Terms of use

EverStamp is a service of Digital Sandbox B.V., Waalstraat 2, 8052 AE Hattem, the Netherlands, registered with the Netherlands Chamber of Commerce (Kamer van Koophandel) under number 42124304, VAT number NL869836109B01 (“we”, “EverStamp”).

Contact: info@everstamp.app. Telephone: +31 6 21 52 00 00, on working days. For privacy: privacy@everstamp.app. To report a vulnerability or misuse: security@everstamp.app; see also everstamp.app/security. By post: Waalstraat 2, 8052 AE Hattem.

Authorities and users can reach us for notices under the Digital Services Act at the same addresses, in Dutch or English.

These terms apply to every use of EverStamp: the app, the verification page, share links, the dashboard and the API.

Anyone who gets the app from the App Store or Google Play, or buys Plus there, is also subject to the terms of Apple or Google (article 16). For an organisation, a quotation, where there is one (article 26.1), and the data processing agreement (annex 1, article 34) also apply.

In the event of conflict, precedence is as follows: (a) mandatory law, (b) the data processing agreement (annex 1), insofar as personal data are concerned, (c) a quotation accepted by both parties, (d) these terms. The terms of Apple and Google take precedence insofar as they themselves so provide.

We expressly reject an organisation’s general terms and conditions, including purchasing terms. They apply only if we accept them in writing.

The terms are available at everstamp.app/nl/voorwaarden and everstamp.app/terms, also as a PDF to save. We send them free of charge on request.

An agreement with us is formed by electronic means. (a) With a user of the app it is formed by using the app, and a purchase by confirming it in the store; with an organisation as article 26.1 says. (b) The terms are on the site, also as a PDF to save (article 3.5). For an organisation we record which text it accepted, with the state of the data processing agreement, who did so and when. With a user of the app we keep no separate agreement, because there is no account; the text that applies is on the site, with the date on which it took effect. (c) Until confirming, whoever creates an organisation can read over and change the data entered; after that an owner can change them in the dashboard. The user confirms a purchase in the app on the screen of the store, where they can also abandon it. (d) The agreement can be concluded in Dutch and in English (article 14.5). (e) We have not subscribed to a code of conduct. (f) Whoever creates an organisation receives a confirmation by email, with the moment, the state of the terms they accepted and a link to that text.

EverStamp is a tool for recording photos and videos, in a form and a time window that another person can check for themselves. What a file is worth in a dispute is decided by the recipient, an insurer or a court. Not by us.

In the European Union, a qualified timestamp enjoys the presumption of the accuracy of the date and time it indicates, and of the integrity of the data to which that date and time are bound, that is, that the data has not changed since then (Article 41(2) of the eIDAS Regulation). The presumption goes no further than those two things. In the Netherlands, the court assesses the evidence freely (Article 152 of the Dutch Code of Civil Procedure (Rv)).

What a file records:

• that the images existed in this form and order before the moment of the timestamp;
• that EverStamp signed no capture before the time anchor it carries, insofar as that time anchor can be checked. A time anchor is a random number that becomes public at a fixed moment; no one could know it in advance. In a photo the time anchor is in the provenance data that EverStamp signs after the device; in a video it is in what the device itself signs (the point for a video, below). With our app on a device that is not jailbroken or rooted, the photo was then also taken after that moment;
• that a change to the images or their order after that shows up;
• that the photos were signed with a key that, according to Apple or Google, was created in the secure hardware of a real device for our app. That is a declaration by Apple or Google, not a finding of ours;
• for a video: that the images and the sound existed in this form before that video’s own timestamp, that the fragments of that video, in this order, fall under the device’s signature, that the device did not sign the video before the time anchor it carries, and that a change after that shows up; with our app on a device that is not jailbroken or rooted, the video was then also recorded after that moment;
• for a file that our registry confirms: that EverStamp registered the file. Without that confirmation the verification page never gives a green verdict.

