Privacy Policy

Draft, pending legal review. Last updated 8 August 2026.

Who we are

Everl ("we", "us") operates the everl.com website and progressive web app. We are the data controller for the personal data described here. Everl is a UK service and this policy is written to the UK GDPR and the Data Protection Act 2018.

Our Data Protection Officer

What we collect, and why

We are built to collect as little as possible. Today, the only personal data we collect is for our waitlist:

• Your email address: to confirm your place on the waitlist (double opt-in) and to send you the updates you asked for.
• Your city and, optionally, whether you are local or visiting.
• The first part of your postcode only (the outward district, e.g. "M1"), never your full postcode or address. It is optional, we only ask after you have confirmed your email, and it is used for one thing: deciding which area of your city opens first. It tells us an area, not a street.
• A record of your consent (that you are 18+ and opted in), with a timestamp, and basic source/campaign information.

We do not collect real names, photos, or full addresses for the waitlist.

The age-verified adults area (not yet live)

Everl is developing a separate, age-gated adults area. It is not enabled in production. When it launches it is designed to hold as little about you as possible:

• Age check: a facial age estimation is performed by our provider Yoti, which returns only a yes/no "over 18" result. We keep only a device-local yes/no flag. No image, document, or date of birth is stored by us.
• Anonymous identifiers: short-lived, opaque session tokens and an anonymous membership id, none of which is your name or email.
• Approximate area: a coarse location cell (roughly 5 km), worked out on your device before anything is sent. We do not track your precise location, except a single one-off location if you use the in-app panic/safety feature.
• Payments: handled entirely by Stripe. Your card details never reach our servers; your membership is held against an anonymous id with a neutral statement descriptor.

No photos, user-uploaded media, or real names are used anywhere in this area.

Purposes and lawful bases

• Waitlist and updates: your consent (UK GDPR Art. 6(1)(a)); you can withdraw it at any time.
• Providing the adults service (when live): performance of our contract with you (Art. 6(1)(b)).
• Age assurance: to meet our legal duty to keep under-18s out of adult content under the Online Safety Act 2023 (Art. 6(1)(c) / (f)).
• Safety, security and prevention of abuse: our legitimate interests (Art. 6(1)(f)) in protecting users and children.

Who processes data for us

We use a small set of processors, chosen for UK/EU regions where possible:

• Supabase: EU-hosted database (waitlist; anonymous membership records).
• Resend: sends our transactional emails.
• Yoti: facial age estimation (returns an over-18 result only).
• Stripe: payments (holds card data; we never see it).
• Cloudflare: realtime signalling + anonymous, aggregate presence counts for the adults area.
• Meta & Reddit: cookieless conversion measurement only (see "Advertising measurement" below); they act as independent controllers for that purpose.
• Google: cookieless conversion measurement only, and it receives less than the two above: Google's own click identifier and nothing else, no email address at all (see "Advertising measurement" below); independent controller for that purpose.

Advertising measurement

When we run ad campaigns (for example on Meta, Reddit or Google), we measure which campaigns lead to waitlist sign-ups using each platform's server-side Conversions API. This is deliberately cookieless. We place no advertising or cross-site tracking pixel on the site. Instead, when you join or confirm the waitlist, our server sends the platform a one-way hashed (pseudonymised) version of your email address together with your IP address and browser type, so the platform can attribute the sign-up to a campaign. We never send your raw email, your name, or any special-category data, and nothing from the adults area is ever shared for advertising.

Google Ads works differently, and receives less. When you arrive from a Google ad, Google itself adds a click identifier to the web address. If you later confirm your sign-up, we send that identifier back to Google along with the time you confirmed, so Google can match the sign-up to the ad that led to it. No email address is sent (not even a hashed one), and nothing else about you. As above, this is cookieless: there is no Google advertising or cross-site tracking pixel on this site.

Our lawful basis is our legitimate interests (UK GDPR Art. 6(1)(f)) in measuring and improving our advertising; you can object at any time by contacting our DPO. Meta and Reddit act as independent controllers for this measurement under their own privacy policies. This processing is subject to our DPO's review before any campaign goes live.

How long we keep it

We keep the minimum for the shortest time. Waitlist data is kept until launch plus a short consent window, and is erased sooner on request. In the adults area, presence, matches, messages and safety data are short-lived and self-expire; the age check leaves only a yes/no flag; deleting your account erases everything keyed to you, including that flag. Payment and tax records held by Stripe are retained as required by law.

Your rights

Under UK GDPR you can, free of charge, ask us to:

• access the personal data we hold about you;
• correct it if it is wrong;
• erase it ("right to be forgotten"): one click for the waitlist, against your email;
• object to or restrict processing, including direct marketing;
• withdraw consent at any time (unsubscribe is one click); and
• where applicable, receive your data in a portable form.

To exercise any of these, contact our DPO at dpo@mishcon.com.

Cookies and analytics

We keep this to a minimum. We use only what is needed to make the site and app work (and, on the waitlist, to remember your signup). We use privacy-preserving analytics only, and no activity in the adults area is ever sent to analytics. We do not use advertising or cross-site tracking cookies. Small pieces of data (such as your age yes/no flag and an anonymous membership id) are stored on your own device, not sent to advertisers. For how we measure ad campaigns without any cookie or pixel, see "Advertising measurement" above.

International transfers

We prefer UK/EU processing. Where a provider processes data outside the UK, we rely on an adequacy decision or appropriate safeguards (such as the UK International Data Transfer Agreement or Standard Contractual Clauses).

Age

The waitlist is for adults (18+). The adults area is strictly 18+ and age-verified. The neutral part of Everl is not directed at children, and we take active steps to keep under-18s out of any adult content.

Complaints

Please contact our DPO first so we can help. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk or 0303 123 1113.

← Everl home