Privacy Policy

This Privacy Policy (or simply the "Policy") applies to all Users of the Everinbox Platform (the "Platform") offered by EVERINBOX TECNOLOGIA E INFORMAÇÃO LTDA. ("Everinbox" or "We"), dedicated to the management of email marketing campaigns, automation, and segmentation. Please read this Policy carefully and, if you have any questions, feel free to contact our Data Protection Officer, whose identity and email address are indicated in item 11 below.

For the purposes of this Policy, the Controller of Your Personal Data is EVERINBOX TECNOLOGIA E INFORMAÇÃO LTDA., a limited liability company headquartered at Avenida Dr. Dib Sauaia Neto, nº 1600, sala 32, Alphaville, Barueri/SP, CEP 06.460-003, registered with the CNPJ/MF under No. 57.453.692/0001-40.

1. Important Concepts

Here are some concepts to help You better understand the content of our Privacy Policy:

• National Data Protection Authority ("ANPD"): the public administration body responsible for regulation, oversight, and the application of administrative penalties relating to the protection of Personal Data.
• Customer: Any individual or legal entity that acts as a contracting party of the Platform.
• User: Individuals who use the features offered by our Platform, whether as a Customer or as a representative of a Customer.
• Platform or Everinbox Platform: digital environment provided by Everinbox for the management of email marketing campaigns, automation, and segmentation.
• Personal Data (or "Data"): Information relating to an identified or identifiable natural person. This is Data relating to an individual that, alone or together with other Information, is or can be used to identify that individual, collected and/or processed in physical or electronic form.
• Sensitive Personal Data: Information relating to an identified or identifiable natural person concerning racial or ethnic origin, religious belief, political opinion, membership of a union or of an organization of a religious, philosophical, or political nature, data concerning health or sex life, genetic or biometric data.
• Data Protection Officer ("DPO"): Known internationally as the Data Protection Officer (DPO), the DPO has the legal role of acting as a communication channel between Everinbox, Data Subjects, and the ANPD.
• Data Subject (or "You"): Every User who provides their Personal Data, directly or indirectly, through the actual use of or mere visit to our Platform.
• Processing: For the purposes of this Policy, Processing means any operation performed with Personal Data, such as those relating to the collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction.

2. What are the purpose and scope of this Policy?

This Privacy Policy applies to all Users of the Platform, which operates as detailed in our Terms of Use. The purpose of this Policy is to provide Data Subjects with transparency about the main aspects of the Processing of their Personal Data by Everinbox through the Platform, in order to enable decision-making and the exercise of Data Subject rights provided for in applicable law, especially the General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) – Federal Law No. 13.709 of August 14, 2018 ("LGPD").

3. How and what Data do we collect about You?

Everinbox collects Personal Data from the interactions carried out through the Platform, whether arising from initial registration, use of features, or integrations with third-party systems. The categories of Data collected may vary according to the usage profile, the services contracted, and the account settings.

In general, the following types of data are collected:

a) Information provided directly by the User: This is the Data provided at the time of registration or while using the Platform's services, such as:

• Full name, email address, telephone number, corporate name of the represented company, and CNPJ;
• Login data, such as username and password (encrypted);
• Information entered in forms, messages, or support tickets;
• Communication preferences and account settings.

b) Information collected automatically: While browsing the Platform, certain Data is collected automatically, in order to ensure the functionality, security, and personalization of the services, such as:

• IP address and technical data of the device used (type, browser, operating system);
• Data on interaction with the Platform interface, including pages accessed, actions performed, and dates and times of access;
• Performance data, failures, and browsing errors;
• Cookies and similar technologies, as detailed in our Cookie Policy.

c) Information obtained from third parties: We may receive additional data through integrations with external systems, such as:

• CRM and automation tools integrated with the Platform;
• Payment platforms, authentication systems, and digital identity systems;
• Other applications previously authorized by the Customer.

This information supplements the User's profile and is used to enable specific features of the Platform, within the limits of consent and the applicable legal bases.

