Privacy

Privacy Policy

Effective date: 13 October 2026. Version 3.0.

In short

You give us your email when you join The Workshop Circle. We use it to send you the monthly letter and a note when pre-orders open. We store it in our own database and with Resend, the service that delivers our emails. We never sell your data and never pass your email to Meta or any other advertising platform.

When you open the Site, a banner asks what you allow. Without your consent we only count, without any identifier, how far down the page visits get and whether the sign-up form is used, and Cloudflare counts page visits the same way. Only with your consent, and only for what you allow: we record how you use our pages to improve them (PostHog), we note which of our ads brought you here, and Meta learns from your visits to measure and show our ads. You can change your choice at any time via "Cookies" at the bottom of every page, and ask us to delete your data at any time by clicking Unsubscribe or by emailing [email protected].

1. Who we are

This site (evervel.com) is operated by Evervel, Unipessoal LDA, a Portuguese single-shareholder limited liability company.

• NIPC (company tax number): 519 159 462
• Registered office: Lisbon, Portugal
• Privacy contact: [email protected]

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese Law 58/2019, we are the data controller for the personal data described below, and a joint controller with Meta for the processing described in section 2.8. We have not appointed a Data Protection Officer because we are not legally required to. Privacy questions go to [email protected].

2. What we collect, and why

We collect personal data when you give it to us, when our infrastructure logs it for security, and, for the purposes in sections 2.6 to 2.8, only when you allow it.

2.1 Email address (Workshop Circle)

When you submit the Workshop Circle form, we record your email address, the date and time, the language version of the page, your IP address, the type of device (phone, tablet or desktop, worked out from your browser's user-agent string, which we do not keep), and the country and city our hosting provider derives from your IP address. We also record the version of this policy you were shown, your cookie choice at that moment (section 8) and, while we test two versions of the page, which version you saw (section 2.9). We use your email to send you the monthly Workshop Circle letter, occasional updates about Evervel's launch, and the welcome email confirming your subscription. The founder receives these details, without your IP address, in a short email notification when you join, so that new members can be welcomed personally.

If you allowed ad measurement (section 2.7), we also record the campaign tags of the link that brought you (such as utm_source) and the external page you came from, without its query string. Without that consent we record neither.

Lawful basis for your email: your consent (Article 6(1)(a) GDPR). You give consent by submitting the form. You can withdraw it at any time by clicking the Unsubscribe link in any email, or by emailing [email protected]. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Lawful basis for the date, page language, policy version, cookie choice and IP address: our legitimate interest (Article 6(1)(f) GDPR) in being able to prove your consent and what you were shown, and in dealing with abuse of the form.

Lawful basis for the country, city and device type: our legitimate interest in knowing where our subscribers live (to advertise by region and, later, to plan delivery) and which devices people sign up from. You can object at any time by writing to [email protected]; we then delete these details and keep your subscription.

Lawful basis for the campaign tags and the external page: your consent to ad measurement (section 2.7).

Subscriptions made before 13 October 2026 were recorded under version 2.9 of this policy. Their records, and our new-member notifications for them, also hold the campaign tags and the full address of the page you signed up on (which can include the ad platform's click identifier), your browser's user-agent string and the name of your internet provider. These details were collected before we asked for consent to ad measurement. We will delete them by 31 October 2026, keeping only anonymous weekly counts (for example sign-ups per ad and country). You can ask us to delete them sooner (section 7).

2.2 Email correspondence

If you write to [email protected], [email protected], or any other Evervel address, we keep your email and our reply in the relevant inbox.

Lawful basis: our legitimate interest (Article 6(1)(f) GDPR) in handling and documenting communications, balanced against your right to privacy.

2.3 Server and edge logs

Our hosting provider (Cloudflare) and our edge functions record technical metadata for each request: IP address, user-agent, request path, response code, and timestamp. We use these logs to keep the site secure (rate limiting, abuse prevention, debugging). To stop automated sign-ups, the Workshop Circle form also counts submissions per IP address; the count is kept as a one-way hash of the address for one hour and then deleted.

Lawful basis: our legitimate interest (Article 6(1)(f) GDPR) in operating a secure service.

2.4 Aggregate web analytics (Cloudflare Web Analytics)

We use Cloudflare Web Analytics to count how many people visit the Site, which pages they look at, and roughly where in the world they are. A small script on the page sends Cloudflare the address of the page (without its query string or fragment), the address of the page that linked to it (also without its query string), and technical data about the page load and the screen. Cloudflare Web Analytics sets no cookie, stores nothing in your browser, assigns you no persistent identifier and does not track you across other websites. Cloudflare counts a visit when a page is opened from another site or a direct link, by comparing the address of the linking page with ours; it does not count individual visitors.

