Privacy Policy

EVERYWHERE AI LTDA (“Everywhere AI,” “we,” “us”) builds and operates AI employees: software agents that do work in accounting, finance, marketing, sales, customer service, and related operations. Our registered office is in São Paulo. We also work from Montreal, Los Angeles, São Paulo, and Dubai.

This policy is written to meet the transparency duties of the GDPR, UK GDPR, PIPEDA, Quebec’s Law 25, the CCPA/CPRA and other US state privacy laws, the LGPD, and the sector rules named below. A signed customer agreement can add stricter terms. It does not reduce the rights these laws give to individuals.

This policy covers personal information we handle in three places:

• The Everywhere AI website, including everywhere-ai.com, and the messages people send us from it.
• Sales, contracting, billing, and support for our own business.
• AI employees we design, connect, and run for a customer, including agents that read or write in that customer’s ERP, CRM, email, spreadsheets, and similar systems.

Products we publish under their own brands, such as Milano AI, may have their own privacy notice. When they do, that notice applies to that product. This notice applies to Everywhere AI and to the AI employees we operate under the Everywhere AI name.

The law uses different names for the organization that decides why personal information is used and the organization that handles it on instructions. We play both roles, depending on whose data it is.

When the customer is in charge

If an AI employee works inside a customer’s systems, the customer decides the purpose. The customer is the controller under the GDPR and UK GDPR, the controlador under the LGPD, and the business that engaged us under the CCPA/CPRA. Everywhere AI is the processor, the operador, and the customer’s service provider or contractor. We use that information only to deliver the AI employee the customer asked for, to keep the connection secure, and to meet the law.

When we are in charge

Everywhere AI is the controller of personal information we collect for ourselves: website visitors, people who contact us, billing contacts, and our own recruiting and vendor records.

If you are a person whose information sits in a customer’s ERP, CRM, inbox, or spreadsheet, contact that customer first. We will help the customer answer you. If you contact us directly, we will either respond or pass the request to the customer, as the law requires.

An AI employee is software that performs a defined job. The jobs we build include accounting, finance, marketing, sales, and customer service. A customer can authorize an AI employee to connect to business systems. Those connections can include:

• ERP and accounting systems, including invoices, ledger entries, vendors, customers, and operational finance records.
• CRMs, including contacts, companies, pipeline, and notes.
• Email accounts and message metadata the customer connects.
• Spreadsheets and files, including Excel workbooks the customer places in scope.
• Support inboxes, ticketing tools, and similar customer-service records.

Read access lets the AI employee retrieve what it needs for the task. Write access exists only where the customer turns it on, and only in the systems and fields the customer enables. Material reads and writes are logged so the customer can see what the agent did.

The customer chooses the scope, keeps the right to revoke a connection, and remains responsible for the accuracy of its source systems. Outputs from an AI employee can be wrong. Before an output is used for a filing, a payment, a financial statement, a credit or eligibility decision, tax, regulated advice, or a binding message to a person, the customer reviews it, unless the written order sets a different control and that control is lawful.

We do not, on our own account, make a decision based solely on automated processing that produces a legal effect or a similarly significant effect for a person. Where a customer’s deployment could affect someone in that way, the customer provides the notice, the lawful basis, and the human review that the GDPR, the LGPD, and Quebec’s Law 25 require. A person can ask for information about the logic and for human review through the customer, or through the privacy contact below.

Information we collect for our own business

• Identity and contact details, such as name, work email, phone number, company, and role.
• The content of messages you send us, including demo requests and support mail.
• Billing and contract details for customers who pay us, processed with our payment and accounting providers.
• Technical data from the website: IP address, browser type, device type, pages viewed, and approximate location derived from the IP address.
• Cookie identifiers, as described below.

Information an AI employee processes for a customer

Customer Data is the information the customer authorizes an AI employee to access or that the customer submits to us. It can include personal information inside invoices, ledgers, payroll-adjacent operational files, CRM records, emails, spreadsheets, support tickets, prompts, and the outputs the agent produces. It can include financial account details, government identifiers, and employee or customer contact data when those records are in the connected systems.

