/sharing opt-out.

14. Children

EverythingBusiness.ai is intended for business use and is not directed to children under 13.

Customers may not intentionally use the Services to process children's information in violation of applicable law.

15. Changes

We may update this Privacy Policy as our Services, business, technology, or legal obligations change.

The current effective date appears at the top of this Policy.

16. This Website

This section describes the everythingbusiness.ai marketing website, which is operated separately from the authenticated EB application described above.

What the Get connected form collects

The Get connected form collects your name, work email, company name, an optional company website, and whatever you write in the free-text field.

These details are sent by email to our team so a person can review the request and respond. They are not stored in a database on this website, not used for marketing, not sold or shared with third parties, and not used to create an account of any kind. Submitting the form records that you acknowledged this notice, together with the date and which version you agreed to.

Email delivery is handled by Postmark, and submissions are checked by Cloudflare Turnstile to confirm they come from a person. Both process the submission in order to deliver and protect it.

Notice version 2026-08-15.

Cookies and analytics on this website

This website does not set advertising cookies, behavioral analytics, tracking pixels, remarketing tags, or session-recording software. Its hosting provider records ordinary server request information, which can include IP addresses, URLs, and HTTP headers.

Contact

Email: tech@everythingbusiness.ai