What a file does not record:

• what can be seen in a photo, or whether that is accurate; a photo of a screen is still a photo;
• what can be seen or heard in a video, or whether that is accurate;
• the time on the stamp bar: that is the clock of the device, a declared value; the time that counts is that of the timestamp;
• the location on the stamp bar: that is what the device reports;
• who used the device;
• whether the device was jailbroken or rooted; the declaration by Apple or Google can succeed on such a device too, and on such a device an older image can be presented as a new capture;
• which files were not shown;
• without that confirmation by the registry: whether EverStamp registered the file.

The timestamp is issued by the time-stamping service, not by us. For the timestamp itself, that service is liable on the basis of Article 13 of the eIDAS Regulation.

Even without a network, the device signs every capture immediately with its own key in the secure hardware. What needs a connection, namely the C2PA signature of our service and the timestamp, follows as soon as there is a connection or the time-stamping service is available again. The time of the timestamp is then later than the capture; the file shows the window between the time anchor and the timestamp, with the device clock as a stated value, and a photo signed later is marked as such.

For each file, the public log contains only: the fingerprint (hash) of the file, the serial number and the time of the timestamp, an identifier of the device and the identifier of the file. Never the photos or the position. The identifier of the device differs per file, so that entries of the same device cannot be linked to each other; entries from before 29 September 2026 carry the fixed identifier of the device.

In addition, the registry keeps what is needed to provide the service, as the privacy statement describes: among other things the key and the attestation of a device, for each photo the fingerprint that is signed, for Plus a fingerprint of the subscription and the usage, and for a file of an organisation the name, the checklist and the completed fields, only for that organisation.

We keep entries in the public log indefinitely; that way the registry can still confirm a file later, and anyone can check that a period has not changed. We erase the names and file data of an organisation when the organisation is dissolved, except the organisation’s name in a revoked link of a phone, which stays for another fourteen days (data processing agreement, article 11). The privacy statement explains what this means for the rights of the people concerned.

The verification page is free to use, without an account. We may restrict automated use that hinders the service for others.

Photos and videos stay on the user’s device, except in three cases: (a) a share link that the user creates, or that a guest’s app makes by itself right after the delivery as a receipt (with the key only in the link), (b) photos and videos that are supplied at the request of an organisation, (c) files that an organisation has us store. In those cases we keep an encrypted copy.

A share link remains available until it expires or is withdrawn. How long a link is valid, and how much a user’s open share links may weigh together, depends on the plan and is shown in the app and on the pricing page. After expiry or withdrawal we delete the copy; backups disappear no later than 17 days after that.

With an ordinary share link, the key travels only in the link itself; we cannot read the content. With a delivery to an organisation or storage with us, we hold the key. Through the dashboard or the API we open such a file only at the request of that organisation: a signed-in owner or administrator, or an API key of that organisation; not for a field worker or reader. Every opening through the dashboard or the API is recorded in that organisation’s audit log: a page of previews in the gallery as one line with the files listed, and the originals as one line per file. Because we manage the key, we can technically also open such a file outside the dashboard, and then without a line in that audit log; we do so only at the written request of an owner of that organisation, after we have verified their identity, or if a competent court or authority obliges us to by an order or demand based on the law. We review such an order or demand, we provide no more than is demanded, and we tell the organisation in advance or as soon as that is allowed, unless the law forbids that notice. Of every opening outside the dashboard we keep a record: who did it, when, which file, and at which request, order or demand. On request the organisation receives the entries that concern its files, insofar as the law allows.

Anyone who shares a share link decides who receives it. Anyone who has the link can open the file.

