This is a plain-language summary of how Everpop processes personal data on behalf of its customers, provided for transparency. It is not itself the agreement — the full Data Processing Agreement (DPA) governs and is available on request at privacy@everpop.app.
Roles
For the content and channel data you process through Everpop — hosting, clipping, publishing, and measuring results on your instructions — you are the data controller and Everpop acts as your processor. Everpop is an independent controller for your own account and billing data, and for the processing it does for its own purposes: security and abuse prevention, content-safety screening before publishing, aggregate service measurement, operational alerting, and legal compliance. Those purposes and their legal bases are set out in Section 3 of our Privacy Policy.
Scope & instructions
As your processor we process personal data only to provide the Service — detecting your uploads, generating and publishing clips, and measuring results — and on your documented instructions. We do not sell personal data, and we do not use Google user data to train generalized machine-learning models.
Security
We apply appropriate technical and organizational measures: encryption in transit, encryption of sensitive credentials at rest, least-privilege access, and audit logging. You can view and export your own activity log from your dashboard settings.
Subprocessors
We engage the subprocessors listed on our Subprocessors page, each bound by applicable data-protection terms. The signed DPA governs any advance-notice and objection rights; the public list is updated to show current provider use.
International transfers
Transfers to processors outside the EEA and the UK rely on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) with the UK Addendum, on the EU-US Data Privacy Framework where the recipient is certified, or on an adequacy decision. The full DPA and the safeguards for a particular recipient are available on request.
Your rights
We help you respond to access, correction, deletion, and portability requests. You can export or delete your own data directly from your dashboard settings (GDPR Articles 15, 17, and 20).
Breach notification
We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own notification obligations.
Return & deletion
On termination, we delete or return your personal data in accordance with the DPA and our retention policy, except where retention is required by law.