We do not ask customers to connect special-category information, such as health, biometric, religious, or similarly sensitive data, unless a written order requires it and a lawful basis is in place. If that information appears incidentally in a connected system, we process it only to perform the service and apply the tighter limits below.

For our own business, we use personal information to:

• Answer inquiries and provide the website. Legal basis: contract, or steps taken at your request before a contract.
• Send service messages about an engagement. Legal basis: contract.
• Send business communications. Where the law requires consent, including CASL, the LGPD, and ePrivacy rules, we send marketing only with that consent or another permitted ground, and every message has a way to stop it. Legal basis: consent or legitimate interests, depending on the message and the country.
• Keep the site and our systems secure, prevent abuse, and understand which pages are used. Legal basis: legitimate interests.
• Keep tax, corporate, and accounting records. Legal basis: legal obligation.

For Customer Data, the purpose is the one the customer sets: run the AI employee, read the systems in scope, write where write access is enabled, log those actions, support the customer, and protect the connection. We do not use Customer Data for our own marketing.

We do not sell personal information. We do not share it for cross-context behavioral advertising. Under the CCPA/CPRA, “share” has that advertising meaning, and we do not share personal information that way.

Customer Data, including records retrieved from an ERP, CRM, email, or spreadsheet, is used to perform that customer’s service. We do not use Customer Data to train general-purpose models that serve other customers, unless the customer agrees in a written order. Model providers we engage are subprocessors. They process Customer Data to deliver the service under contract, not to build a model for someone else.

We share personal information only in these cases:

• Service providers and subprocessors that host infrastructure, run language or voice models, deliver email, process payments, provide analytics, or advise us professionally. They may use the information only on our instructions.
• The customer, when an AI employee returns an output into the customer’s systems.
• Authorities, when the law requires a disclosure, or to protect the rights, safety, and security of people and of the service.
• A buyer or successor in a merger, financing, or sale of assets, under a duty to protect the information as this policy describes.

A list of subprocessor categories is available on request. When a signed agreement requires notice before we add a subprocessor, we follow that agreement.

We are established in Brazil. Personal information may be processed in Brazil, Canada, the United States, and the United Arab Emirates, and in other countries where our infrastructure and model providers operate. Those countries may not offer the same legal protection as the country where the person lives.

Where the GDPR or UK GDPR requires a transfer tool, we use Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful mechanism, plus the supplementary measures the transfer needs. Where the LGPD requires a transfer mechanism under ANPD rules, we use one. For PIPEDA and Quebec’s Law 25, cross-border processing is covered by contract, confidentiality, and security duties, and we remain accountable for the information we transfer for processing.

We limit access to people and agents that need it for the engagement, protect credentials for customer systems, use encryption in transit, and log material agent actions. Connections are scoped to the systems the customer enables.

No method of transmission or storage is perfectly secure. A customer agreement may set additional controls, including where data resides and which systems an AI employee may write to.

We keep personal information for as long as the purpose requires, and then we delete it or anonymize it. Billing and corporate records are kept for the period tax and company law require. Marketing contacts are kept until the person opts out, plus a short suppression record so we do not email them again.

Customer Data is kept for the engagement and for the wind-down period in the customer agreement. At the end, we delete it or return it, except for copies the law requires us to keep and copies that remain in encrypted backups until the backup cycle overwrites them. We do not restore a backup in order to keep using Customer Data after the engagement ends.

You can ask us to exercise the rights that apply where you live. Email contact@everywhere-ai.com with the subject “Privacy request.” We may need to confirm it is you. We will not discriminate against you for making a request. If we deny a request, we will say why and how to appeal, including the right to complain to the authority named for your country or state.

If we hold the information only as a processor for a customer, we will tell you and help the customer complete the request.

GDPR and UK GDPR

If you are in the EEA or the United Kingdom, you can ask for access, correction, erasure, restriction, and a portable copy of your information. You can object to processing based on legitimate interests, and you can withdraw consent where consent is the basis. You can lodge a complaint with your local supervisory authority, or with the UK Information Commissioner’s Office.

