Privacy & KYC/AML Policy

Everystone (every-stone.com) is operated by ART. Research & Development Ltd. (Company No. 227778), Suite 1, Second Floor, Sound & Vision House, Francis Rachel Street, Victoria, Mahé, Seychelles. We decide why and how your personal data is used: we are its data controller.

Everystone is international: it serves buyers and sellers in any country, and our team works in Bangkok. This policy covers the website, your cabinet, the letters we send, the chat assistant on our public pages, and our contact with businesses.

We process personal data under the data protection laws that apply to us, including Thailand's Personal Data Protection Act (PDPA). Your own country's law may give you further rights. Questions and requests: [email protected].

We collect what the service needs, mostly from you. Here it is by situation, with the reason we use it.

Visiting the site

What we collectCloudflare, which carries all traffic to the site, handles your IP address and browser details to deliver and protect the pages. Visits are counted with Cloudflare Web Analytics — see Analytics. If you are not signed in, we do not log the pages you visit.

WhyTo run and protect the site and to understand, in aggregate, how it is used (our legitimate interest).

Where your visit came from

What we collectWhen a visit starts, your browser tab notes the link's campaign tag (such as utm_source or ref) or the site that linked to us, and the first page you opened. It is deleted when you close the tab. We receive it only if you create an account or send the contact form during that visit, and then keep it with your account or your message.

WhyTo learn which links, events and searches bring people to us (our legitimate interest).

Creating an account

What we collectYour name, email address and password — we store only a one-way hash of the password, never the password itself. Whether you agreed to receive our letters, the use you choose in your cabinet (buying, selling, owning), and when you were last active.

WhyTo open and run your account (our agreement with you). Letters about stones and the market only with your consent.

Identity and business checks

What we collectYour full legal name, country of residence and an image of your passport or national ID. For a business: its name, registration number, city and country, the director's name, a company registration document and the director's ID. Our desk's decisions and their reasons. See Identity checks.

WhyTo know who is on each side of a deal and to meet the anti-money-laundering rules that apply to us (a legal obligation where they apply, and our legitimate interest in safe deals).

Buying

What we collectYour orders and deals: the stone, prices and fees, the options you chose, how the stone reaches you (for insured delivery, the destination country), each step and our desk's notes to you. For payments: the network, the exact amount and the transaction ID of your transfer, which our system reads from the public blockchain to match your payment — anyone can look up a transaction ID there. Refund references. A carrier needs a delivery address: we ask you for it when the stone is ready to ship.

WhyTo carry out your purchase (our agreement with you) and to keep the records the law requires.

Selling or bringing in a stone

What we collectThe stone's details, photos and documents, your price and delivery terms, and each step of your lots and sales. Photos are public; before we keep one, we remove the data stored in the file, such as where and when it was taken (Security). Documents stay private. For a stone you bring in: what you tell us about it. For an owner account: the payment reference you give us. An heir contact, if you name one.

WhyTo list, check and sell your stone (our agreement with you).

Writing to us

What we collectThrough the contact form: your name, email address, who you are (dealer, owner, buyer…), your message and where your visit came from. By email: your address and what you write.

WhyTo answer you and take the steps you ask for.

Using the chat assistant

What we collectWhat you type and the answers. See The chat assistant.

WhyTo answer your question, and to review the assistant's answers.

Details about other people

What we collectA dealer who books a check at the counter gives us the buyer's contact, so that our desk can arrange it. An owner may name an heir contact. If you give us someone's details, tell them, and give only what is needed.

WhyTo provide what the person who gave them asked for.

Businesses we list or contact

What we collectBusiness details from public catalogues and directories. See Dealer catalogues and outreach.

WhyOur legitimate interest.

A deal through Everystone is safe because the stone, the seller and the buyer are all checked. Every owner and every buyer is identity-verified before a deal is completed:

• Buyers pass a short identity check. It runs alongside the payment, and a further purchase needs the check completed. A company buying in its own name passes the business check instead.
• Owners and private sellers pass the identity check before they sell.
• Clients who place a stone in custody also give a source-of-funds declaration.

Dealers and jewelry stores pass a business check (KYB) — the company's registration and its director's identity — before their lots go live.

What we ask for: your full legal name, your country of residence and an image of your passport or national ID; for a business, its registration details and document, and the director's ID. Our desk reviews each check by hand and records the decision. If something is missing, we tell you why, and you can resubmit.

