Privacy Policy

This policy explains how Evermont Inc. (“Evermont”, “we”, “us”), a Delaware corporation, handles information when you use evermont.ai, the Evermont web application, the Evermont MCP server at https://api.evermont.ai/mcp, and the Evermont connector and plugin for AI clients such as Claude, ChatGPT and Codex (together, the “Service”). Evermont is a business service for insurance filing, actuarial and compliance teams. It is not offered to consumers.

Our role depends on the information:

• Customer Data. The filings, documents and other content an organization submits to Evermont (“Customer Data”) are processed on that organization’s behalf and under its instructions. For Customer Data, the organization is the controller (or “business”) and Evermont is its processor (or “service provider”). If you use Evermont through your employer, your employer’s agreement with us also applies, and your employer decides how its Customer Data is used.
• Account and business contact information. For the information we use to run accounts, secure the Service, communicate with you and bill your organization, Evermont is the controller.

This policy does not cover the AI clients you connect to Evermont. Anthropic, OpenAI and other client providers handle your conversations, including Evermont tool results once they reach the client, under their own privacy policies.

• Account information. Your name, work email address, your organization, its legal name and your role in it. You sign in with an email address and password handled by Firebase Authentication; we never see your password.
• Customer Data. Filings and their details, uploaded documents and templates, answers to requirement questions, requirement status, drafts and generated documents, objection letters and responses, and other content you or your AI client create in your organization. To make documents searchable we also store text extracted from them, embeddings derived from that text, and short AI-written context notes and summaries. Our Terms of Service prohibit submitting restricted data, such as health information about identifiable individuals (including protected health information), payment card data, government ID numbers or passwords, unless we have agreed to it in writing.
• Tool requests. The information your AI client sends with each tool call, such as a search query, a filing ID, document text it asks us to store, or the material for a drafting tool. We use it to carry out the request.
• What we do not receive. Apart from connection details (your sign-in token or API key, your IP address and client software information), we receive only what your AI client puts in each tool call. We do not receive your conversation history, your client’s memory or the files in your chats, unless your client puts their content in a tool call, for example when you ask it to upload a document. Clients can attach extra details to a request, such as your locale or approximate location; our server ignores them and does not store them.
• Connection and usage records. When an AI client calls an Evermont tool, we record the tool name, time, organization, the API key or signed-in user that made the call, for signed-in connections an identifier of the client app the connection was approved for, the outcome and usage counts. When a tool creates or changes a filing, a document, an objection or a row of the requirements matrix, we record what changed, the result, and which API key or signed-in user made the change, and show it in that filing’s activity history so your team can review it. Answers to intake questions and requirements-matrix builds started by a tool record the key or user on the record itself, but do not appear in the activity history.
• Technical and log information. Our hosting provider’s infrastructure logs record the IP address and browser or client information of each request. Our application and database logs do not record tool calls in full, but they can contain search text and document names, and the log entry for a slow database query can include the values it used, such as search text or text from your documents. We use IP addresses in memory to limit request rates and do not store them in our databases.
• Sign-in credentials. For OAuth connections we store authorization codes and refresh tokens only as one-way hashes; access tokens expire after one hour and are not stored. API keys are also stored only as hashes, with a short prefix so you can recognize them.
• Messages to us. What you send through our contact form (name, email, optional phone number and message) or by email.
• Public regulatory data. Evermont compiles public records such as SERFF filings and state statutes, regulations and bulletins. These records can include the names and business contact details of people who prepared or reviewed a filing.

We get this information from you; from your organization, for example when an administrator invites you; from the AI clients you connect, which send tool requests on your behalf; and from public sources such as state insurance departments and SERFF.

We use information to:

• provide the Service, including answering the tool calls your AI client makes;
• authenticate you and limit each connection to the organization you approved;
• keep the Service secure, including limiting request rates and investigating misuse;
• measure usage for your organization’s activity history, allowances and billing;
• provide support and, if you ask us to, managed filing services;
• send service messages and important notices; and
• comply with law and enforce our Terms of Service.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for advertising.

If the GDPR, the UK GDPR or a similar law applies to you, our legal bases are: performance of our contract with you or your organization, to provide the Service; our legitimate interests in operating, securing and improving a business service and in communicating with its business users; compliance with legal obligations; and your consent, where we ask for it. For Customer Data, we act on the organization’s instructions and the organization is responsible for its own legal basis.

Customer Data you submit through Claude, ChatGPT, Codex or the web application is processed to carry out your requests. Evermont does not currently use Customer Data to train AI models. If that changes, we will update this policy and notify customers in advance.

