EverID
Privacy policy
Last updated: 3 November 2026
This notice, given under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), explains how we process the personal data of the people who create and use an EverID account, the service used to sign in to Geckosoft's Ever products (today: Everdeal). The processing of the data you enter in each product is described in that product's privacy notice.
1. Data controller
Geckosoft SRL, Borgo Stretto 3, 56127 Pisa (PI), Italia, VAT number 02208570503, PEC geckosoft@pec.it.
For any question about your data write to
privacy@geckosoft.it.
2. Which data we process
- Account data: email address (which is also the username), first and last name.
- Credentials: the password, stored only as a non-reversible hash, and the two-step verification factors you set up (authenticator apps, security keys or passkeys).
- Data received from Google or Microsoft, if you choose to sign in with those accounts: the account identifier at the provider, name and email address. We do not receive your password or any other data of your Google or Microsoft account.
- Sign-in and security data: active sessions, date and time of sign-ins and of other account events (registration, password change, failed attempts), IP address, the product you signed in to.
- Authorizations given to artificial intelligence agents: which agents you allowed to act on your behalf in an Ever product, and when.
We do not process special categories of data (Article 9 GDPR) and we ask for no data other than the above.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, signing you in to the Ever products, sending you service emails (address verification, password recovery) | Performance of a contract (Art. 6(1)(b) GDPR) |
| Protecting accounts from unauthorized access: two-step verification, lockout of repeated attempts, sign-in log | Legitimate interest in the security of the service and its users (Art. 6(1)(f) GDPR) |
| Complying with legal obligations and answering requests from authorities | Legal obligation (Art. 6(1)(c) GDPR) |
We do not use your data for advertising, profiling or automated decision-making, and we do not sell it.
4. Signing in with Google or Microsoft
If you choose to sign in with Google or Microsoft, the provider sends us, with the consent you give on its page, your account identifier, name and email address. We use them only to create or link your EverID account and sign you in: we do not use them for any other purpose, we do not transfer them to third parties except to sign you in to the Ever products you choose to use, we do not use them for advertising and we do not sell them. EverID's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke EverID's access from your Google or Microsoft account settings. The processing carried out by Google and Microsoft is governed by their own privacy notices.
5. Who receives the data
- The Ever products you sign in to, operated by Geckosoft SRL: they receive your account identifier, name and email address, only when you sign in to them.
- The providers that help us run the service, appointed as processors (Art. 28 GDPR): Amazon Web Services EMEA SARL, for the infrastructure EverID runs on and for sending service emails.
- Authorities, when the law requires it.
6. Where the data is
The data is stored in the European Union, in the AWS Ireland region (eu-west-1). Should a provider access it from a country outside the European Economic Area, the transfer takes place with the safeguards set by the GDPR (an adequacy decision, such as the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses).
7. How long we keep it
- Account and credentials: as long as the account exists. When the account is deleted we erase them.
- Sessions: they expire by themselves after a period of inactivity or at sign-out.
- Sign-in and event log: 90 days.
- Backups: up to 35 days, then overwritten.
8. Cookies
EverID's sign-in pages use only technical cookies, needed to sign you in and to protect the session (session, protection against forged requests, language). We use no profiling, analytics or third-party cookies. This website uses no cookies.
9. Your rights
You can ask at any time to access your data, to rectify or erase it, to restrict its processing, to receive it in a structured format (portability) and to object to processing based on legitimate interest (Articles 15–22 GDPR). Name, email and password can also be changed from your EverID account page. To exercise your rights write to privacy@geckosoft.it: we answer within one month.
If you believe the processing infringes the GDPR you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the country where you live or work.
10. Children
EverID is meant for the professional use of the Ever products and is not directed at children under 14.
11. Changes
We may update this notice. The date at the top shows the last change; if the changes are significant we tell you by email or at your next sign-in.