Lawful basis: our legitimate interest (Article 6(1)(f) GDPR) in operating and improving the Site. Having a script read this information from your browser and send it is access to your device under Article 5(3) of the ePrivacy Directive (Article 5 of Portuguese Law 41/2004). We rely on the exemption for audience measurement that only produces aggregate statistics for the site owner, as described by the Spanish (AEPD) and French (CNIL) supervisory authorities: no identifier, no campaign tags, no tracking across sites; Cloudflare processes the data as our processor, only to provide this service, and states that Web Analytics does not collect or use visitors' personal data.

2.5 Page-use counts

While the Site is open, your browser tells our server, at most once per page view each, which parts of the page came into view (for example the product section or the sign-up form), whether the page stayed on screen for 10, 30, 60 and 180 seconds, whether you clicked into the sign-up form (not what you type in it), pressed its button or one of the buttons that lead to it, tapped the arrow that moves the page down, opened a note on how a figure is calculated, switched language or followed a link to another site, whether the cookie banner was shown and which of its buttons you used, and whether your screen is phone, tablet or desktop sized. Each of these adds one to a count, together with the page language, the day, the country our hosting provider derives from your connection, the version of this policy, your cookie choice and the version of the page you saw (section 2.9). Nothing links one of these counts to another or to you: there is no visit or visitor identifier, no campaign tag, and nothing is stored in your browser for this. We use these counts to see where on the page visitors lose interest, so that we can improve it. They are kept with Cloudflare Workers Analytics Engine.

Lawful basis: our legitimate interest (Article 6(1)(f) GDPR) in knowing how the Site is used. Sending these counts from your browser relies on the same audience-measurement exemption as section 2.4. Your IP address is used only to deliver the request and to derive the country, as for any visit (section 2.3).

2.6 Site analysis (only with your consent)

If you allow "Site analysis", we use PostHog to see how our pages are used, so that we can improve them:

• session recordings: what happens on the page while you use it (the pages you open, clicks and taps, scrolling, mouse movement, the size of your screen). What you type is never recorded: every input field is masked in your browser before anything is sent;
• heatmaps: where on the page people click, tap and move the mouse, including repeated clicks in one place;
• clicks that lead nowhere and errors in the page's code.

PostHog receives no campaign tags, no ad click identifier, no information about the page that sent you and no query string of any address: we remove them in your browser before anything is sent. We do not tell PostHog who you are and never send it your email. PostHog keeps a random identifier in a cookie and in your browser's storage, so that the pages of one visit can be put together (section 8), and receives your browser type, operating system and screen size; PostHog discards your IP address and does not store it.

Retention: recordings are deleted after 30 days. Heatmap, dead-click and error events are kept for one year, then deleted.

Who: PostHog, Inc., as our processor, on its EU cloud in Frankfurt, Germany. PostHog staff in the United States may access the data, for example for support; this transfer is covered by the EU-US Data Privacy Framework, in which PostHog participates, and by the Standard Contractual Clauses (Module Two) in our data processing agreement with PostHog.

Lawful basis: your consent (Article 5(1) of Portuguese Law 41/2004; Article 6(1)(a) GDPR). Without it, PostHog is not loaded at all.

2.7 Ad measurement (only with your consent)

If you allow "Ad measurement", we note which of our ads brought you here. The page reads the campaign tags (such as utm_source and utm_content) and the ad platform's click identifier (for example Meta's fbclid) from the link you opened. Our server adds one to the count for that ad, together with the page language, the day and the country, and keeps only a one-way hash of the click identifier, so that reloading the page or reopening the same link counts once; the page-use counts of section 2.5 are then also counted per ad. If you join the Workshop Circle, the campaign tags and the external page you came from (without its query string) are kept with your subscription (section 2.1). Only Evervel uses this information; it is not passed to Meta or to anyone else.

Retention: the counts are kept for three months in Cloudflare Workers Analytics Engine and then deleted automatically. Sums without any identifier (for example, visits and sign-ups per ad, country and week) are not personal data and may be kept longer. With your subscription: until you unsubscribe.

Lawful basis: your consent (Article 5(1) of Portuguese Law 41/2004; Article 6(1)(a) GDPR). Without it, the page does not read the link and nothing about the ad is recorded.