It is not permitted to use EverStamp:

• for content or acts that are contrary to the law, including illegal content within the meaning of Article 3(h) of the Digital Services Act;
• to photograph or film people, or to distribute their image or voice, without the law allowing it; anyone who works for a company or organisation is responsible for having a legal basis under the GDPR (AVG) and respects the right to one’s own image (portretrecht);
• to falsify a file, to make it appear to be something it does not record, or to mislead another person about what a file records (article 4);
• to disrupt or overload the app, the registry, the verification page or the API, to use them to view other people’s data, or to probe them without permission; only the last of these has an exception, within the rules of everstamp.app/security for anyone who reports a vulnerability in good faith;
• to circumvent the device check (App Attest on the iPhone, Android Key Attestation on Android).

Researchers who investigate and report a vulnerability in good faith in accordance with everstamp.app/security will not face legal action from us for doing so. Good faith means at least: without disrupting or overloading the service and without viewing other people’s data. The commitment on /security applies in the same way.

Anyone who believes that a share link or a stored file contains illegal content, or that EverStamp is being misused, reports this via security@everstamp.app, and states: the reason, the link or the reference, their name and email address (except in the case of certain criminal offences), and a statement of good faith. A notice from someone who can be recognised in a photo or video and objects to it counts as a notice too. We confirm receipt and let the person reporting know what we decided. A notice that arrives at info@everstamp.app is handled in the same way.

A notice is not a reason for us to open encrypted content: we cannot read an ordinary share link, and we open a delivery or a stored file only as article 6.3 describes. After a notice, we may block or remove a share link. In the event of repeated misuse, we may also restrict access to share links or the dashboard. We do so carefully, objectively and proportionately, and we give reasons for a measure if we can reach the person concerned.

If a notice gives rise to a suspicion of a criminal offence that threatens the life or safety of people, we report it to the competent authorities.

Complaints about EverStamp: info@everstamp.app. We reply within 3 working days, and within 24 hours in urgent matters. Consumers can also go to the competent court. For purchases through the stores, they can also turn to Apple or Google.

The app, the verification page, the dashboard, the software and the trade marks belong to us or our licensors.

The photos, videos and files belong to the user, or to the organisation for which they work. We receive only the right that is needed to provide the service: to store and display a share link, to hand over a delivery to the organisation, to store a file.

How we handle personal data is set out in the privacy statement at everstamp.app/privacy. The privacy statement is information and not part of these terms. For share links, the registry (except what it keeps for an organisation, articles 5.2 and 10.2), the public log, Plus, the sign-in account for the dashboard (email address, sign-in method, sessions, last sign-in and second step) and the payments, we are the controller, and also for what is needed for the security of the service and preventing abuse, with the access logs and the system journal that belong to it: we do that as the provider on our own responsibility, not on an organisation’s instruction.

For what we process on behalf of an organisation (deliveries, stored files, data of guests, the membership and the role of members, the organisation’s audit log, and the name, the checklist and the fields of its files in the registry) we are the processor, and the data processing agreement (annex 1, article 34) applies.

We do our best to keep EverStamp available, but we do not promise uninterrupted operation. Where possible, we announce maintenance in advance.

EverStamp also depends on services of others: the time-stamping service, Apple and Google (device check and purchases), and the user’s networks. If these do not work, a timestamp may come later (article 4.6).

We provide updates to the app, including security updates, for as long as may reasonably be expected. Anyone who does not install an update bears the consequences of that if we have informed them about it.

We are not liable for what a recipient, insurer or court does with a file or concludes about it, nor for the content of photos.

We are not liable for damage caused by services of others not being available, or being available only later (article 11.2), insofar as we have no influence over this.

The limitations in these terms do not apply in the case of intent or wilful recklessness (opzet of bewuste roekeloosheid) on the part of us or our senior management, nor insofar as mandatory law prohibits them. For consumers, article 23 also applies; for organisations, article 36.

These terms and every agreement with us are governed by Dutch law. A consumer retains the protection of the mandatory rules of the country where they live.

Disputes with an organisation are settled by the Rechtbank Gelderland (the District Court of Gelderland). A consumer can always go to the court of their own place of residence; we bring proceedings against a consumer only there.

