Everdone

GDPR overview

Everdone documents substantial GDPR machinery without ever claiming compliance in plain text: the word GDPR appears only in the meta keywords of the privacy page, in force since 15 October 2025. A data processing addendum is built into that policy at section 10 — the customer is controller, Cointab is processor acting on documented instructions, breach notification is promised without undue delay, and one written audit per year is allowed. Transfers out of the European Economic Area or the United Kingdom are covered by Standard Contractual Clauses or an equivalent lawful mechanism. Data subject rights (access, rectification, erasure, portability, objection, restriction) are offered subject to jurisdiction and exercised at privacy@everdone.ai after identity verification, and a DPO is named at the Mumbai address. Two gaps remain: no Article 27 EU representative is appointed, and no security certification is displayed.

Who owns the data?

Everdone's terms draw a clean line. Section 5.1 states that all data, code and materials you upload — your User Content — remain your sole property. Cointab Software Private Limited claims no ownership, only a non-exclusive, worldwide, royalty-free licence to process that content for the sole purpose of providing and improving the service. Section 5.2 gives you ownership of the Output: the documentation and analyses generated through Everdone are yours, subject to your compliance with the terms. Section 5.3 holds the other side of the line: the service itself, its software, algorithms and AI models remain Cointab's property. No third party is granted rights over your content.

Reuse rights

The outputs are yours to reuse, publish or redistribute without asking permission, provided you keep complying with the terms (section 5.2). CodeDoc documentation can stay private, be shared with the team, or be made public by link, and the publisher's own demo pages show generated documentation published openly. On its side, Cointab limits what it does with your data: it processes it to run the service, authenticate you, execute jobs and generate outputs, bill, support, monitor performance and security, prevent fraud, and develop and improve its products. It states that it does not sell or rent personal data and does not use customer data for advertising or profiling unrelated to service improvement; cookies are limited to session and aggregated audience measurement, with no advertising, behavioural or cross-site tracking. Your code is never used for model training. Sharing is confined to service providers (infrastructure, analytics, payments), legal obligations, corporate transfers and cases where you give explicit consent. Data collected covers the account, repository access tokens, execution logs, billing, support exchanges and technical data such as IP address, browser and session.

Data retention & training

Hosting summary

Everdone names no hosting country and no hosting region. The privacy policy calls the service global and states only that data may be stored or processed on servers located in jurisdictions other than the user's country of residence. Section 8 covers international transfers: where personal data leaves the European Economic Area, the United Kingdom or another region with transfer restrictions, Cointab says it puts appropriate safeguards in place, including Standard Contractual Clauses or another lawful mechanism. On security, the policy claims encryption in transit and at rest, access controls, environment separation, least-privilege access and continuous monitoring, but no certification — neither SOC 2 nor ISO 27001 — is displayed anywhere on the site. The publisher, Cointab Software Private Limited, operates from Mumbai, India, the only jurisdiction actually documented; the site itself is served behind Cloudflare on an anycast address (104.21.4.233), a CDN node that says nothing about where the data lives. In short: the legal framework for transfers is described, the physical location of the data is not.