These parts of the Service send content to the providers listed in section 5:

• Indexing documents. When a document is uploaded, or a SERFF document is copied into a filing, with indexing on (the default), we extract the text of PDFs with Google Document AI; other file types are read by our own software. We then use a language model to classify the document’s tables, add a short line of context to each passage and write summaries, and create embeddings so it can be searched. These requests can include the filing’s name and details along with the text. For documents uploaded in the web application, a language model also reads the file name and opening text to classify the document and note details such as its carrier, state and effective date. Templates uploaded in the web application (Excel .xlsx and .xlsm workbooks and PDF forms) are described by a language model, and saved answers to requirement questions are embedded. A document added with indexing off is stored but not sent to these providers.
• Searching your documents. Searching your organization’s documents, including looking up evidence for an objection, sends the search text to an embedding model.
• SERFF document-text search. The serff_semantic_search tool is switched off for customer organizations by default. If an owner or administrator of your organization switches it on, its search questions are sent to an embedding model.
• Managed drafting and review. The managed module tool (assist_run) and the objection response drafting tool (objection_response_draft) send the material you provide to a language model; for objection responses that includes the objection, the evidence found for it, the filing’s basic details and your organization’s style guide. These tools are off by default: they run only if Evermont has made them available and an owner or administrator of your organization switches them on.

Other tools, such as looking up filings, SERFF filings and requirements, building the requirements matrix and running calculations, do not send your data to AI providers. Each provider handles the content it receives under its own terms for API use. We have not arranged zero data retention with these providers, so a provider may keep request content for the period its terms allow, for example for abuse monitoring.

We use these service providers to run the Service. Each receives only the information it needs for the purpose shown.

We update this list before a new provider starts receiving Customer Data. We also share information:

• with other members of your organization, according to their roles;
• with the AI clients you connect, which receive the results of the tool calls they make;
• with SERFF Filing Access, the public filing site operated by the National Association of Insurance Commissioners (NAIC), when Evermont looks up a SERFF filing there live for you. We send the state and the tracking number or filing ID, or the company, product, line of business and dates you searched for. We do not send your name or your organization’s;
• when required by law, or to protect the rights, safety and security of our customers, users or Evermont;
• with a successor if Evermont is involved in a merger, acquisition or sale; and
• with your consent.

When you connect Claude, ChatGPT, Codex or another client, the client sends tool requests to Evermont and receives the results. Depending on the tool, results can include:

• your organization’s filings, requirements, objections and documents, including text;
• your own user ID, email address and organization name;
• the names, email addresses and roles of organization members assigned to a filing;
• in a filing’s activity history, the user IDs of members who made changes in the web application, the names or IDs of the API keys that made changes through tools, and for signed-in connections the client app used and the user ID of the person who connected it;
• public SERFF filings and regulatory records.

Once a result reaches your client, its provider handles it under its own terms and privacy policy.

Some tools return a download link instead of the file itself, for an original document, each document in a filing, or a ZIP archive. These links are signed and expire after ten minutes. Until then, anyone who has a link can download the file without signing in, and the link passes through your AI client and its provider like any other result, so treat it as you would the file.

A connection can reach only the organization you chose when you approved it. When an owner or administrator removes someone from an organization, or someone deletes their Evermont account, their signed-in connections to that organization stop working, normally within a minute and at the latest when the current access token expires, one hour after it was issued. To end a signed-in connection yourself, disconnect Evermont in your client; your client may also ask Evermont to revoke the connection when you do. To make sure a connection is ended on our side, email hi@evermont.ai from your account’s email address and we will revoke it. Its current access token can keep working for up to an hour afterwards. API keys belong to the organization rather than a person; its owners and administrators can revoke them at any time in the web application, and a revoked key stops working within a minute. Deleting your account also revokes the API keys you created.

We do not use advertising cookies, tracking pixels or third-party analytics, and our own code does not set cookies. The web application keeps you signed in using Firebase Authentication, which stores your session in your browser’s storage and connects your browser directly to Google’s sign-in and database services. It also remembers your light or dark theme preference locally. Our pages serve their fonts from our own domain. If we add product analytics, we will update this policy first.

Our application, databases and file storage are hosted in Google Cloud’s United States regions. Our service logs are kept in Google Cloud Logging’s global location, and email to and from evermont.ai addresses is stored by Google Workspace, so Google may store both outside the United States. If you use Evermont from outside the United States, your information is transferred to and processed in the United States, whose data protection laws may differ from those where you live.

Some subprocessors may process data outside the United States. In particular, for most AI requests we let OpenRouter choose which model provider handles the request, so a request may be processed by a provider in another country under that provider’s terms. If your organization needs a data processing agreement, contact us.