If a provision is void or is annulled, the other provisions remain in force and we replace it with a provision that comes as close as possible to its purpose and is valid.

We may amend these terms if there is a good reason for it: a change in the law or in its interpretation, the security of the service, a change at Apple, Google, the time-stamping service or another supplier, a change to the service (article 21), a change in the costs suppliers charge us for the service, or clarifying or improving the text. Every version is on the site, with the date on which it takes effect; the app links to the terms. We distinguish two kinds of amendment:

• A minor amendment is an amendment that is not to the disadvantage of the user or the organisation: a clarification, the correction of a mistake, an amendment to their benefit, or an adjustment the law requires. It takes effect on the day it is on the site, and the dashboard shows a notice.
• A material amendment: every other amendment, and in any case a change to a price (except an indexation under article 31.4), to what the service does, to what the user or the organisation has to do, or to a retention period that these terms state. We announce it at least 30 days in advance: on the site, in the dashboard, and by email to the owners of every organisation, with a link to the new text as a PDF at its fixed address. That email is a service message and is sent even to someone who does not receive product news. Users of the app from version 1.1 also see a material amendment in the app: as soon as the app next connects to our registry, as a rule at the next start, it announces the new terms, with the date they take effect and the PDF to read and save. Anyone who does not want the amendment may terminate the agreement free of charge before the day it takes effect (see also article 21).

These terms exist in Dutch and English. Where the two differ, the Dutch text prevails, except towards a consumer for whom the English text is more favourable.

We grant the user a personal, non-exclusive and non-transferable right to use the app on devices that they own or control, in accordance with these terms and the rules of the store.

iPhone. Apple’s standard licence agreement (Licensed Application End User License Agreement, https://www.apple.com/legal/internet-services/itunes/dev/stdeula/) also applies to the app from the App Store. These terms supplement it. The agreement is between the user and us, not with Apple; Apple is not responsible for the app, its maintenance or its support; claims about the app are to be addressed to us; Apple and its subsidiaries are third-party beneficiaries of these terms and may enforce them against the user.

Android. For the app from Google Play, this licence applies; the Google Play terms take precedence insofar as they so provide.

The app is for anyone aged 16 or over. For a guest, article 25 applies.

You buy Plus and files in the app through the App Store or Google Play. The store handles the payment, the VAT, the renewal, the cancellation and any refund, under its own terms. Anyone in the European Union who buys through the App Store buys from Apple Distribution International Ltd.; through Google Play, from Google Commerce Limited. What Plus gives, how long it runs and how it renews is ours and is in article 18.

The price is the price that the store shows at the time of purchase.

Plus is a monthly or yearly subscription. It gives ten files per month, the customer’s signature on the screen in a checklist that asks for it, backup to a cloud folder of your own, your own logo on the report, share links with a password, with the periods that the app and the pricing page show, and from version 1.2 of the app a taster of video, with the amount per calendar month that the app and the pricing page show.

The subscription renews automatically for the same period until the user cancels it in the subscription settings of the store. Cancellation takes effect from the end of the current period.

Buying files can be done in two ways. Those who have Plus buy five extra (“Five extra files”). With Basic and with Plus you buy one file or three files (“Buy files”). The files from the subscription are used first, or with Basic the free file; then the five extra you bought, and then the single files. The free file is used only when you have no running Plus subscription.

Purchased files do not expire, not even when the subscription ends. After Plus ends, they remain usable for new files. “Five extra files” can only be bought with Plus.

Purchased files are tied to the subscription or to the account with the store: the registry keeps track of them with a fingerprint of it, as the privacy statement describes. The five extra files you bought are tied to the subscription. Single files bought while Plus runs are tied to the subscription; others to the account with the store. On Android you find credit of an ended Plus subscription on the device it ran on. On another device our support transfers it, within three working days after you have sent us three things: the order number from Google Play, the receipt of the purchase, and the identifier of the new device (in the app under This device). The credit is then on the new device and no longer on the old one. If you reinstall the app, that also counts as another device.

