Privacy Notice

What we collect

• Account data — your email address, sign-in credentials or Google sign-in identifier, and the display name you choose.
• What you write in Elevait — daily entries, reflections, journal entries, tasks, notes, wellbeing and money entries, review answers and AI Guide conversations.
• Photos you upload to have a handwritten list read into tasks.
• Support messages you send us.
• Technical data — IP address, device and browser information, and basic usage and error logs.

We do not collect or store your card details. Payments are handled by Paddle (see "Who we share data with").

Why we use it, and on what legal basis

• To provide the service — creating your account, storing your entries, generating your reflections and reviews, and sending review emails you have turned on. Legal basis: performance of our contract with you.
• Security and fraud prevention — protecting accounts and preventing abuse. Legal basis: our legitimate interests.
• Product improvement and support — diagnosing errors and answering your questions. Legal basis: our legitimate interests.
• Marketing emails, if you ask for them. Legal basis: your consent, withdrawable at any time.
• Legal and accounting obligations. Legal basis: compliance with a legal obligation.

Your entries are private to your account. We do not sell personal data, and we do not use your writing to train third-party AI models.

Who we share data with

• Service providers who host the application and database, send email, and provide error and usage monitoring, acting on our instructions.
• AI providers who process the text or photo needed to generate a reflection or read a handwritten list, on a no-training basis.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, payment processing, subscription management, tax compliance, invoicing and related customer service.
• Professional advisers such as legal and accounting advisers, where needed.
• Authorities, where we are required to do so by law.

International transfers

Some of our providers are located outside your country, including in the United States. Where data leaves the UK or EEA, we rely on appropriate safeguards such as the UK/EU Standard Contractual Clauses or an adequacy decision.

How long we keep it

We keep your account and entries for as long as your account is open. If you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep records longer for legal, tax or accounting reasons.

Your rights

Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. You may also withdraw consent at any time and complain to your data protection authority (in the UK, the Information Commissioner's Office). Email info@elevait.org and we will respond within one month.

Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, and database rules that restrict every entry to the account that created it. No service can be perfectly secure, but we take this seriously.

Cookies

We use only essential cookies and local storage, needed to keep you signed in and to remember your preferences. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will stop working if you do.