We screen transactions under the anti-money-laundering rules that apply to us, and we operate no nominee arrangements of any kind. We may ask further questions, or pause or refuse a transaction. Where the law requires, we report suspicious activity to the competent authority.

Who sees your documents: identity documents are open only to our operators. A business's documents are also open to that business's own account. None of them appears on a public page, and the other side of a deal sees only that your check is complete. Public passport pages never show who owns a stone.

How long: we keep the records of these checks as long as anti-money-laundering, tax and accounting rules require, which can be after your account is closed.

We use no advertising cookies. The site sets two cookies, and only when you sign in or create an account:

es_session

What it doesKeeps you signed in. It holds a random token that only our server can match, and pages cannot read it (HTTP-only).

How long30 days, or until you sign out

es_signed_in

What it doesTells our pages that you are signed in, so they show your cabinet instead of “Create account”, and so that the public pages you open while signed in can be added to your activity log. It holds only the value 1.

How long30 days, or until you sign out

Your browser also keeps two items for us, outside cookies:

es_first_touch (session storage)

What it doesWhere this visit came from (What we collect). Sent to us only with a registration or a contact form.

How longUntil you close the tab

foyer.widget.v1.… (local storage)

What it doesThe chat assistant's session and your conversation with it, up to its last 100 messages, so that a page reload does not lose it.

How longUntil you clear this site's data in your browser; the chat session itself lapses after 30 days

You can delete all of these in your browser's settings. Signing out deletes both cookies.

We count visits with Cloudflare Web Analytics. Cloudflare adds its small script to our pages as they pass through its network. It reports which pages are viewed, the referring site, the visitor's country, browser, operating system and device type, and how fast the pages load. According to Cloudflare, it sets no cookies, uses no local storage and does not fingerprint visitors. We see the figures in aggregate.

We use no Google Analytics, no advertising pixels and no social-media trackers.

What signed-in customers do on the site is recorded in our own activity log, not in analytics.

When you are signed in, we keep a log of your account's activity in our own database, on our server. It records:

• the steps you take — registering, signing in, the use you choose, demo tours, sending an identity or business check, registering or bringing in a stone, publishing or withdrawing a lot, booking a check at the counter, changing your heir contact (that you changed it, not the contact), and each step of your orders, deals and payments;
• what our desk does on your account, such as its decision on a check;
• the public pages you open while signed in — stone pages, the shop, a checkout — at most once per page every 30 minutes;
• when you were last active.

It records nothing about visitors who are not signed in, and it is not sent to any analytics or advertising service.

Why: to support you, to keep a record of what happened in a deal, and to understand how the service is used (our legitimate interest).

Who sees it: our operators, on a screen that shows each customer's timeline. Our team also receives a daily summary by email: who registered, who was active, and how many stone pages and checkouts were opened.

How long: while your account is open. You can ask us for a copy at any time, or ask us to delete your page views. Entries that record a deal, a payment or a check are kept with that record.

The assistant on our public pages is an AI, provided for us by Foyer (foyerbot.com). It answers from information Everystone has published.

Its script loads from Foyer's servers, so Foyer receives the technical details any website receives — your IP address and browser details — even if you never open the chat.

What you type is processed by Foyer on its own infrastructure, with an AI model Foyer runs itself; it is not sent to any other AI provider. Foyer keeps the conversation to answer you and to review the assistant's answers.

Your browser keeps up to the last 100 messages of the conversation in its local storage, so that a page reload does not lose them, until you clear this site's data (Cookies).

Please don't share identity documents or payment details in the chat — those go through your cabinet.

We read the public online catalogues of gemstone dealers to show their stones in the dealer-catalogue section of our shop. We keep stone facts, prices, product links and business details. None of this is personal data, except where a business is named after a person, and the first name of whoever answered when we called to check the business.

A dealer's name and photos stay off our pages until the dealer agrees. A dealer who objects is opted out: their lots are removed, and their site is never fetched again. A lot that disappears from a dealer's site is deleted 90 days later.

We may write to businesses at the contact details they publish for trade enquiries, for example in a trade-fair exhibitor list: one letter and at most one follow-up, each with a one-click unsubscribe link. Our team may also reach some of them by phone or messenger, and keeps track of that work through a private Telegram bot. Twelve months after the first letter, a contact who never replied is reduced to the company in our outreach list: the person's name, phone number and address are removed, and the email address is kept only after an unsubscribe, so that we never write again.

Both rest on our legitimate interest, use business information only, and stop for good on request.