Plus Video is, from version 1.2 of the app, a level of Plus with more video per calendar month; how much is shown in the app and on the pricing page. It is a subscription of its own in the same subscription group with the store: switching from Plus to Plus Video takes effect at once, back to Plus at the renewal, as the store carries it out. Otherwise everything that applies to Plus applies to Plus Video. If the month’s amount of video is used up, the app records no more video. If the app did not know yet, for instance without a connection, it does record, but the registry puts no timestamp on that video. If you have Plus and take Plus Video within an hour of the recording, you can have that one video stamped after all, once; the window between the time anchor and the timestamp of that video is then wider. If that does not work, or you do not do it, the video stays on your phone, outside the file or struck in the file. The app never retries on its own. Videos stay on your phone, like photos; only a share link puts an encrypted copy with us for a while, and a subscriber’s open share links may together weigh no more than the app and the pricing page state.

A consumer can withdraw from a purchase made through the store within 14 days, through the store and according to its rules. We do not work against this.

If a consumer withdraws within the cooling-off period, we ask no payment for the use up to that moment. The settings of the app have Withdraw a purchase; that line takes you to the store where you bought.

After a withdrawal, we return to the user their own files on request, insofar as they are held by us. Files on the device stay there.

For single files and for “Five extra files” we ask in the app, beforehand, for your consent to immediate delivery; under the law the right of withdrawal then lapses as soon as they have been delivered. Whether the store refunds anyway is for the store to decide.

The app works without an account. Files are stored on the user’s device. We cannot retrieve or erase them.

If a device is lost or the app is deleted without a backup, the files on that device are gone. Plus offers a backup to a cloud folder of your own. You restore a purchase with “Restore purchases” in the app.

These features (files on the device, no recovery by us, share links with a limited validity) are deliberate characteristics of the service.

We may change the app and the service during a subscription if there is a good reason for this, such as security, legislation, a change at Apple, Google or the time-stamping service, or improvement of the service. A change costs the user nothing extra.

If a change has more than minor negative consequences for the user, we notify them of this in advance, and they may cancel free of charge within 30 days of our notification or, if later, of the change. The store then refunds the unused part according to its rules.

We may block share links or withdraw a device’s access to the registry in the case of: misuse as referred to in article 7, a valid notice as referred to in article 8, a device whose key does not pass attestation (App Attest on the iPhone, Android Key Attestation on Android), or a purchase that the store has reversed.

We do so proportionately and state the reason if we can reach the user. Files on the device remain the user’s.

Towards consumers, we are liable in accordance with the law. We do not limit the rights of a consumer if the service does not conform to the agreement.

Article 12.1 describes what lies outside our service; that is not a limitation of statutory rights. Article 12.2 and the second sentence of article 13 do not apply towards a consumer.

An agreement with an organisation is formed by creating an organisation in the dashboard with acceptance of these terms, or by a quotation accepted by both parties. If the agreement is concluded by email or on paper, we send the terms with it as a PDF.

Anyone acting on behalf of an organisation declares that they are authorised to do so.

The organisation appoints owners and administrators. They invite members, manage linking codes, checklists and settings, and are responsible for what happens under the organisation. An invitation counts as a membership only once the invited person accepts it.

A linking code is personal and secret. An owner or administrator can revoke a code, unlink or block a linked phone, and withdraw an invitation while it is unanswered.

An organisation can ask guests for photos and videos by means of a request. The organisation is itself responsible for having a legal basis under the GDPR and for informing the guest, and we show the guest the notice in article 25.

Sending requests is free; an answered request counts as a file.

Photos and videos that are delivered in response to a request are stored by us for the organisation. In addition, an organisation can have all its files stored with us; that comes with Business and Enterprise, and an owner or administrator switches that storage on. In both cases the files stay for as long as the agreement runs, unless the organisation sets a shorter retention term itself in the dashboard; by default there is no term, and there is no term per plan.

