Privacy noticefor people we contact

• Oftmrw AB, which runs Everdge, holds your work contact details because your job likely touches an EU rule our software helps with.
• They come from a public source, a business data provider, an event or a referral. Our first message names which.
• We use them only to contact you about your work, where your country’s law allows it.
• We record calls only if you agree. AI helps us draft; it decides nothing with legal effect on you.
• Reply “stop” at any time and we won’t contact you again.

You can tell us to stop at any time. Reply “stop” to any email or LinkedIn message, say so on a call, or write to privacy@everdge.com. We act on it the same day, on every channel. No reason needed (GDPR Art. 21(2)–(3)).

So it sticks, we keep only one-way coded versions of your email address, phone number and LinkedIn profile on a do-not-contact list. We code your company’s domain too only if the company asked never to be contacted. We use the list for nothing else.

You can also object to any other use of your data based on our legitimate interest (Art. 21(1)).

Oftmrw AB (org. no. 559608-7071, Klockartorpsgatan 34A, 723 44 Västerås, Sweden) runs Everdge and is the controller. Contact: privacy@everdge.com. We have not appointed a data protection officer, because the GDPR doesn’t require it for us (Art. 37). Write to us at the same address.

Data: name, job title, company, country of work, work email and phone, LinkedIn profile URL; sourced public facts about your work; where and when we found each detail; our messages and your replies; call and meeting notes; and, only if you agree, recordings and transcripts. Nothing private or sensitive.

Sources: public ones (company websites, business and product registers, exhibitor lists, LinkedIn, news, job ads); a business data provider (lemlist); and trade fairs, events and referrals.

If you wrote to us or joined our waiting list yourself, our website privacy notice applies to that data instead.

Our legitimate interest: finding business customers for our product-compliance software among companies facing a dated EU legal duty, such as the battery passport from 18 February 2027.

We don’t track whether you open our emails, and our links don’t identify you.

AI (Anthropic’s Claude) grades companies, not people, drafts one line about your work from sourced public facts, and writes call summaries. An automatic check removes anything unsourced or personal. A founder approves every message written to you personally. Cold email sequences use texts the founders approve weekly; the line about you in them is checked automatically, not by a person. No decision with legal or similarly significant effect is made about you (Art. 22). Under its commercial terms Anthropic may not train on this data, and it deletes it within 30 days.

Our processors. We use each one under its data processing agreement:

lemlist may also control its own database; LinkedIn is its own controller. Advisers and authorities get data only when needed or required. We never sell it.

Twenty, n8n and our booking tool are software we run ourselves on our Hetzner server. Their makers have no access to the data.

We also use DataForSEO (Estonia) to search public job ads and news by topic and country. We send it search terms only, never names or contact details.

Outside the EU: Anthropic, Slack, Google, Cloudflare and Resend are companies in the United States, or owned by them, and your data can reach the United States through them. Google, Cloudflare, Slack and Resend are certified under the EU–United States Data Privacy Framework, and we rely on that, with Standard Contractual Clauses in their terms as a fallback. Anthropic is not on the certification list, so we rely on the Standard Contractual Clauses in its data processing agreement. CloudTalk and Scape keep data in the EU by default and use Standard Contractual Clauses for anything that leaves it. Ask us for a copy.

• Found but never contacted: deleted 30 days after we found you.
• Never replied or met us: deleted 12 months after we found you.
• Talked to us, no deal: deleted 24 months after the last contact.
• Recordings: 90 days. Transcripts: 12 months after the last contact.
• Signals, and approval messages in Slack: 90 days.
• Meeting reminder emails, at our email provider: 30 days.
• Backups of our systems: up to 30 days, then replaced. After a restore, the do-not-contact list is applied again.
• Do-not-contact list: as long as we do sales outreach.

You can ask for access, correction, erasure, restriction, and a portable copy of data held on your consent. Write to privacy@everdge.com or reply to any message. We confirm within 72 hours and answer within one month. When we erase, we also tell lemlist.

Complaints: to Integritetsskyddsmyndigheten (IMY) in Sweden, imy.se (opens in a new tab), or the authority where you live or work.

We update this notice when what we do changes.