We do not sell personal data, and we do not use it for advertising. We share it only as follows:

• Cloudflare carries all traffic to the site, protects it, provides our analytics, sends our emails, and forwards the emails you send to our addresses.
• Our hosting provider runs the server that holds our database and the files you upload.
• Foyer runs the chat assistant, on its own infrastructure and with its own AI model.
• The mailbox our team uses holds the emails you send us and the notices our site sends the team — for example about a new registration, a check or a request.
• Telegram carries the outreach cards our team works from: a business's name and the contact details it published.
• TronGrid and Etherscan: to see whether a payment has arrived, our server reads public blockchain data about our own wallets. We send them nothing about you.
• Other users see only what a deal needs. A buyer sees the seller's business name, or “Private owner”; a seller sees that the buyer is verified, not who they are. If you sell as a business, your business name appears on your lots and on the passports of stones you supplied.
• Laboratories, vault operators and insured carriers: when your purchase or custody needs one, our desk arranges it and gives them only what the job needs — a carrier, for example, needs the delivery address. Vault operators store stones under their own agreements with you.
• Authorities, courts and our professional advisers, where the law requires it or to establish or defend legal claims.

Everystone is international, and so is the handling of your data. Our team works in Bangkok. Our server, rented from a hosting provider, and the systems of the other providers above may be in a different country from yours, and Cloudflare carries traffic through its network around the world. Your data may therefore be processed or stored outside the country where you live, including in places whose data protection laws differ from yours.

We transfer data across borders only where it is needed to provide the service you asked for, or on another basis the applicable law allows.

We keep personal data only while we need it for the purposes above, and longer only where the law requires. In practice:

Your signed-in session

30 days, or until you sign out

An email confirmation link

48 hours

Where your visit came from, in your browser

Until you close the tab

The chat, in your browser

Until you clear this site's data

Your account, lots, orders and deals, the letters we sent you, and the activity log

While your account is open; records of deals and payments as long as tax and accounting rules require

Identity and business checks

As long as anti-money-laundering rules require, which can be after your account is closed

Contact-form requests

24 months after they arrive, then deleted

Dealer-catalogue lots

While the lot is on the dealer's site, and 90 days after it disappears. Of a dealer who opted out, only that fact and the website address, so that it is never fetched again

Outreach contacts who never replied

12 months after the first letter; then only the company — and the email address, if they unsubscribed

To close your account, write to us (Your rights).

We protect your data with measures that fit a small team on a single server:

• The site is served over encrypted connections (HTTPS), through Cloudflare. Our server accepts no connections from the internet except our administrators' key-based access.
• Passwords are stored only as one-way hashes (argon2id): we cannot read yours.
• Your session is a random token in an HTTP-only cookie, and we store only a hash of it.
• Identity documents are open only to our operators; business and lot documents, to our operators and the account they belong to. The operator console is open only to operator accounts.
• When you upload an image — a stone photo or a scan of an ID — we remove the data stored in the file, such as where and when it was taken and on which device, before we keep it. The picture itself is not altered.

No system is completely secure. If a breach puts your data at risk, we will act to contain it, and tell you and the authorities where the law requires.

Under the law that applies to you — including Thailand's PDPA — you can ask us to:

• give you access to your personal data and a copy of it;
• correct it if it is wrong or incomplete;
• delete it, or stop using it, when there is no longer a reason to keep it;
• stop using it where we rely on our legitimate interest — direct marketing stops at once;
• withdraw a consent you gave, such as to our letters, without affecting what was done before.

Write to [email protected]. We may first ask you to confirm who you are, and we answer within 30 days. Some data we must keep by law — records of identity checks and deals, for example — and we will tell you when that is the case. To close your account, write to the same address.

You can also complain to a data protection authority, such as Thailand's Personal Data Protection Committee.

We email you about your account, your checks, orders and deals; these letters are part of the service. All our letters are sent through Cloudflare, and we keep a copy of each in our mail log.

Letters about newly verified stones and market notes go only to people who ticked the box when they registered, never more than weekly. You can withdraw at any time by writing to us.

Everystone is for adults. We do not knowingly collect personal data from anyone under 18, or under the age of majority where they live if that is higher, and they should not create an account. If you believe a minor has given us personal data, write to us and we will delete it, unless the law requires us to keep it.

We publish every change on this page and update the date at the top. Where the law requires, we will also tell you directly or ask for your consent.

ART. Research & Development Ltd., Suite 1, Second Floor, Sound & Vision House, Francis Rachel Street, Victoria, Mahé, Seychelles. Email: [email protected].