Privacy Policy

1. Who We Are

Everlasting Email is a trading name of Smart Centric (ABN 27 213 698 865), as trustee for the LLM Family Trust, a Discretionary Investment Trust registered in the Australian Capital Territory. We are the entity responsible for your personal information (the “data controller” for users in the EU/EEA and UK).

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use Everlasting Email. We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

For any privacy question or request, contact us at privacy@everlasting.email.

2. Information We Collect

We collect the following kinds of personal information:

• Account information: your name, email address, and password when you create an account.
• Message content: the messages you create, including text, media (videos, photos, and file attachments), and the details of the people they are for. Photos and videos can contain hidden location details (GPS). We remove these by default when we process your upload; you can choose to keep them, in which case they are delivered to your recipient.
• Details of the people you name: the names and email addresses of your recipients, and of any trusted contact or delivery-code holder you choose. You provide this information about other people; see Section 3 for what we ask you to do about that.
• Payment information: billing name, email, and address. Your card details are handled directly by Stripe — we never see or store your full card number.
• Usage data: information about how you use the service, including delivery events and service logs, used to run and secure the service. This includes the IP address of requests, used for security and rate-limiting, and your preferences (timezone, language, and currency).
• How you found us: when you first visit our site, we note the page you landed on, the site that referred you, and any campaign tags in the link (for example, from an ad you clicked). If you create an account, we store this once, with your account, to understand which of our marketing works. We do not use it to track you across other sites.
• Phone number: only if you add it for SMS features — two-factor authentication or check-in reminders. We send these messages via AWS.

3. Information About Other People You Give Us

To deliver your messages, you give us details about other people — your recipients, and any trusted contact or delivery-code holder. Please only provide these details if you are reasonably entitled to, and where practical, let those people know that you have listed them and that Everlasting Email may contact them on your behalf. If someone we have contacted asks us to explain how we hold their information or to remove them, they can email privacy@everlasting.email.

4. Legal Basis for Processing (GDPR)

If you are in the European Union, the European Economic Area, or the United Kingdom, we rely on these legal bases under Article 6 of the GDPR (and UK GDPR):

• Performing our contract with you: managing your account, and storing, encrypting, and delivering your messages.
• Consent: for optional marketing communications, where you have opted in. You can withdraw consent at any time.
• Legal obligation: keeping financial records and responding to lawful requests from authorities.
• Legitimate interests: keeping the service secure, preventing fraud, and improving the service, balanced against your privacy.

5. How We Use Your Information

We use your information to:

• Provide, maintain, and improve Everlasting Email
• Process payments and issue invoices
• Send service messages (for example, delivery confirmations and security alerts)
• Store and deliver your messages when the conditions you set are met
• Keep the service secure and prevent fraud

We do not sell your personal information, and we do not use your message content to train artificial-intelligence models or for advertising.

6. Message Privacy & Encryption

Keeping your messages private is central to our service. We do this by:

• Encryption at rest: sensitive information — including your message text, recipient details, and billing details — is encrypted using AES-256 encryption with keys managed by AWS Key Management Service (KMS), rotated automatically each year. Your videos, photos, and attachments are encrypted at rest with AES-256 server-side encryption managed by AWS S3.
• Encryption in transit: all data between your device and our servers is protected by TLS encryption.
• Extra-Secure Mode for delivery codes: when you turn this on, we do not keep your delivery code in any form we can read or recover. We keep only a one-way “fingerprint” (a secure hash) so we can check a code when someone enters it. Because we cannot read the code, we cannot recover it for you if it is lost. Please make sure the code parts are kept safe.
• Staff access: we do not read your messages. Our staff do not access message content except where the law compels us to (for example, a valid court order), or where we must investigate a specific abuse report. We do not proactively monitor or scan message content. Access to encryption keys is strictly limited. To provide support, our staff can view delivery details — a message's status, its delivery method, recipient and code-holder names and contact addresses, and dates — but not message content, subjects, or the delivery codes themselves.

7. Who We Share Data With

We do not sell your personal information. We share data only with the service providers we rely on to run Everlasting Email:

• Amazon Web Services (AWS): cloud hosting, data storage, email delivery (SES), and content delivery (CloudFront).
• Stripe: payment processing and billing.
• Expo: if you use our mobile app and turn on push notifications, your device's push token is handled by Expo's notification service (based in the United States) to deliver notifications.

When we deliver one of your messages, the recipient receives it and can see who it is from and its content — that is the purpose of the service. Messages are sent from an Everlasting Email address (for example, messages@everlasting.email), and each one gives the recipient a way to contact us. When we deliver a message, we record delivery and whether it has been opened (using a small tracking image in the email or the “view in browser” page), and we can share that status with the sender. We keep these delivery and open records for 90 days.

Questions you type into our help assistant

Our Help page and the help panel in the app include an assistant that answers questions about how Everlasting Email works. When you send it a question, that question is processed by an AI model running on AWS infrastructure, in the same way the rest of our service runs on AWS. No new company receives your data, and your question is never used to train any AI model.

The assistant answers only from our published help documentation. By default it has no access to your account — it cannot see your messages, your occasions, your delivery codes, your plan, or your payment details, whether or not you are signed in.

If you are signed in, you can tick “Check against my account” for a question. For that question only, the assistant is also given a short summary of your account: your plan and its status, how many messages you have, your occasions’ types, statuses and dates, your delivery codes’ statuses, and whether you have a Trusted Contact. It is never given the content of your messages, their subjects, your recipients, or any names. The answer shows you exactly which details were used. Leave the box unticked and nothing about your account is shared.

We keep a record of the question and the answer for 90 days so we can see where our help documentation falls short, and then it is deleted automatically. These records are not linked to your account or to your email address. When you use “Check against my account”, the log records only that account details were used — never the details themselves. Please avoid typing personal details into the help box — you never need to, and the assistant cannot use them to help you.