PIPEDA, Quebec Law 25, and provincial PIPA

In Canada, you can ask for access to the personal information we hold about you, ask for a correction, and withdraw consent, subject to legal or contractual limits. You can challenge our compliance with the Office of the Privacy Commissioner of Canada.

In Quebec, Law 25 also gives you rights to be informed, to access and rectify, to receive information about a decision made exclusively by automated processing, and to submit observations to a person in a position to review that decision. You can complain to the Commission d’accès à l’information du Québec. The privacy contact in this policy is the person in charge of the protection of personal information for requests sent to Everywhere AI.

In Alberta and British Columbia, the provincial Personal Information Protection Act applies to organizations it covers, in place of PIPEDA. The same access, correction, and complaint paths are available through the provincial commissioner.

California CCPA / CPRA

If you are a California resident, you can ask us to disclose the categories and specific pieces of personal information we collected, the categories of sources, the purposes, and the categories of third parties we disclosed it to. You can ask us to delete and to correct personal information, subject to legal exceptions. You can opt out of sale or sharing. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes other than providing the service, security, and the short list of permitted business purposes in the regulations. You may use an authorized agent if you provide signed permission and we can verify you. You may also appeal a denial.

In the last 12 months, the categories we collect for our own business are:

• Identifiers, such as name, email, and IP address.
• Commercial information, such as the services a company asks us about.
• Internet activity on our website.
• Professional information, such as role and company.
• Inferences drawn from the above only to the extent needed to respond to a request.

Customer Data can also include financial information, commercial records, and the contents of communications the customer connects. We process those categories as a service provider, for the customer.

Other US state privacy laws

Residents of states with a consumer privacy law, including Colorado, Virginia, Connecticut, Utah, and Texas, can request access, correction, deletion, and a portable copy where the statute provides it, and can opt out of sale, sharing, and targeted advertising. We do not sell personal information or use it for targeted advertising. To appeal a decision, reply to our response with the subject “Privacy appeal.”

GLBA

When we handle nonpublic personal information for a financial institution, we do so as that institution’s service provider. We use it to provide the AI employee, to prevent fraud and security incidents, and as the law allows. We do not reuse it for our own marketing.

LGPD

If you are in Brazil, you can ask for confirmation that we process your personal data, for access, correction, anonymization, blocking, or deletion of data that is unnecessary or excessive or processed in breach of the LGPD, for portability, for information about the public and private entities we share data with, and for information about the possibility of refusing consent and the consequences. You can withdraw consent and oppose processing. You can ask for review of a decision made solely by automated processing. You can petition the Autoridade Nacional de Proteção de Dados (ANPD).

Commercial email to people in Canada follows CASL: we identify Everywhere AI, we send only with the consent CASL requires or another applicable ground, and each message includes an unsubscribe that we honor. Commercial email to people in the United States follows CAN-SPAM: we include our postal address and a working unsubscribe, and we honor opt-out requests. Marketing to people in Brazil, the EEA, and the UK follows the consent or other ground those laws require.

We use cookies and similar technologies that are necessary to run the site, and analytics cookies that help us see which pages are used. You can block cookies in your browser. Blocking a necessary cookie can break parts of the site. We do not sell cookie identifiers, and we do not allow third parties to use them for their own advertising on this site.

Our website and our AI employees are built for businesses. They are not directed at children. We do not knowingly collect personal information from anyone under 16, or under 13 where COPPA sets that age. If you believe a child gave us personal information, email us and we will delete it.

If we discover a breach of security safeguards or a confidentiality incident involving personal information we are responsible for, we will investigate, contain it, and notify the affected customer without undue delay. Notices to individuals and to authorities follow the statute that applies, including the GDPR’s 72-hour notice to a supervisory authority when we are the controller, PIPEDA’s real-risk-of-significant-harm standard, Quebec’s confidentiality-incident rules, US state breach-notification laws, and the LGPD.

We will post changes on this page and update the date above. If a change materially affects Customer Data, we will also follow the notice clause in the customer agreement.

Send privacy requests, appeals, and questions about this policy to the privacy contact below. That mailbox is also the contact for the person in charge of the protection of personal information under Quebec’s Law 25.