We store encrypted, with the key held by us, and open only as article 6.3 describes. When the agreement ends, the organisation has the 30 days of article 35.1 to collect its files, and after that we delete them. If an owner or administrator withdraws a file earlier, or the organisation is dissolved, we delete it at that moment. Backups disappear no later than 17 days after that.

We keep an organisation’s videos like photos: for as long as the agreement runs, with the storage that comes with the video module and above that the price per 100 GB of article 31.5. An organisation can set a shorter retention term of its own for video in the dashboard, separate from the one for photos. A month before we delete videos under such a term, we email the owners which videos and when, with the way to collect them first. If the organisation shortens the period and videos fall outside it at once, we delete them within a day after an owner or administrator has confirmed it in the dashboard; the owners get an email about it. With a period shorter than 37 days there is no email in advance; the dashboard says so when it is set. After deletion the data about the video stays in the file and the archive with the photos stays kept; the verification page says at that video that it was not supplied and not checked; the file gets a note on the videos for it.

A subscription can always be cancelled as of the end of a calendar month.

You pay for a yearly subscription in advance. If you cancel it during the year, it ends at the end of the current calendar month, and we credit the part of the amount paid that corresponds pro rata to the remaining full months. If more files were used than the plan gives pro rata for the elapsed months, we settle the difference at the price per extra file (article 31.2).

An owner cancels in the dashboard or by email to info@everstamp.app. Where that is in the dashboard is in the user guide in the dashboard. An owner can withdraw the cancellation of a monthly subscription until the subscription has ended; it then simply continues. With a year that is not possible, because the part for the remaining months has then already been settled.

With a quotation, for Business or Enterprise: term and cancellation as in the quotation. If a quotation says nothing about it, 30.1 to 30.3 apply.

A Business subscription renews automatically for the same period, a month or a year, until the organisation cancels it as articles 30.1 to 30.3 describe.

An organisation takes out Business Start itself in the dashboard, at the price the dashboard states at checkout; the dashboard also shows that price when the organisation is created. It takes out Business on quotation and Enterprise with a quotation. An accepted quotation replaces the prices from the dashboard for that organisation, from the date in the quotation. All prices exclude VAT. You pay for Business Start and Business on quotation in advance, monthly, or yearly with the discount the dashboard or the quotation states, through the payment provider in the dashboard; Enterprise pays as in the quotation. Every payment through the payment provider comes with an invoice, already marked as paid. Business can be tried free for the first 14 days, with the number of files stated on the pricing page and without payment details; what the trial includes and what still works afterwards without payment is on the pricing page. The trial ends after 14 days or after the number of files the pricing page states, whichever comes first. Business can be taken by a business established in the European Union; outside the Netherlands that requires a valid VAT number, which we check with VIES. The trial is open in every country the dashboard offers at creation. If the trial ends without the organisation taking out Business Start or accepting a quotation, the agreement ends at that moment: from then on the organisation has the 30 days of article 35.1 to collect its data, and then we delete them, as on cancellation. If the organisation takes out Business Start or accepts a quotation within those 30 days after all, the agreement continues and everything stays. We email the owners at the end of the trial and a week before we delete.

The number of files per plan is a soft cap: we refuse nothing because a counter is full, and we charge for the excess afterwards at the price per extra file that the dashboard states at checkout, or that the quotation states. With a yearly subscription, the files count over the whole year. We notify the owner when the bundle is 80% and 100% used, before we charge for any excess, so that an additional charge does not come as a surprise. There is no maximum of members and no price per member.

If a payment through the payment provider fails, we report this and the payment provider tries again. If a payment is more than 14 days late, we may suspend the service as article 32 describes. Statutory commercial interest is due on a late payment (Article 6:119a BW).

