A little clarity
about your data.

Everstead by Strategy Crate · Effective September 6, 2026

Your optional service accounts.

When you select an optional service, we store your provider choice, whether the account already exists, accepted pricing, public connection links, setup progress, approvals and test records. Do not submit passwords, API secrets, payment card details or provider customer lists in setup notes. Use the provider’s delegated access where available. We publish only approved public links, not private setup notes or administrative access details.

Visitors who follow a booking or signup link interact with that provider under the business’s and provider’s privacy notices. Those providers process the booking, opt-in or transaction. Merely loading the Everstead page does not load their scripts or send form entries to them. The business controls its provider account, data and billing.

What we store

We store account names and email addresses, securely hashed passwords and recovery codes, session records, business information you enter, website URLs you submit, imported business facts and source page links, supplied logos and photos, website versions, change requests and drafts, and inquiry records. Launch records include the access you authorize, connected resource identifiers, approved content, delivery checks and service dates. We store identifiers needed for Stripe billing, but do not receive or store full payment card details.

What becomes public

The business facts, photos and content you approve become public when your website is published. Payment begins fulfillment; it does not authorize immediate publication of an unfinished preview. Saved private previews require an owner session. Before signup, a necessary private browser cookie gives you access to the preview created from your notes; its URL alone does not grant access. Customer inquiries, account credentials, billing details, and internal change history are not part of the public website.

How information is used

Information is used to create and maintain your website, prepare requested changes, configure and verify your launch, store and route customer inquiries, prepare reporting, process billing, protect accounts, and recover interrupted work. Authorized Everstead operators can access the records needed to fulfill and support your service. Change generation and previews created from pasted notes or an existing public website may process the relevant business profile, notes, imported website text, and request through Vercel AI Gateway and its selected model provider. If you enable browser alerts, we store your browser subscription address and encryption keys and send a brief activity notice through your browser provider (Google, Mozilla, or Apple). The notification does not include the inquiry message or customer contact details. Customer inquiry contents are not included in the website-change prompt.

Service providers

The service uses Vercel for application hosting, an isolated Prisma Postgres database for application records, Stripe for payments and subscription management, Vercel AI Gateway for assisted changes and preview creation, Resend for account verification and inquiry email delivery, and Google for Analytics and Search Console. Those services process information according to their own terms and policies. Fonts are loaded from Google Fonts. The service does not install advertising pixels. A business website with Analytics configured offers visitors a choice to allow or decline analytics before Google measurement runs.

Google setup and access

After purchase, Everstead handles the agreed Analytics and Search Console setup. We use delegated access to suitable existing client resources, or create separate new client resources when needed. We record the approved setup identity, account and property identifiers, access roles, verification methods, confirmed client access and aggregate reporting. This access is used for the selected business website, including configuration, verification, sitemap submission, measurement checks and reporting. Existing properties and useful history are preserved; another client is not given access to your records. You retain independent administration and verification.

You may optionally authorize your Google account through Everstead. For this connection we store your Google identity, granted permissions and encrypted authorization credentials, alongside the selected resource identifiers. Disconnecting that optional connection removes its stored authorization; it does not delete Google properties or history. Access you separately grant to an Everstead setup identity is managed in the relevant Google product and is distinct from app authorization. We confirm measurement and access changes during your handoff, including removal of unneeded Everstead grants when you leave.

Everstead’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google data is used for these user-facing features, not sold, used for advertising, or used to train generalized AI models.

Everstead advertising choices

Everstead uses Meta Pixel and LinkedIn Insight Tag only after you allow advertising cookies. They measure visits to our public marketing pages, completed website previews and confirmed launch purchases, and may support ad attribution, audience building and personalized ads on those platforms. A preview is not a purchase, and the $59 monthly care fee is not counted as initial launch revenue.

Events contain the action, an opaque identifier used to avoid duplicate counts and, for a purchase, the verified USD launch-order value. The platforms also receive browser and network information and advertising identifiers. We do not include your business notes, contact details, private preview content, inquiry messages or payment session identifiers in these events. Advertising scripts are not installed in private workspaces, forms, customer websites or generated previews.

Your choice is stored in a first-party cookie for 90 days. Change it using Privacy choices on our marketing pages, tools or workspace. Declining leaves preview creation and purchasing available; supported Global Privacy Control signals keep advertising off. Browser storage also remembers conversion attempts to prevent repeated counts. Ad blockers, consent choices and browser restrictions can limit measurement.

See Meta's privacy policy and LinkedIn's privacy policy for their handling of advertising information.

Analytics on Everstead’s own website

With your analytics permission, Google Analytics measures visits and steps such as starting and completing a preview, creating an account, sending a contact request, using a planning tool, beginning checkout and completing a verified purchase. A purchase event uses the verified one-time payment amount and an opaque transaction reference; it does not report future monthly care as money already paid.

Microsoft Clarity helps us understand clicks, scrolling and session recordings on public marketing and resource pages. We do not load Clarity on business-brief tools, contact forms, private previews, login, account, operator or customer website pages. Input content is masked. We do not send names, email addresses, phone numbers, business notes or recovery codes as analytics event fields.