2.8 Ad personalisation (only with your consent)

If you allow "Ad personalisation", Meta Platforms Ireland Limited ("Meta": Instagram, Facebook) learns from your visits to our site through the Meta pixel, which our pages load only for visitors who allowed this purpose and which works exactly as described here. Anything beyond this would come with a new version of this text and a new question to you.

• What will be collected: the pages you open on our site and what you do there (for example reaching the sign-up form or signing up), Meta's cookies _fbp and _fbc, your IP address and information about your browser and device. Your email address is not passed to Meta: the pixel's automatic advanced matching stays off, and we do not upload subscriber lists to Meta.
• Why: to measure our ads, to improve how Meta shows them, to show our ads to people who have visited our site, and to reach people similar to our visitors.
• Who: Evervel and Meta are joint controllers for collecting this data on our site and passing it to Meta (Court of Justice of the EU, Fashion ID, C-40/17; Meta Business Tools Terms and Controller Addendum). Under that arrangement Evervel is responsible for asking your consent and informing you, and Meta for its processing after it receives the data. Meta also uses the data for its own purposes under its Privacy Policy. You can exercise your rights with us or with Meta. Meta may transfer the data to the United States under the EU-US Data Privacy Framework.
• Lawful basis: your consent (Article 5(1) of Portuguese Law 41/2004; Article 6(1)(a) GDPR). A consent given now applies when we switch the pixel on, if your choice is still stored then (we ask again after 12 months, section 8).

2.9 Testing versions of the page

From 13 October 2026 until 31 October 2026 at the latest, we test two versions of the page: half of the page views show the cookie banner and half do not, chosen at random each time a page is opened; nothing is stored in your browser for this. If you have already made a choice, it applies and the banner is not shown. Without the banner nothing that needs your consent happens. Which version you saw goes into the page-use counts (section 2.5) and, if you join the Workshop Circle, into your subscription record, where it is deleted once the test has been evaluated, at most three months later. After the test everyone sees the same version.

3. What we do not do

• We do not run analytics that follow you across other websites. PostHog (section 2.6) works only with your consent and only on our pages.
• No advertising tag is active on the Site. The Meta pixel will run only for visitors who allowed ad personalisation (section 2.8). We use no Google Ads, LinkedIn, TikTok or other advertising tags.
• Without your consent, the Site sets no cookie other than our hosting provider's security cookies and keeps nothing in your browser other than your cookie choice (section 8).
• We do not pass your email address, or a hash of it, to Meta or any other advertising platform.
• We do not sell, rent, or license your data.
• We do not use your data to train AI models or share it with companies that do.
• We do not make automated decisions about you, including profiling, with legal or similarly significant effects.
• Content on the Site is written and reviewed by Evervel personnel. Where AI tools assist drafting, the final text is reviewed and approved before it is published. We do not publish unmodified AI-generated content.

4. Who processes your data on our behalf

We use a small set of service providers (processors) that handle parts of the operation under written contracts. Where personal data is transferred outside the European Economic Area, the contracts incorporate the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), with the supplementary technical and organisational measures described in each provider's Data Processing Agreement.

These are the only service providers that receive your personal data. Meta is not one of them: it is a joint controller for the processing in section 2.8, and receives nothing until the Meta pixel is switched on and you have allowed ad personalisation.

5. International transfers

Your data is processed in both the European Union and the United States. Cloudflare KV holds the primary subscriber record; Cloudflare stores and replicates it across its global network, which includes data centres outside the EU, so we do not rely on an EU-only location for it. Resend, Inc. is US-based and processes contact data primarily in the United States, with EU sending infrastructure (eu-west-1) for outbound delivery. PostHog keeps site analysis data in Frankfurt, with access from the United States. Google Workspace may process data in the United States.

All transfers of personal data outside the European Economic Area are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), together with each provider's supplementary technical and organisational measures (encryption in transit and at rest, access controls, audit logging). Where the provider participates in the EU-US Data Privacy Framework (Cloudflare, PostHog, Google), it applies as well.