We may change prices as of a new period. If a quotation states anything about price changes, that prevails; if it states nothing, this article applies. A price change is a material amendment (article 14.4): we announce it at least 30 days in advance by email to the owners, and an organisation that does not want it may cancel free of charge before the day the new price takes effect. The only exception is an indexation. At most once per twelve months we may raise the prices by no more than inflation: the year-on-year change of the consumer price index (CPI), all expenditure, of Statistics Netherlands (CBS), over the last month for which the figure has been published on the day we announce the indexation. If CBS replaces the series, the series that takes its place applies. An indexation does not count as a material amendment and gives no right to cancel free of charge; we announce it at least 30 days in advance, stating the figure and the month. A consumer may nevertheless always cancel free of charge before the day the new price takes effect, as with every material amendment (article 14.4).

Video with Business, in four parts:

• (a) Switching on and price. An owner switches the video module on or off in the dashboard; then all members have video from version 1.2 of the app, and a request can allow video. With Business Start the module is included in the price: 25 videos per month and 100 GB of storage for video; above that we charge per video and per started 100 GB, as the dashboard states. With Business on quotation and with Enterprise the module has the price and the amounts the quotation states.
• (b) What counts. The amount of storage counts video only, including video in deliveries and in share links, and no photos. Videos a guest records for a request of the organisation count too, like files on request.
• (c) Settlement. Above the number of videos and above the storage we charge afterwards per calendar month at the price per extra video and per started 100 GB of extra storage that the dashboard or the quotation states, as in article 31.2: we refuse no video because a counter is full. We measure the storage as the highest level on any day in that calendar month. If the module has a price of its own, it runs with the subscription: monthly, or yearly in advance with the same discount; whoever switches it on in the middle of a year pays pro rata until the end of that year, and whoever switches it off pays until the end of the current period. If the organisation cancels a yearly subscription, we settle the module for the remaining months in the same way as the subscription itself (article 30.2). During the trial, video can be tried up to the amount the pricing page states; an owner switches video on for it in the dashboard, at no cost.
• (d) Switching off: keeping or collecting. If the organisation switches the module off, no new videos are added. For the videos stored with us, the owner chooses on switching it off between keeping and collecting. Keeping costs the price per 100 GB a month, from the first GB and for as long as the subscription runs, afterwards per calendar month and per started 100 GB, as above the module’s storage. Collecting gives thirty days from the day the module goes off; after that we delete all of the organisation’s video files, also those in deliveries and in open share links, as article 29.3 describes. A share link then keeps its photos, and the verification page says at the video that it was not supplied. If the owner chooses nothing, collecting applies, and we email the owners when it is switched off and before we delete. If the organisation moves to a smaller bundle, we delete nothing; above the new amount of storage the price per 100 GB applies from the next invoice, and the dashboard shows that before the change.

API keys and webhooks come with Business on quotation, if the quotation names them, and with Enterprise. They are not available during the trial. The qualified timestamp per photo comes only with Enterprise, if the quotation names it; the costs are in the quotation.

We may suspend the service for an organisation after a written demand for payment if payment is more than 14 days overdue, or immediately in the case of serious misuse as referred to in article 7.

Either party may terminate the agreement if the other fails to perform a material obligation and does not remedy this within 30 days of a written notice of default, or in the event of bankruptcy or a suspension of payments (surseance).

During a suspension, files remain on the users’ devices, and the registry and the verification page continue to work.

For Business, article 11 applies: a best-efforts obligation. Support through the dashboard and via support@everstamp.app, on working days.

For Enterprise, the quotation may include a service level, with availability, maintenance windows, response times and any service credits.

For personal data that we process on behalf of an organisation, the data processing agreement (annex 1) applies; it follows Article 28(3) GDPR. For Business it is accepted electronically with these terms (Article 28(9) GDPR). For Enterprise the same text is signed, with its annex B filled in, and DPIA material and a fixed contact person are added.

