Privacy Policy

1. The two roles we play

Our obligations differ depending on whose information is involved, so it is worth separating the two up front.

For your account information — your name, email address, billing details, and how you use the Service — we are the controller (or, under Canadian law, the organization responsible). We decide what to collect and why, and this Policy governs it.

For the content you put into the Service — your website pages, keyword lists, competitor domains, and the articles we generate for you (“Customer Content”) — we act as a processor (or service provider) on your behalf. We handle that material under your instructions and under our Terms of Service, and we do not use it for our own purposes. If your Customer Content happens to contain personal information about your own customers or visitors, you remain responsible for it as controller, and you are responsible for having a lawful basis to provide it to us.

2. Information we collect

Information you give us

• Account information. Your full name and email address when you register, and a record of when you accepted these policies. Passwords are hashed by our authentication provider — we never see or store your password in readable form. If we offer sign-in with Google and you use it, we will receive your name, email address, and profile photo from Google.
• Organization and billing information. Your organization name, subscription status, billing interval, and the customer and subscription identifiers issued by Stripe. Card details are submitted directly to Stripe and are never transmitted through or stored on our servers.
• Connected account credentials. If you connect Google Search Console, we store OAuth tokens issued by Google. If you connect a CMS such as WordPress, Shopify, Squarespace, or Sanity to publish content, we store the credentials for that connection. All such credentials are encrypted at rest — see Security.
• Customer Content. The website addresses, page content, keywords, competitor domains, publishing preferences, and generated drafts associated with your projects.
• Communications. Messages you send us through the contact form or by email, including anything you choose to include in them.

Information we collect automatically

• Usage data. Records of activity in the Service — analyses run, content generated, features used, and the timestamps of those events.
• Technical data. IP address, browser type and version, device and operating system information, referring page, and request timestamps, captured in our hosting logs.
• Cookies and analytics. See Cookies and analytics.

Information we collect from third parties

• Google Search Console. With your authorization, we retrieve search performance data — queries, impressions, clicks, and positions — for the verified property matching the site in your project. See Google user data.
• SEO and search data providers. Keyword volumes, rankings, and competitor data about the domains you ask us to track. This is business and website data, not personal information about you.
• Stripe. Payment status and subscription events.

3. How and why we use information

For users in the European Economic Area and the United Kingdom, the GDPR requires us to identify a legal basis for each purpose. This table serves as our disclosure for everyone.

Where we rely on legitimate interests, we have considered the impact on you and concluded that our interest in operating, securing, and improving the Service does not override your rights. You may object to that processing — see Your privacy rights.

4. AI processing of your content

Evergreen AI works by sending the material in your projects — your page content, keywords, competitor information, and your instructions — to our AI provider, which analyzes it and returns the drafts, recommendations, and analyses you see in the app. This transfer is the core function of the Service and cannot be disabled while you use it.

Under our commercial agreement with our AI provider, your content is used only to return results to us and is not used to train their models. We do not use your Customer Content to train models of our own, and we do not share it with other customers.

AI output can be inaccurate, outdated, or unintentionally similar to existing material. You are responsible for reviewing anything generated before you publish it — see section 8 of the Terms of Service.

5. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising or targeted advertising. We share information only as described below.

Service providers. We use the providers below to operate the Service. Each receives only what it needs for its function, and each is bound by contract to protect it and to use it only on our instructions.

At your direction. When you connect a CMS or another third-party service, we transmit content to it on your instruction. Once your content reaches that service, the third party’s own privacy policy governs it.

Legal and safety. We may disclose information where required by law, subpoena, or other valid legal process, or where we reasonably believe disclosure is necessary to protect our rights, investigate fraud or abuse, or protect the safety of any person. Where we are permitted to do so, we will notify you before responding to a legal demand for your data.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will give you notice before your personal information becomes subject to a materially different privacy policy.

6. International data transfers

We are based in Canada, and our primary application infrastructure is hosted in the United States (the us-east-1 region). Our service providers may process information in the United States, the European Union, and elsewhere. This means your personal information will be transferred outside your country of residence, and may be accessible to courts, law enforcement, and national security authorities in those jurisdictions under their laws.

For transfers of personal information out of the EEA, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (together with the UK International Data Transfer Addendum where applicable), or on another transfer mechanism permitted by law. You may request a copy of the safeguards we use by writing to privacy@tryevergreen.ai.

7. Cookies and analytics

We use four categories of cookies and similar technologies:

• Strictly necessary. Cookies that keep you signed in, maintain your session, and protect against cross-site request forgery. The Service cannot function without these, and they are not used for tracking.
• Analytics. We use Google Analytics 4 to understand how visitors find and use our site. It sets cookies that record the pages you view, the site or search that referred you, your device and browser type, and an approximate location derived from your IP address. We use this only to measure and improve the site. Google processes this data as our service provider under its Privacy Policy.
• Session replay and heatmaps. We use Microsoft Clarity to see how visitors move through our pages. It records clicks, scrolling, mouse movement, and the pages you move between, and reconstructs them as a playback of the visit, along with aggregate heatmaps of where visitors click and how far they scroll. Clarity is configured to mask the text you type into form fields, and it does not capture passwords or payment card details. We use recordings to find usability problems, not to monitor individual people. Microsoft processes this data as our service provider under its Privacy Statement.
• Advertising. We use the Meta Pixel so that we can tell which of our Facebook and Instagram ads bring people to Evergreen AI. It records the pages you view on our site and whether you signed up or subscribed, and reports those events to Meta along with your IP address and an identifier for your browser. Meta can match that identifier to a Facebook or Instagram account, and uses it both to report on how our ads performed and to choose who sees them, including on other sites and apps. Unlike the providers described above, Meta is not acting solely on our instructions: under its business tools terms it may also use what it receives to improve its own advertising systems. We use it only to measure and direct advertising for Evergreen AI itself, and we do not send Meta your email address, your name, or any other detail that identifies you directly. Meta processes this data under its Privacy Policy.