6. How long we keep your data

• Workshop Circle email (active subscription): as long as you remain subscribed.
• Subscription details (section 2.1: device type, country, city, policy version, cookie choice and, with ad measurement consent, the campaign tags and external page): kept with your subscription and deleted together with it. The version of the page you saw during the test (section 2.9): deleted once the test has been evaluated, at most three months after you joined. The new-member notification in our inbox follows the rule for email correspondence below.
• After unsubscribe: we delete the entry from our database immediately. We keep a record that an unsubscribe occurred (email hash, date) for up to 24 months, so that we can prove the withdrawal of consent (the Portuguese Data Protection Authority's direct-marketing guideline, CNPD Diretriz 2022/1, requires that we can prove consent and its withdrawal; the 24-month period is our own).
• Resend audience: when you unsubscribe, your contact in Resend is marked as "unsubscribed" rather than deleted, so that future sends automatically skip you. You can ask us to fully delete the Resend record by writing to [email protected]; we will do so within 30 days.
• Email correspondence: as long as the matter is open, plus up to 36 months for our records.
• Server and edge logs: retained by Cloudflare per their default retention (typically up to 30 days).
• Web Analytics aggregates: Cloudflare retains anonymous, aggregated visitor counts indefinitely. No individual record is kept.
• Page-use counts and ad measurement counts: three months, then deleted by Cloudflare automatically.
• Site analysis (PostHog): recordings 30 days; heatmap, dead-click and error events one year.
• Your cookie choice: 12 months in your browser (section 8).

We process unsubscribe requests within 48 hours, in line with industry standards (RFC 8058 one-click unsubscribe; Gmail and Yahoo bulk-sender requirements 2024).

7. Your rights

If you are in the EEA, the UK, or any other jurisdiction with comparable rules, you have the right to:

• Access the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erase your data ("right to be forgotten").
• Restrict our processing of your data.
• Object to processing based on legitimate interest.
• Port your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting the legality of processing carried out before withdrawal. For cookies and similar technologies, use "Cookies" at the bottom of every page.
• Lodge a complaint with a supervisory authority (see section 12).

To exercise any of these rights, write to [email protected]. We respond within one month, as required by GDPR Article 12. We may ask for proof of identity to make sure we are talking to the right person.

If you are a US resident, you have analogous rights under your state's privacy law, including the California Consumer Privacy Act (CCPA/CPRA), the Texas Data Privacy and Security Act (TDPSA), the Connecticut Data Privacy Act (CTDPA), the Virginia Consumer Data Protection Act (VCDPA), and the Colorado Privacy Act (CPA). These rights typically include the right to know, delete, correct, and opt out of "sale", "sharing", or targeted-advertising processing of your personal information. We do not sell your personal information. Targeted advertising (the Meta pixel, section 2.8) happens only if you allow ad personalisation. We treat the Global Privacy Control (GPC) signal as a refusal of ad personalisation. To exercise any state-law right, write to [email protected].

8. Cookies and similar technologies

When you first open the Site, a banner asks whether you allow three purposes: site analysis (section 2.6), ad measurement (section 2.7) and ad personalisation (section 2.8). Each stays off until you switch it on; ignoring the banner means no. "Accept" allows all three, "Reject" none, and "Settings" lets you choose one by one. You can change your choice at any time via "Cookies" at the bottom of every page. Withdrawing consent stops the processing from then on and does not make what happened before unlawful (Article 7(3) GDPR); withdrawing site analysis also deletes PostHog's cookie and storage from your browser.

We keep your choice in your browser for 12 months, together with the version of the banner text, and then ask again. If we change what we ask consent for, we ask everyone again.

Without your consent, the Site reads only what it needs to show you the page and to count visits without identifying you (sections 2.4 and 2.5), and stores only your choice.

9. Children

Under Portuguese Law 58/2019 (Article 16), the age at which a minor can consent to information society services is 13 - one of the lowest thresholds in the European Union. Below that age, consent must come from the holder of parental responsibility.

The Workshop Circle is not directed to children. Our Terms of Use require subscribers to be at least 16. We do not knowingly collect personal data from anyone under 13. If you are a parent or guardian and you believe your child has signed up, write to [email protected] and we will delete the entry promptly.

10. Security

We protect your data with industry-standard measures: HTTPS for all traffic, encryption at rest with our providers, scoped API keys, environment-based secrets management, and access limited to the minimum necessary personnel. No system is perfectly secure, and we cannot guarantee that. If we ever discover a personal data breach that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours (GDPR Article 33) and you without undue delay (Article 34).

11. Changes to this policy

If we update this policy, we will publish the new version on this page and update the effective date and version number above. Material changes that affect how we use existing subscribers' data will be communicated in a separate email, not inside the monthly letter, before they take effect.

12. Contact and complaints

For any privacy question, write to:

Evervel, Unipessoal LDA
NIPC 519 159 462
Lisbon, Portugal
[email protected]

You also have the right to lodge a complaint with your local data-protection supervisory authority. In Portugal, this is the:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa
+351 21 392 84 00
[email protected] · cnpd.pt

If you live elsewhere in the EEA, your local DPA can also accept the complaint. UK residents may complain to the Information Commissioner's Office (ico.org.uk).

Back to home