Privacy Policy

1. Scope and Controller

This Privacy Policy explains how Elvanto, Inc., a Delaware corporation, collects, uses, discloses, and protects personal data when you visit elvanto.app, create an account, contact us, or use the Elvanto Station and Platform services.

For business customer data processed on a customer's instructions, the customer is generally the controller and Elvanto acts as its service provider or processor under the applicable agreement.

2. Personal Data We Collect

The data we collect depends on how you interact with the services.

• Account and profile data, such as name, business email, organization, role, login identifiers, and account preferences.
• Customer content and service data, including agent inputs and outputs, run metadata, configuration details, support messages, and files you choose to submit.
• Transaction data, such as subscription, invoice, and payment status. Payment-card details are handled by the applicable payment provider and are not intended to be stored by Elvanto.
• Device and usage data, such as IP address, browser and device type, pages viewed, timestamps, referring pages, diagnostics, and security logs.
• Information received from integrations or third parties at your direction, subject to your settings and their terms.

3. Sources of Personal Data

We collect personal data directly from you, automatically from your device and use of the services, from your organization, and from integrations or service providers you authorize.

4. How We Use Personal Data

• Provide, secure, maintain, and troubleshoot the services.
• Authenticate users, administer accounts, process subscriptions, and provide support.
• Display and analyze agent results, generate requested reports, and improve service performance.
• Communicate about transactions, security, product updates, and marketing where permitted by law.
• Detect fraud, abuse, and security incidents; enforce our agreements; and comply with law.
• Create aggregated or deidentified information that cannot reasonably be linked to an individual.

5. How We Disclose Personal Data

We disclose personal data only as reasonably necessary for the purposes described here.

• Service providers and processors that support hosting, authentication, payments, communications, support, security, and analytics, subject to contractual restrictions.
• Your organization, administrators, collaborators, and integrations according to your account settings and instructions.
• Authorities or other parties when required by law, to protect rights and safety, or to investigate fraud or security incidents.
• A buyer, investor, adviser, or successor in connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

6. Cookies, Do Not Track, and Opt-Out Signals

We may use cookies or local storage that are necessary for authentication, preferences, security, and basic service measurement. The current public site does not use third-party advertising trackers.

Because we do not currently sell personal data or process it for targeted advertising, browser Do Not Track and universal opt-out signals do not change the site's behavior. If those practices change, we will update this notice and honor legally required opt-out preference signals, including Global Privacy Control where applicable.

7. Sale and Targeted Advertising

Elvanto does not sell personal data for monetary or other valuable consideration and does not process personal data for targeted advertising as of the effective date of this policy.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including providing the services, maintaining security and business records, resolving disputes, and meeting legal obligations. Retention periods vary based on the data type, account status, contract requirements, and applicable law. We delete or deidentify data when it is no longer needed, subject to backup and legal retention requirements.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data. No system is completely secure, and we cannot guarantee absolute security. Customers remain responsible for configuring their environments, credentials, permissions, integrations, and backups appropriately.

10. Privacy Rights and Requests

Depending on where you live and subject to legal exceptions, you may request confirmation and access, correction, deletion, portability, a list of third-party categories, or an opt-out from sale, targeted advertising, or qualifying automated profiling. We will not discriminate against you for exercising an applicable privacy right.

Delaware residents may exercise rights available under the Delaware Personal Data Privacy Act. We generally respond within 45 days and may extend once by up to 45 additional days when reasonably necessary. If we deny a request, you may appeal by replying to our decision with the subject line 'Privacy Appeal.' We may verify your identity or an authorized agent's authority before acting.

Submit a privacy request or appeal by emailing [email protected].

Delaware residents may also contact the Delaware Department of Justice through its Personal Data Privacy Portal.

11. Children

The services are intended for business users and are not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data, contact us so we can review and delete it as required by law.

12. International Data Transfers

If personal data is transferred across national borders, we use safeguards required by applicable law. Your organization's agreement with Elvanto may contain additional transfer terms.

13. Changes to This Policy

We may update this policy to reflect changes in our services, practices, or legal obligations. We will post the revised policy with a new effective date and provide additional notice when required by law or contract.

14. Contact Us

The controller and website operator is Elvanto, Inc., a Delaware corporation.

For privacy questions or requests, email [email protected].