You can block or delete cookies through your browser settings, which stops the analytics, session replay, and advertising technologies described above. Blocking strictly necessary cookies will prevent you from signing in. To opt out of Google Analytics on every site you visit, install the Google Analytics Opt-out Browser Add-on. To limit how Meta uses your activity to target advertising, use the ad preferences in your Facebook or Instagram account settings.

We do not sell your personal information for money, and we do not license or otherwise pass data about your visit to data brokers, ad networks, or anyone else’s advertising. The advertising technology above exists so that we can tell whether the ads we pay for are bringing people to Evergreen AI. Note that US state privacy laws may still treat sending that information to Meta as “sharing” for advertising purposes — see Your privacy rights for how to opt out.

8. Email we send you

Service and account email — sign-in confirmations, password resets, receipts, billing notices, security alerts, changes to these policies, and factual information about your subscription and its ongoing use. These are part of the Service and are sent to all users; they are not marketing, and you cannot unsubscribe from them while your account is open.

Product updates and marketing — product announcements, tips, and offers that we send because you registered for or subscribe to the Service. Every one of these messages identifies Tactycs Inc., includes our mailing address, and carries a one-click unsubscribe link that we honour promptly. You can also opt out at any time by writing to support@tryevergreen.ai. Unsubscribing from marketing does not affect service and account email.

9. How long we keep information

• Account and Customer Content — for as long as your account is open. You can ask us to close your account and delete your data at any time by emailing privacy@tryevergreen.ai; once you do, we remove or irreversibly anonymize it within 90 days, except where a longer period is required below.
• Billing and tax records — six years after the relevant tax year, as required by Canadian tax law.
• Hosting and security logs — typically 30 days, and up to 12 months where a log is relevant to an ongoing security or abuse investigation.
• Marketing contact records — until you unsubscribe, plus the period we need to keep a record of your unsubscribe request so we can honour it.
• Support correspondence — two years from your last message to us.

We may retain information longer where necessary to resolve disputes, enforce our agreements, or comply with a legal obligation or preservation demand.

10. Security

We maintain safeguards appropriate to the sensitivity of the information we hold, including:

• Encryption of all traffic in transit using TLS, and encryption of stored data at rest.
• Additional application-level encryption of connected-account credentials — Google OAuth tokens and CMS publishing credentials are encrypted with AES-256-GCM before they are written to our database.
• Row-level database security so that records are reachable only by the organization they belong to.
• Restricted administrative access, granted only to personnel who need it to operate or support the Service.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach of your personal information creates a real risk of significant harm, we will notify you and the applicable regulators as required by law — including the Office of the Privacy Commissioner of Canada under PIPEDA, and supervisory authorities under the GDPR.

11. Your privacy rights

Wherever you live, you may ask us to give you access to the personal information we hold about you, correct it if it is wrong, delete it, provide it in a portable format, or stop using it for a particular purpose. Email privacy@tryevergreen.ai and we will respond within 30 days. We will never charge you for making a request or treat you differently for exercising these rights. We may need to verify your identity before we act.

Canada (PIPEDA and provincial law)

You have the right to access your personal information, challenge its accuracy, and withdraw consent to processing that is not necessary to provide the Service. If you are not satisfied with how we handle your request, you may complain to the Office of the Privacy Commissioner of Canada or to your provincial privacy regulator.

European Economic Area and United Kingdom (GDPR)

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection — including the right to object to processing based on legitimate interests and, at any time and without reason, to direct marketing. Where we rely on your consent, you may withdraw it at any time without affecting processing that already happened. You also have the right to lodge a complaint with your national supervisory authority, or with the UK Information Commissioner’s Office.

California and other US states

If you are a resident of California, Colorado, Connecticut, Virginia, or another state with comprehensive privacy legislation, you have the right to know what personal information we collect and disclose, to access and delete it, to correct inaccuracies, and to appeal a refused request. We do not use personal information for profiling that produces legal or similarly significant effects.

We do not sell personal information for money. However, the Meta Pixel described in Cookies and analytics sends information about your visit to Meta so that we can measure and direct our own advertising, and California and several other states define “sharing” for cross-context behavioural advertising broadly enough to include that, whether or not we are paid. You have the right to opt out. To do so, email privacy@tryevergreen.ai, or block cookies in your browser, which stops the pixel from loading at all.

12. Google user data

If you connect Google Search Console, you grant us read-only access (the webmasters.readonly scope) to search performance data for the verified property matching the site in your project. We use that data solely to display your search performance in the Service and to inform the keyword, content, and page recommendations we generate for you. We do not use it for advertising, we do not sell it, and we do not transfer it to others except to the service providers listed above that are strictly necessary to operate these features.

Evergreen AI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke our access at any time through your Google Account permissions page. To have the tokens we hold for your account deleted, email privacy@tryevergreen.ai and we will remove them.

13. Children

The Service is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact privacy@tryevergreen.ai and we will delete it.

14. Changes to this Policy

We may update this Policy as the Service evolves or the law changes. When we make a material change, we will update the effective date above and notify you by email or through the Service before the change takes effect. Continuing to use the Service after that date means the updated Policy applies to you.

15. How to reach us

For privacy questions, requests, or complaints, contact our privacy officer at privacy@tryevergreen.ai, or write to us at:

For general support, email support@tryevergreen.ai.