4. How do we use Your Data?

The Personal Data collected is processed for the purpose of enabling the Platform to operate and offering Users a personalized, secure, and efficient experience. Everinbox uses the Data for the following main purposes:

• Access account management: creation, authentication, and maintenance of User accounts, as well as management of permissions and credential resets;
• Sending and management of email marketing campaigns: use of the Data for the creation, scheduling, and distribution of email campaigns, based on parameters defined by the Customer;
• Segmentation and content personalization: application of demographic, behavioral, or custom criteria to target communications and improve the engagement rate;
• Performance and metrics analysis: collection of statistical data to measure campaign effectiveness, track deliveries, open rates, clicks, bounces, and unsubscribes;
• Customer support: use of the Data to respond to requests, questions, or problems reported through technical support;
• Fraud prevention and information security: adoption of measures to identify suspicious behavior, protect data integrity, and prevent unauthorized access;
• Compliance with legal and regulatory obligations: Processing necessary to meet legal requirements, oversight, audits, and compliance with court orders.

As our business continues to develop, there may be corporate acquisitions and mergers, commercial partnerships, joint ventures, and similar transactions. In the event of any such transaction, the information collected from our Customers may be transferred; however, even in these situations this Privacy Policy will be maintained and Your Data will be used exclusively under the terms provided herein.

Everinbox does not sell Personal Data and does not carry out, within the scope of the Platform, the Processing of Sensitive Personal Data or Data of children or adolescents, since, under our Terms of Use, this Platform is intended for persons over 18 years of age. All Processing activity is guided by the principles of purpose, necessity, adequacy, and security.

We emphasize that we take the protection of Your Personal Data very seriously, including when it is necessary to transfer it outside the national territory. Such transfers may occur, for example, due to the use of cloud services and email delivery providers.

In these cases, Everinbox adopts appropriate safeguards, under the provisions of the LGPD and Resolution No. 19, Resolution CD/ANPD No. 19/2024 (the "Resolution"), such as the adoption of standard contractual clauses and compliance with international information security standards, such as the ISO 27001 and 27701 standards.

Among the services involved in these transfers, the following stand out:

• Twilio SendGrid (USA) – used for sending emails, and for the processing of message bodies, recipients, and delivery metrics;
• Amazon Web Services – AWS (USA and Brazil) – responsible for hosting the Platform, data storage, and encrypted backups.

When carrying out an international transfer of Personal Data, we will ensure that there is an adequate legal basis for it, as well as an appropriate international transfer mechanism under the terms of the Resolution.

5. With whom do we share Your Data?

Everinbox may share Personal Data with third-party service providers that support the operation of the Platform, such as technology infrastructure providers, marketing automation tools, cloud hosting, electronic communications delivery, data analytics services, and payment processing. These providers include infrastructure providers and email service providers (ESPs), such as Amazon Web Services (AWS), Twilio SendGrid, or other equivalent ESPs, especially those headquartered in the United States. These companies play a fundamental role in the efficient and secure delivery of the Platform's features, as well as in the execution of automated transactions and payment services linked to the purchase of the Platform.

Data sharing may also occur with business partners and integrated platforms, especially where the Customer chooses to link its accounts to external systems. In all of these cases, Everinbox contractually requires a commitment to confidentiality, security, and limited use of the data as provided in this Policy.

Additionally, Data may be made available to public authorities and regulatory bodies whenever required by law or court order, or for audit, fraud prevention, and legal compliance purposes. In these cases, the provision of information will be limited to the minimum necessary to meet the applicable legal obligation.