How long we keep information:

• We keep account information and Customer Data for as long as your organization has an Evermont account, unless you or your organization ask us to delete it sooner. After an account closes, we keep its data until an owner or administrator of the organization asks us in writing to delete it, and we complete that request within thirty days.
• A filing’s activity history is kept with the filing until the filing is deleted.
• Usage records, which count your organization’s tool calls and credits for billing, and our records of the deletions we carry out are kept for seven years. They hold identifiers such as user, filing and document IDs, counts and dates. When we delete an organization, we remove any other text from its usage records.
• Messages you send us, through the contact form or by email, are kept until you ask us to delete them. We complete that request within thirty days.
• Public regulatory records in our SERFF and regulatory research collection, including the names and business contact details they contain, are kept as part of that collection for as long as we offer it.
• ZIP archives created for downloads are deleted automatically after one day.
• OAuth authorization codes expire after ten minutes and refresh tokens after thirty days, and an expired code or token no longer works.
• Request and application logs are kept for about thirty days. Google Cloud’s audit logs of administrative changes to our infrastructure are kept for up to 400 days. Deleting data does not remove it from logs; log entries expire on this schedule.
• Deleted data can remain in backups and recovery copies of our databases and file storage until they expire, usually after about a week and never more than thirty days.

What you can delete yourself in the web application:

• A document. The person who uploaded it, or an owner or administrator, can delete it. That deletes the file and what we derived from it: its extracted text, search index entries and context notes, page images, the cached text-extraction output, the filing summaries that drew on it, links to view it, and the objection records, templates, intake answers and instructions created from it. It also deletes the filing’s package bundles and download archives, which can be built again, and removes the document from the filing’s requirement records and requirements matrix. Entries in the filing’s activity history that refer to the document are kept, but their recorded results and references to the document are removed. Documents made from it, such as a filled form or a converted copy, are separate documents and are not deleted with it. If the document is still being processed, the last steps finish when processing stops.
• A filing. An owner or administrator can delete a filing after typing its name. That deletes the filing and everything in it: its documents and what we derived from them, templates, requirement status records and requirements matrix, intake answers, instructions, packet items, revisions and uploaded packet files, objections, package bundles and download archives, and its activity history (agent actions, generation runs and objection runs). The filing disappears from your list at once and the deletion finishes in the background.
• Your account. Deleting your account in Settings deletes your sign-in, profile and settings, revokes the API keys you created and your signed-in connections, and removes your email address from activity history. Your organization keeps your membership record, marked as removed, and usage records under your user ID only. Filings, documents and other work you created stay with your organization. An organization’s owner cannot delete their account this way; contact us to transfer ownership or close the organization.
• Evermont’s tools for AI clients cannot delete filings or documents.

To delete your organization, or any Customer Data you cannot delete yourself, email hi@evermont.ai from the account’s email address. We will confirm the request and complete it within thirty days, except for information we must keep to meet legal, security or billing obligations. Requests about an organization’s Customer Data must come from, or be approved by, an owner or administrator of that organization. Deleting an organization deletes its filings, documents and everything derived from them, its settings, API keys and signed-in connections, and the accounts of its members who belong to no other organization.

• Data is encrypted in transit with TLS and encrypted at rest by Google Cloud.
• Each request is checked against the organization it belongs to.
• A signed-in connection can use only the tools covered by the access approved for it on the consent screen.
• Refresh tokens, authorization codes and API keys are stored only as hashes.
• Evermont personnel access Customer Data only when needed to provide support or services you request, to keep the Service secure, or to comply with law.

No system is perfectly secure. If we learn of a security incident affecting your information, we will notify affected customers without undue delay and as required by law.

To report a security vulnerability or concern, email hi@evermont.ai. Our security contact is also published at evermont.ai/.well-known/security.txt.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to restrict or object to certain processing, and to withdraw consent you have given. To make a request, email hi@evermont.ai. We may need to confirm your identity first, and an authorized agent may make a request for you where the law allows it.

If your request concerns Customer Data your organization controls, we may refer you to your organization’s administrator and will help them respond. If we decline a request, we will explain why, and you can ask us to reconsider by replying. You may also complain to your local data protection authority. We will not discriminate against you for exercising your rights.

The Service is for businesses and is not directed to children. Users must be at least 18, and we do not knowingly collect personal information from anyone under 18.

We may update this policy. We will post the new version here and update the date above, and for material changes we will give notice by email or in the Service before they take effect.

Evermont Inc. is responsible for this policy. For questions or requests about privacy, email hi@evermont.ai or use our contact page.