Privacy Policy

Eleva ("we", "our", "us") operates the Eleva platform - an AI-powered business operations tool for SMBs. We act as the data controller for personal data you provide when using our services.

Contact: privacy@appeleva.com

We collect the following categories of personal data:

Account Data

• Full name, work email address, password (hashed - never stored in plain text)
• Company name, team size, role, and industry

Business Content

• Documents, contracts, and files you upload for analysis
• Financial data, KPI records, and market notes you enter
• Roadmap entries and calendar events

Connected Sources (Magic Inbox)

• If you enable Magic Inbox, we receive email content (body and attachments) sent or auto-forwarded to your dedicated Eleva inbound address
• This may include personal data about people other than you - for example, a vendor's named contact, your accountant's signature block, or an employee named on a receipt - which you (or someone acting on your instruction) choose to send to us
• We classify and extract structured data (amounts, dates, vendor names, line items) from this content; see Section 9 for how automated extraction and human review work together

Third-Party Data in Documents You Forward Documents you forward to Eleva (invoices, receipts, correspondence) frequently name people who never interact with Eleva directly - a supplier's accounts contact, your bookkeeper, an employee on an expense receipt. Where this happens:

• You are responsible for having a lawful basis to share that person's data with us (for example, because it is part of an ordinary business record you are entitled to process, such as an invoice you received)
• With respect to that third-party data, Eleva acts as your processor - the same role we already play for documents you upload manually - and you remain the controller responsible for your own disclosure obligations toward the people named in the documents you forward
• Individually notifying every third party named in every forwarded document is not something we can practically do at scale; consistent with GDPR Article 14(5)(b), we rely on this Privacy Policy, made publicly available, to provide general notice of this category of processing rather than contacting each named individual separately
• We also limit this operationally: raw forwarded content is retained only briefly (see Section 7) and content from unverified senders is always held for your manual review rather than processed automatically (see Section 9)

If you are a third party named in a document forwarded to Eleva and wish to exercise a data protection right, contact privacy@appeleva.com and we will route your request appropriately, working with our customer where needed.

Usage Data

• Pages and features you interact with
• Session duration and frequency of use
• Error logs and performance metrics (anonymized)

Technical Data

• IP address, browser type, device type, operating system
• Cookie identifiers and preferences (see Cookie Policy)

We do not collect: payment card data, government ID numbers, biometric data, or data from minors.

We use your personal data exclusively to:

• Provide the service - authenticate your account, store and retrieve your content, generate AI-powered insights from your data, and - if you enable Magic Inbox - classify and extract structured records from documents and emails you forward to us
• Improve the platform - analyze anonymized usage patterns to fix bugs and develop features
• Communicate with you - send transactional emails (account confirmations, beta access codes, security alerts)
• Comply with legal obligations - retain records as required by applicable law

We do not use your data for advertising, sell it to third parties, or use it to train AI models without your explicit consent.

For users in the European Economic Area, we process your data under the following legal bases:

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

We share your data only with the following categories of trusted processors under strict data processing agreements:

Database & Authentication Provider

• Role: Stores your account data, content, and application data
• Location: EU and/or US (EU-only storage available on request)
• Privacy Policy

AI Processing Provider

• Role: Processes text you submit for AI-generated analysis (contracts, documents, market queries)
• Location: United States
• Note: Our AI provider does not use your inputs to train models under our API agreement
• Privacy Policy

Hosting & Content Delivery Provider

• Role: Hosts the Eleva web application and serverless functions
• Location: United States, with global CDN edge nodes
• Privacy Policy

Inbound Email Processing Provider (Magic Inbox)

• Role: Receives email sent or forwarded to your dedicated Eleva inbound address and passes the content to our ingest pipeline
• Location: Global edge network (Cloudflare), under Standard Contractual Clauses for EU/EEA transfers (same transfer basis as our AI and hosting processors above)
• Privacy Policy

We do not share your data with any other third parties without your explicit consent, except where required by law.

Adding new sub-processors When we engage a new sub-processor or replace an existing one, we will notify account administrators (by email or in-platform notice) at least 14 days before the change takes effect, and you may object by contacting privacy@appeleva.com. If we cannot address your objection, you may stop using the specific feature that relies on that sub-processor, or terminate your account, without penalty.

Our service providers operate in the United States. We apply appropriate safeguards for all international transfers of personal data, including:

• Standard Contractual Clauses (SCCs) - for transfers from the EU/EEA
• Data Processing Agreements - in place with all processors listed above
• Other applicable transfer mechanisms - as required by the data protection laws of your country

We do not transfer your data to countries that lack adequate protections without first applying the relevant legal safeguards required by your jurisdiction.

We retain your personal data only as long as necessary:

• Account data - retained for the duration of your account, plus 90 days after deletion (to allow recovery)
• Business content (documents, contracts, financials) - retained while your account is active; deleted within 30 days of account deletion
• Magic Inbox raw email & attachments - retained for 90 days after receipt (to support audit and dispute resolution), then permanently deleted; only the validated structured data extracted from them (amounts, dates, vendor names) is retained thereafter
• Usage logs - retained for 12 months in anonymized form
• Security and audit logs - retained for 24 months as required for fraud prevention

Where a document you forward is a financial record subject to statutory retention (e.g. invoices, receipts), we retain the extracted structured data for the period required by the tax/commercial law applicable to your business - typically up to 10 years depending on your jurisdiction (for example, Germany: HGB §257 / AO §147; France: Code de commerce Art. L.123-22; Turkey: TTK Art. 82) - even if this exceeds the general retention periods above.

You may request deletion of your account and all associated data at any time via privacy@appeleva.com.

Regardless of where you are located, you have the following rights regarding your personal data:

• Access - request a copy of your personal data
• Rectification - correct inaccurate or incomplete data
• Erasure - request deletion of your data
• Restriction - limit how we process your data
• Portability - receive your data in a machine-readable format
• Objection - object to processing based on legitimate interests
• Withdraw consent - at any time for consent-based processing
• Compensation - claim damages arising from unlawful processing

These rights are recognized under major data protection frameworks including GDPR (EU/EEA) and KVKK (Turkey). Users in other jurisdictions may have additional or equivalent rights under their local laws - contact us and we will accommodate your request to the fullest extent applicable.

To exercise any of these rights, contact privacy@appeleva.com. We will respond within 30 days.

You also have the right to lodge a complaint with the data protection authority of your country.

Eleva uses AI to generate analysis, risk scores, and recommendations based on your data. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

In practice, Eleva's AI outputs are advisory only - no legally binding decision is made automatically without human involvement. You retain full control over how you act on any AI-generated recommendation.

For documents and emails processed through Magic Inbox specifically:

• High-confidence extractions may be committed to your records automatically; low-confidence extractions are always placed in an in-app review queue for you to confirm or correct before they affect your records
• Content from senders we cannot verify against your known contacts is always held for manual review - it is never auto-committed regardless of confidence
• You can adjust your auto-commit confidence threshold, or require manual review of everything, in your account settings

If you believe an automated process has produced a decision that significantly affects you, contact privacy@appeleva.com to request human review.

Eleva is a professional B2B platform intended solely for use by individuals aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact privacy@appeleva.com and we will promptly delete that account.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or a prominent notice within the platform at least 14 days before the changes take effect.

The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Eleva after changes take effect constitutes your acceptance of the revised policy.

For all privacy-related inquiries, data subject requests, or complaints:

Email: privacy@appeleva.com

We aim to respond to all requests within 5 business days.