We may also disclose information:

• To comply with the law, a regulation, or a lawful request
• To protect the rights, property, or safety of Everlasting Email, our users, or the public
• In connection with a sale, merger, or transfer of our business, in which case we will notify you and the new owner will remain bound by this policy

8. Where Your Data Is Stored

Your data is primarily stored in Australia (the AWS Sydney region, ap-southeast-2). Some processing happens overseas:

• Email sending (AWS SES): when we send any email — including your delivered messages — it is processed through AWS's email service in the United States (us-east-1). The message content and the recipient's address pass through that region; our stored copies remain in Australia.
• CloudFront CDN: content is delivered from servers around the world to make the service faster.
• Stripe: payment processing may happen in the countries where Stripe operates.
• Expo push notifications: mobile push tokens are processed in the United States.

Australian users: we take reasonable steps to comply with Australian Privacy Principle 8 before disclosing personal information overseas.

EU/EEA and UK users: where data leaves your region, transfers are covered by Standard Contractual Clauses (and the UK Addendum) maintained by our providers, AWS and Stripe.

9. How Long We Keep Data

We keep your information as follows:

• Account data: while your account is active.
• Messages: until they are delivered, deleted by you, or your account is deleted.
• Delivered media: videos, photos, and attachments in a delivered message are removed 90 days after the recipient first views them (attachments: 90 days after delivery). Recipients are encouraged to download anything they want to keep.
• Financial records: invoices and purchase records are kept for 5 years from the date of the transaction, as required by Australian tax law. When you delete your account, these records are anonymised (your personal details are replaced with placeholders) and are automatically deleted after the retention period.
• Email delivery events (such as bounce and complaint records): deleted automatically after 90 days.
• Help assistant questions and answers: deleted automatically after 90 days, and never linked to your account.
• System logs: most operational logs are deleted automatically after 7 days; a small number of logs (for example, those from media processing) are kept for up to 30 days.
• Security and audit records: records of administrative actions (including the administrator's IP address) are kept for 12 months; short-lived rate-limiting records are deleted automatically within hours to days.

10. Information About People Who Have Died

Everlasting Email is designed to deliver messages after a person has died. Australian privacy law generally applies to living individuals, so once we are aware that an account holder has died, this contract governs how we handle their information. In that case, we act on the delivery instructions set up in the account — for example, releasing messages through a trusted contact or a delivery code. We do not give family members, executors, or others access to read the deceased person's stored messages or account content beyond what those delivery instructions allow, unless we are legally required to.

11. Your Rights

All users: you can ask us to give you a copy of the personal information we hold about you, to correct it if it is wrong, or to delete it, and you can opt out of marketing at any time. You can also delete your account yourself in Settings.

Australian residents (APPs)

Under the Australian Privacy Principles, you can:

• Access the personal information we hold about you
• Ask us to correct information that is inaccurate or out of date
• Complain to the Office of the Australian Information Commissioner (OAIC) if you are not satisfied with our response (see Section 15)

EU/EEA and UK residents (GDPR)

In addition to the above, you have the right to:

• Restrict or object to how we process your personal data
• Withdraw consent at any time (where we rely on consent)
• Receive your data in a structured, commonly used, machine-readable format
• Complain to your local data-protection authority

California residents (CCPA/CPRA)

Under California law, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale or sharing of personal information (we do not sell or share it)
• Not be treated differently for exercising your rights

To exercise any of these rights, contact us at privacy@everlasting.email. We may need to confirm your identity before we act on a request.

12. Cookies

We use essential cookies only. These include:

• Session sign-in tokens
• Your language preference (NEXT_LOCALE)

These cookies are strictly necessary to sign you in and to show the site in your chosen language, so we do not ask for consent to set them and we do not show a cookie banner. You can block or delete them in your browser settings, but you will not be able to stay signed in if you do.

We also use your browser's local storage to remember preferences and, on your first visit, to hold the “how you found us” details described in Section 2 until you sign up (they are discarded if you never do).

We do not use advertising cookies, we do not track you across other sites, and we do not run third-party analytics. Our admin and trusted-contact panels use scoped session cookies for sign-in.

13. Children's Privacy

Everlasting Email is intended for adults. It is not for anyone under 18, and we do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it promptly.

14. How We Protect Your Data

We use appropriate technical and organisational measures to protect your information, including:

• AES-256 encryption of sensitive data at rest, with keys managed by AWS KMS
• TLS encryption for all data in transit
• Automatic annual rotation of encryption keys
• Access controls, and multi-factor authentication for administrative access
• Hosting on AWS infrastructure, which holds industry-standard security certifications (such as SOC 2 and ISO 27001)

No online service can be completely secure, but we work hard to protect your information and to respond quickly if a problem arises.

15. Data Breaches and Complaints

If a data breach affects your personal information, we will:

• Notify affected users without undue delay (and, for breaches covered by the GDPR, generally within 72 hours where required)
• Notify the OAIC for eligible breaches under the Notifiable Data Breaches scheme, and any other authority the law requires
• Explain what happened, what data was involved, what we are doing, and what you can do

If you have a complaint about how we handle your personal information, please email us at privacy@everlasting.email. We will acknowledge it promptly and aim to respond within 30 days. If you are not satisfied with our response, you can escalate to:

• Australia: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au
• EU/EEA and UK: your local data-protection authority
• California: the California Privacy Protection Agency or the California Attorney General's Office

16. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email. Minor changes will be posted on this page. If you keep using Everlasting Email after a change is posted, that counts as accepting the updated policy.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us through our contact page or by email:

privacy@everlasting.email

Smart Centric
ABN 27 213 698 865
Trading as Everlasting Email