The subprocessors are listed on everstamp.app/security. We announce a new subprocessor, or a material change in what a subprocessor does, at least 30 days in advance; an organisation can object to it. If the objection is not resolved, the organisation can cancel free of charge.

An amendment of the data processing agreement follows article 14.4. An amendment that reduces the protection of personal data is always a material amendment. The text that an organisation with Enterprise has signed changes only with the consent of both parties.

When the agreement ends, an organisation has at least 30 days to retrieve its data. An owner or administrator exports the data in the dashboard in one go, as JSON and CSV; the photos are not included. They retrieve the archives of stored files there, with the photos and the videos, in one go; those of deliveries per request, in the dashboard or through the API. How that works is in the user guide in the dashboard. After that we delete everything, with the exception of the entries in the public log (article 5.3) and what the law requires us to keep (article 35.2).

If an organisation dissolves itself in the dashboard, we immediately erase what we keep for it, or strip it of names and contact details, except the entries in the public log, the name in a revoked link of a phone that stays for another fourteen days (both article 5.3), and what the law requires us to keep, such as payments and invoices, for seven years; backups disappear no later than 17 days after that, as the privacy statement and /security describe. So export first.

If an organisation wants to switch to another service or to systems of its own, we cooperate with this, in line with the Data Act (Regulation (EU) 2023/2854, Article 25):

• (a) On cancelling, the organisation tells us what it chooses: switching to another service, and which; switching to systems of its own; or having its data erased.
• (b) What can be transferred is everything the organisation can export: the data of the organisation and its members, the audit log, the links of phones, orders, requests, files with their name, checklist and fields, projects, labels, checklists of its own, webhooks, share links and deliveries, the subscription and the usage, as JSON and CSV; and of every stored file and every delivery the archive as the app made it, with the file, the photos, the videos and the report.
• (c) What cannot be transferred is what belongs to the working of our service: keys and secrets (the keys in the vault of the registry, API keys and the secrets of webhooks), the access logs and the system journal, and the backups. The entries in the public log are public and stay (article 5.3).
• (d) The notice period for switching is never longer than two months. A Business subscription ends at the end of the current calendar month (article 30.1); for Enterprise the quotation states the period.
• (e) After the notice period a transitional period of at most 30 days follows. In that period the agreement continues to apply and the service keeps working, we reasonably assist the organisation and whoever it designates with switching, we keep the security at the same level, and we say so if we know of a risk to continuity. The transitional period ends earlier as soon as the organisation lets us know that switching is complete. For those 30 days we charge no subscription; files the organisation records in that period count towards the bundle of the last month and are settled above it under article 31.2. The organisation can extend the transitional period once; for the time after the first 30 days the price of its bundle then applies, pro rata. If 30 days is technically not feasible, we say so within 14 working days of the request, with the reason and another period of at most seven months.
• (f) The agreement ends when switching is complete, and at the latest at the end of the transitional period. If the organisation does not want to switch but wants its data erased, the agreement ends at the end of the notice period. We let the organisation know that it has ended.
• (g) After the end the organisation has the 30 days of article 35.1 to retrieve its data. After that we erase them completely, as articles 35.1 and 35.2 say.
• (h) Switching costs nothing: we charge no switching charges.

The 30 days of article 35.1 also apply after a trial.

Our total liability towards an organisation is limited to the amount that the organisation paid us in the twelve months before the event. This limitation also applies to our liability for a personal data breach, subject to the exception in article 36.3; an organisation with an Enterprise agreement may agree a separate arrangement for this.

We are not liable for indirect damage, including consequential damage, lost profit, lost savings, reputational damage, and damage because a recipient or court assesses a file differently from what the organisation expected. We do not exclude loss of stored files or deliveries through a failure of ours; it falls under the cap of article 36.1.

These limitations do not apply in the case of intent or wilful recklessness on the part of us or our senior management.

A claim lapses if the organisation does not report it to us in writing within twelve months of discovering the damage.