Privacy policy

Last updated: 3 November 2026

Everdeal is a cloud CRM (software as a service) for businesses: each customer company ("Customer") has its own organization, separate from the others, where its team manages companies, contacts, leads, deals, quotes and communications. This policy, given under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), explains which personal data Everdeal processes, in which role and for how long. The Italian version prevails.

1. Who we are and in which role

Everdeal is provided by Geckosoft SRL, Borgo Stretto 3, 56127 Pisa (PI), Italia, VAT number 02208570503, PEC geckosoft@pec.it ("Geckosoft", "we"). For any question about personal data write to privacy@geckosoft.it.

• We are the controller of the data of Everdeal's users (whoever signs in to the CRM on behalf of a Customer) and of the Customers' contact persons, to manage the accounts, security, the contract and support.
• We are a processor (Art. 28 GDPR) of the data the Customer enters or collects in the CRM: its contacts, leads, clients and the communications with them. For this data the controller is the Customer, who decides why and how to use it; we process it only to provide the service, on its instructions and under the terms of service. If you are a person recorded in the CRM of one of our Customers, contact that Customer to exercise your rights: if you write to us, we forward the request to the Customer.

2. Data of Everdeal's users

• Account: the identifier of your EverID account, your email address and name. You sign in to Everdeal with EverID, Geckosoft's identity service: your password and two-step verification are handled by EverID (see its privacy policy), not by Everdeal.
• Organizations and roles: the organizations you belong to, your role (administrator, user, collaborator), the modules assigned to you, the invitations received or sent.
• Activity in the CRM: who created or changed an item and when, the API keys and webhooks you create, the actions taken by artificial intelligence agents you authorized.
• Technical data: IP address, date and time of requests and the technical logs needed to run and protect the service.
• Calendar and mailbox, if you choose to connect them (section 4).

We do not use your data for advertising or profiling, and we do not sell it.

3. Data the Customer processes in the CRM

On the Customer's behalf we store the data it and its users enter or collect: records of companies and contact persons (name, role, email, phone, LinkedIn profile), leads, deals, activities, notes, quotes, attachments, consents and unsubscribes, the emails sent and received through the CRM, the requests coming from the forms on the Customer's website. Data may also come from external sources the Customer chooses to use: public web pages, the European VAT number registry (VIES) and a provider of business contact data (section 6). The people recorded in the CRM receive the privacy notice from the Customer, who is their controller.

4. Google Calendar, Gmail and Microsoft 365

Each user may connect their own Google Calendar and their Gmail or Microsoft 365 mailbox to Everdeal. Connecting is optional, requires the consent given on Google's or Microsoft's page by the account's owner, and can be undone at any time from Everdeal or from the Google or Microsoft account settings.

• Google Calendar (scopes calendar.freebusy and calendar.events): Everdeal reads only the busy and free times of the primary calendar, to offer meeting slots, and creates or cancels the events of the meetings booked through the CRM. It does not read the content of other events.
• Gmail (scopes gmail.send and gmail.readonly) and Microsoft 365 (permissions Mail.Send, Mail.Read and User.Read): Everdeal sends from your mailbox the emails you write in the CRM and reads only the replies in the conversations those emails started, for no more than 90 days. It does not read the rest of the mailbox. The emails sent and the replies become part of the contact's history in the CRM, visible to the colleagues in your organization.
• We store the address of the connected account and the access token, encrypted. When you disconnect the mailbox we delete the connection and revoke the token; when you disconnect the calendar we delete the connection (you can also revoke access from Google). Emails and meetings already recorded in the CRM remain, like the rest of the history.

Everdeal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use this data only for the user-facing Everdeal features described above; we do not use it for advertising; we do not sell it; we do not use it to train artificial intelligence models; no one at Geckosoft reads it except with your consent, for security purposes or to comply with the law. If the organization has turned artificial intelligence on, the replies received may be processed by the AI provider (section 5) only to classify them and suggest your answer, never to train models. The same commitments apply to data received from Microsoft.

5. Artificial intelligence

Everdeal offers artificial intelligence features: email drafts, reply triage, recommended next action, analysis of questionnaires, workflows created from a sentence, a chat assistant, research of signals and public information about companies and people, call preparation. The features are active only if the Customer's plan includes them and the administrator of its organization has not turned them off.

When you use them, the data the request needs (for example the data of the deal, the contact or the email) is sent to the model provider, currently Anthropic, PBC (United States), which processes it as our sub-processor and, under its commercial terms, does not use it to train its models. Web searches are run by Anthropic's tools. We plan to move to a model run by Geckosoft through Rational AI: we will update this policy before the change.

The results are suggestions to be checked: Everdeal does not use artificial intelligence to take decisions that produce legal effects on people (Art. 22 GDPR).

6. Who we share data with

With the providers that help us deliver the service, appointed as processors or sub-processors (Art. 28 GDPR):

• Amazon Web Services EMEA SARL (Luxembourg): infrastructure, databases, file storage, backups and service emails, in the Ireland region (eu-west-1).
• Anthropic, PBC (United States): artificial intelligence models and web search, only when artificial intelligence is on (section 5).
• Crono: business contact data (email, phone, LinkedIn profile, company data), only when a user looks up or enriches a contact with the Outreach feature. It receives the name, email or LinkedIn profile of the person looked up, or the company's data.

Google and Microsoft receive data only when a user connects their account and sends emails or books meetings from the CRM, under their own terms. We share data with authorities only when the law requires it. The current list of providers is available on request.

7. Where the data is

Data is stored in the European Union, in the AWS Ireland region (eu-west-1). Transfers outside the European Economic Area (Anthropic, and possibly the providers' support) take place with the safeguards of the GDPR: an adequacy decision, such as the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses.

8. How long

• Account and membership of an organization: as long as you belong to the organization or as long as the organization exists.
• CRM data: for the term of the contract with the Customer, who manages it; deleted items stay in the organization's trash, from which they can be restored. When the organization is closed we delete all its data.
• Unfinished website form requests: 7 days.
• Invitations: the link expires after 72 hours.
• Unsubscribes: the address of whoever unsubscribed or asked for erasure stays on the suppression list, so they are not written to again.
• Backups: up to 35 days, then overwritten.
• Contract and invoicing data: for the time required by law (usually 10 years).

9. Cookies

The Everdeal application uses only technical cookies, needed to sign in and to protect the session, and keeps a few display preferences in the browser. We use no profiling, analytics or third-party cookies. This website uses no cookies.

10. Your rights

You may ask to access your data, to rectify it, to erase it, to restrict its processing, to receive it in a structured format (portability) and to object to processing based on legitimate interest (Articles 15–22 GDPR). For the data we control write to privacy@geckosoft.it: we answer within one month. For data recorded in a Customer's CRM contact the Customer (section 1).

You may lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the country where you live or work.

11. Minors

Everdeal is a service for businesses and is not aimed at anyone under 18.

12. Changes

We may update this policy. The date at the top shows the last change; we tell Customers and users about significant changes by email or in the CRM.