6. For what purposes do we use Your Data?

Everinbox carries out the Processing of Personal Data for a series of legitimate purposes, aligned with the operation and continuous improvement of the Platform. Below, we present the main purposes and their respective objectives:

• Account creation and management: the data is used to register new Users on the Platform, authenticate identities, define access profiles, and keep information up to date throughout the contractual relationship.
• Sending and automation of email marketing campaigns: the Platform uses the data to enable the automated dispatch of campaigns according to segmentation rules defined by the Customer, such as sending time, the recipient's previous behavior, or interactions with previous campaigns.
• Segmentation and personalization of communications: the data is used to organize contacts into lists or groups based on attributes such as location, job title, preferences, and interaction history, in order to enable targeted and more relevant communications.
• Generation of reports and performance metrics: the data collected makes it possible to assess the effectiveness of campaigns (such as open, click, and bounce rates), helping Customers analyze performance and improve communication strategies.
• Integrations with external systems: to allow data to move securely between the Platform and third-party systems authorized by the Customer (such as CRM, payment systems, or authentication tools).
• Information security and fraud prevention: the data is also processed to ensure the integrity of the Platform, prevent improper access, monitor anomalous behavior, and ensure compliance with security measures.

7. How do our environments collect cookies?

Our Platform collects some Information automatically, such as: characteristics of the accessing device and browser, IP (with date and time), IP origin, information about clicks, pages accessed, the pages accessed next after leaving the Platform, among others.

To do so, we use cookies, which are files installed on the User's device that allow the collection of certain Information, including Personal Data, in order to optimize the User's browsing experience on the Platform according to their habits and preferences.

The User may disable the use of cookies through the browser settings. However, this may impair the functioning of some features of the Platform. For more information about cookies and how to disable them, see the section Your choices and updating Your information and preferences in accordance with our Cookie Policy.

8. How do we protect Your Data?

We take the security of Your Personal Data seriously and, to ensure adequate protection, we implement various technical and organizational measures based on internationally recognized standards and practices. We adopt controls aligned with ISO/IEC 27001, an international standard that guides information security management.

Internally, Everinbox also has corporate policies and procedures covering different aspects of privacy, Personal Data protection, and information security. These measures include, among others: encryption at rest and in transit, key management, role-based access control (RBAC), application firewalls, continuous backup, and uninterrupted monitoring. In addition, the principles of security by design and privacy by default are applied throughout the entire development cycle.

9. How long do we store Your Data?

We will keep Users' Personal Data only for as long as necessary to fulfill the purposes described herein, respecting the applicable legal and contractual periods. After that period, the data will be deleted or anonymized, except where retention is required by law, court order, or a clearly substantiated legitimate interest.

If You request the deletion of Your Data and/or Your account, we will delete Your Data, unless retaining it is necessary to fulfill the purposes for which the Data was collected, or to comply with legal, contractual, or accountability obligations or requests from competent authorities.

10. What are Your rights as a Data Subject?

You will always have rights relating to the privacy and protection of Your Personal Data, as provided in the LGPD. Below is a summary of all the rights You have under Brazilian sectoral data protection laws, which are:

In addition, we emphasize that You may, at any time, choose to stop receiving any marketing communications and information that Everinbox sends. Contact us (@everinbox.com) or click the unsubscribe link in the email You received.

11. How can You exercise Your rights?

To exercise Your rights or clarify questions relating to the Processing of Your Personal Data, You may contact our Data Protection Officer (DPO):

• Name:
• Email: @everinbox.com

12. Updates to the Privacy Policy

Everinbox may modify its Privacy Policy whenever it deems necessary. Changes will take effect immediately upon publication of the revised version on the Platform. You will be notified if it is updated; however, we recommend reading it periodically to stay informed of any changes.

• This Policy was last updated on July 8, 2025.

13. Acceptance of the Policy

By browsing our Platform and using our services, You understand that Everinbox may collect, store, process, associate, share, use, disclose, or otherwise process Your Personal Data, in the ways provided by law and in this Privacy Policy. The rules established by the Policy relate to the use of the Platform, as described in its Terms of Use.

By using the Everinbox Platform, You acknowledge and agree to the terms of this Privacy Policy and to the Processing of Your Personal Data as described herein. If You do not agree with these provisions, we recommend that You stop using the Platform.