EverpopEverpop

Privacy Policy

Last updated: May 28, 2026

This Privacy Policy explains how Everpop ("Everpop", "we", "us", or "our") collects, uses, shares, and protects information about you when you use our website and services (the "Service"). By using the Service, you agree to the practices described here. If you do not agree with this Policy, please do not use the Service.

Everpop is operated by Very - Fast Ltd. (Вери - Фаст ЕООД), an EOOD (single-member limited liability company) registered in Bulgaria under EIK 206337186, with registered seat at 29 Georgi Benkovski Str., 3000 Vratsa, Bulgaria (ул. Георги Бенковски №29, 3000 Враца). You can contact us at privacy@everpop.app for any data protection matter, or at support@everpop.app for general support. Our supervisory authority is the Commission for Personal Data Protection of the Republic of Bulgaria (kzld@cpdp.bg, cpdp.bg).

1. Information We Collect

We collect the following categories of information:

  • Account information: name, email address, and password (stored hashed) when you register.
  • Connected platform data: when you connect a YouTube channel or social account, we receive identifiers, channel/video metadata, and authorization tokens needed to provide the Service. Tokens are encrypted at rest.
  • Content: videos, clips, captions, and related metadata processed to deliver clipping and publishing features.
  • Billing information: processed by our payment provider (Stripe). We do not store full card numbers.
  • Usage data: log data, device/browser information, IP address, and product analytics about how you interact with the Service.
  • Communications: messages you send to support.

2. How We Use Information

  • To provide, operate, maintain, and improve the Service;
  • To detect new uploads, generate clips, and publish content to platforms you authorize;
  • To process payments, manage subscriptions, and prevent fraud;
  • To communicate with you about your account, security, and updates;
  • To monitor, secure, and troubleshoot the Service;
  • To comply with legal obligations and enforce our Terms.

3. Legal Bases for Processing (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data on the bases of: performance of a contract (to provide the Service), legitimate interests (to operate and improve the Service and prevent abuse), consent (where required, e.g. certain cookies), and compliance with legal obligations. As the controller is established in Bulgaria, our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (cpdp.bg).

4. How We Share Information

We do not sell your personal information. We share information only with service providers ("subprocessors") that help us run the Service, under contractual confidentiality and data-protection obligations. We may also disclose information to comply with law, enforce our Terms, or protect our rights, users, or the public.

5. YouTube / Google API Services

When you connect your YouTube channel, Google provides us with access limited to two scopes: youtube.readonly (to detect new uploads on the channel you authenticate) and youtube.upload (to publish vertical Shorts back to that same channel when you explicitly initiate a publish action). We store your channel_id, channel title, recent video metadata (titles, video_ids, thumbnails) for clip generation, OAuth tokens (encrypted at rest), and the video_ids of Shorts we publish.

Limited Use.Everpop's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data; we do not use Google user data for serving advertisements (including retargeting, personalized, or interest-based advertising); we do not use Google user data to train generalized machine-learning models; and we do not allow humans to read Google user data unless we have your explicit consent for specific data, or it is necessary for security purposes or to comply with applicable law.

Your use of the Service's YouTube features is also subject to the YouTube Terms of Service and Google Privacy Policy. You can revoke our access at any time at myaccount.google.com/permissions.

6. Meta Platform Data (Facebook + Instagram)

When you connect your Facebook account and/or Instagram Business or Creator account, Meta Platforms, Inc. provides us with limited information necessary to operate the connection: your Facebook user ID and name; the IDs and names of Facebook Pages you administer; your Instagram user_id, username, and account_type; and OAuth access tokens (including long-lived Page access tokens) used to publish content on your behalf when you explicitly initiate a publish action.

We use this data exclusively to (a) display the connected account in your dashboard, (b) publish the specific clips you select to your chosen destinations, and (c) honor your request to disconnect. We do not use this data for advertising, profiling, machine-learning training, or any purpose other than the publishing function you opt into.

Stored fields: Facebook user_id; Page IDs and names you select; Instagram user_id, username, account_type; OAuth tokens (encrypted at rest); video_ids of clips we publish. Deletion:triggered automatically within 24 hours of clicking "Disconnect" in Settings → Connections, or upon receipt of a deletion request at privacy@everpop.app. You can also revoke our access directly at facebook.com/settings → Apps and Websites.

We support Meta's Data Deletion Callback. Our callback endpoint is hosted at https://everpop.app/api/meta/data-deletion, and our user-facing deletion instructions are at everpop.app/data-deletion.

7. TikTok Data

When you connect your TikTok account, TikTok provides us with your open_id, display name, avatar URL, and OAuth access + refresh tokens, used solely to publish clips you explicitly select via the dashboard.

We do not read your TikTok feed, your followers, your comments, or any content other than what you produce through Everpop. We do not perform any growth automation, fake engagement, or bulk-posting from one account to many accounts. Each connection is single-creator, opt-in, and revocable at any time at Settings → Connections.

We honor TikTok's content removal: if a post is deleted on TikTok's side, we do not re-publish it. We comply with TikTok's Music Usage Confirmation and Branded Content Policy where applicable; commercial-content disclosure is surfaced in the publish dialog before the post is sent.

Stored fields: open_id, display name, avatar URL, OAuth tokens (encrypted at rest), video_id of each published clip, your selected privacy_level and interaction settings per clip. Deletion: within 24 hours of disconnect or written request to privacy@everpop.app.

8. Subprocessors

We use the following subprocessors to operate Everpop. All are bound by data processing agreements compliant with GDPR Article 28. International transfers to processors outside the EEA rely on Standard Contractual Clauses approved by the European Commission.

  • Vercel Inc. (USA) — application hosting
  • Neon, Inc. (USA) — database hosting
  • Cloudflare, Inc. (USA/EU) — CDN and object storage (R2)
  • Stripe, Inc. (USA / Ireland) — payment processing (card data is sent to Stripe directly; we store only a customer_id reference)
  • AI service providers (audio transcription and AI features used to generate clips)
  • Resend, Inc. (USA) — transactional email delivery

We will update this list when subprocessors change. Notice will be provided via the email address associated with your account at least 30 days before adding a new subprocessor that processes personal data. A current list of named subprocessors, including the specific AI service providers we use, is available to business customers and compliance teams on written request to privacy@everpop.app.

9. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion of your account and associated data at any time.

10. Security

We implement technical and organizational measures designed to protect your information, including encryption of sensitive tokens, access controls, and signed webhooks. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Depending on your location, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing or withdraw consent. To exercise these rights, contact us at privacy@everpop.app. You may also revoke connected-platform access at any time from your account or the relevant platform's settings. EU residents have the right to lodge a complaint with their local supervisory authority; in Bulgaria this is the Commission for Personal Data Protection (cpdp.bg).

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, request deletion, and not be discriminated against for exercising your rights. We do not sell or share personal information as defined by the CCPA/CPRA.

13. Cookies & Tracking

We use cookies and similar technologies for authentication, preferences, and analytics. You can control cookies through your browser settings; disabling some cookies may affect functionality.

14. International Transfers

Your information may be processed in countries other than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers outside the EEA.

15. Children

The Service is not directed to individuals under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

16. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted on this page with a revised "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance.

17. Contact

Questions about this Policy? Contact us at privacy@everpop.app. Mailing address: Very - Fast Ltd., 29 Georgi Benkovski Str., 3000 Vratsa, Bulgaria.