Analytics and advertising have separate choices. Neither analytics provider loads until you allow analytics. You can decline or withdraw permission using Privacy choices. Withdrawing permission clears supported first-party analytics cookies and reloads the page to stop the loaded providers. Choices last 90 days; Global Privacy Control and marked internal/test traffic are excluded. Consent, blockers and delivery delays mean analytics totals may differ from operational records.

These services process normal browser and network information. Read Google’s privacy policy and Microsoft’s privacy statement for their practices.

Visitor analytics choices

Analytics on a connected business website is off until the visitor chooses to allow it. The choice is stored in that browser and can be changed through the privacy choices on the website. When allowed, Google receives website page views and limited interaction events, such as inquiry submission and contact-link clicks. Everstead does not send inquiry names, email addresses, phone numbers or message contents as analytics event fields. A contact-link click records an interaction, not an answered call or completed booking. Declining analytics does not prevent browsing or submitting an inquiry.

Contacting Everstead

When you contact Everstead through our contact form, your name, email, optional business name and message are sent through Resend to our private support inbox, hosted by Gmail. We use those details to answer your inquiry and retain the correspondence as needed for support. Submitting this form does not subscribe you to marketing. We retain short-lived counters with hashed network and email identifiers to limit spam. Your message is not published on the website or sent as an advertising event.

Inquiry emails

The launch includes notification setup and a delivery test for one inbox you verify. Everstead uses Resend to send new-inquiry alerts to that address and, if you enable them, simple receipts to customers. The provider processes the recipient address and delivery information. Owner alerts link to the private workspace and do not contain customer messages or contact details. Customer receipts confirm that an inquiry was saved; they do not confirm a booking. We retain delivery status, retry records and recipient suppression records to prevent duplicate or unwanted sends. You can disable email delivery in Connections and continue checking the inquiry workspace.

Customer inquiries

With optional Everstead Team Inbox, the business owner can invite up to four teammates to the same business’s inbox. We store invitation email addresses and names, verification and access records, request assignments, internal notes, form and routing settings, reminder preferences and delivery statuses. Invitation links are emailed and expire; access begins only after the invited person signs in with the matching email address and accepts. The owner may revoke a teammate’s access and notifications.

Authorized teammates can view the business’s inquiry records and collaborate on status, assignment and notes. Internal notes are visible to that business’s authorized team and are not sent to form respondents. Owners can export inbox records. Supported request forms may also record a preferred appointment date. Submitting a request does not reserve an appointment or subscribe the person to marketing.

Team alerts, invitations and reminders use our transactional email delivery provider. Alerts link to the authenticated business inbox; they do not include customer messages or contact details in the email body. The system records delivery attempts and suppression outcomes. An email marked delivered means the provider reported delivery; it does not establish that a person read or acted on it.

When a visitor submits a published website form, their contact information and message are saved for that business. The business owner and authorized Team Inbox members can access and respond to them; owners can export the records. Everstead processes those records to provide the website and inquiry service. If a visitor follows a booking or other external link, that provider handles the information submitted there under its own policies. Do not submit payment card data, medical information, passwords or other sensitive records in this general inquiry form.

Sessions and abuse prevention

A necessary, HTTP-only session cookie keeps account holders signed in. A necessary preview cookie lasts up to one year to remember the three-preview allowance. Its hashed usage counter can remain for up to 400 days after use. Account preview counts remain with the account. We store account email verification status, expiring verification challenges and email delivery records; confirming an account email does not enable inquiry alerts or marketing. We also retain hashed network identifiers and short-lived counters to limit abusive requests. Unsaved onboarding details may be kept in your own browser until you save the preview; saved account data lives in the application database. Pasted notes, submitted website URLs, source page links, and unsaved generated previews expire after seven days. Saving a preview keeps the approved website content in your account.

Retention and access

You can export your business content, supplied assets and inquiry records from the workspace. Cancellation does not immediately delete your content. Exports remain available for at least 30 days after the included or paid service period ends; that access window is not a promise that every record is automatically deleted on day 31. Billing and service providers may retain records needed for payment, security, backup and service operations. Use the seller contact on your Stripe receipt for account-data or deletion requests after purchase; account recovery is available through your saved recovery code. Canceling care does not delete client Google resources.

Your responsibilities

Publish only information you intend to share publicly and have permission to use. Store downloaded inquiry records privately. You determine how your business uses information submitted by its customers. We prepare the site privacy notice around its configured behavior; you approve your business contact details and supply any additional industry-specific disclosures. Store downloaded inquiry records separately from public website files.

Traffic and service measurement

We save source, medium, approved campaign codes and arrival times in this browser for up to 30 days. At checkout, we attach a source snapshot to the order to measure paid conversions. Links between our sites may carry those codes and times. Customer content, private access links and click identifiers are not included in this transfer.

We use Vercel Web Analytics to measure public page visits, broad referral sources and predefined steps such as starting a brief or opening checkout. Query strings, fragments, uploaded files, form contents, email addresses, payment details and private access tokens are excluded. Browser privacy signals and our internal test exclusions turn this measurement off. Confirmed payment records determine purchases and refunds; a button click or open checkout is not a sale.