Privacy Policy

Elevon ("Elevon", "we", "us") is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch Implementation Act for the GDPR (Uitvoeringswet AVG, "UAVG"). This policy explains what personal data we collect, why, and your rights.

1. Controller & contact

Elevon B.V. is the controller for personal data processed on this platform. Contact details are listed in our Legal Notice (Colofon). For privacy questions, contact us at info.elevon@proton.me.

2. Personal data we collect

• Account data: name, email address, role, authentication identifiers.
• Company data: information you provide during onboarding (company name, industry, size, objectives, challenges).
• Business data: financial, sales, marketing and operational records you upload, enter manually, or connect via integrations. This may contain personal data (e.g. customer names) for which you are the controller.
• Usage data: IP address, browser type, pages visited, timestamps, generated for security and product improvement.
• Communications: messages you send to support and AI consultant conversation content.

3. Legal bases for processing (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b)): to provide the service you subscribed to, including account creation and data analysis.
• Legal obligation (Art. 6(1)(c)): to comply with Dutch tax, accounting and record-keeping obligations.
• Legitimate interests (Art. 6(1)(f)): platform security, fraud prevention, product improvement and analytics, balanced against your rights.
• Consent (Art. 6(1)(a)): for non-essential cookies and optional analytics. Consent is freely revocable.

4. Purposes of processing

We process personal data to: operate and secure the platform; provide AI-powered analysis, insights and recommendations; manage subscriptions and billing; provide customer support; and improve our services. AI analysis runs server-side; your data is not used to train third-party AI models.

5. Data isolation

Each company's data is isolated via row-level security. Users only access data belonging to companies they are members of. Business data you upload is processed on your behalf under our Data Processing Agreement.

6. Retention

We retain personal data only as long as necessary for the purposes described. Account data is kept while your account is active and deleted within 30 days of termination. Business data is deleted within 30 days of termination unless a longer retention is required by law. Tax and billing records are retained for 7 years as required under Dutch Bookkeeping obligations (Boekhoudplicht).

7. Recipients & sub-processors

We engage sub-processors to host and operate the platform. A current list is maintained in our Sub-Processors list. We do not sell personal data. Data is shared only with processors bound by GDPR-compliant agreements, or where required by law.

8. International transfers

Some sub-processors may process data outside the European Economic Area. Where this occurs, we rely on Standard Contractual Clauses (Art. 46 GDPR) or an adequacy decision, and apply supplementary safeguards where appropriate.

9. Your rights (Art. 15–22 GDPR)

• Access: request a copy of your personal data (Art. 15).
• Rectification: correct inaccurate or incomplete data (Art. 16).
• Erasure: request deletion ("right to be forgotten") (Art. 17).
• Restriction: limit processing in certain cases (Art. 18).
• Portability: receive your data in a structured, machine-readable format (Art. 20).
• Objection: object to processing based on legitimate interests (Art. 21).
• Automated decision-making: not subject to solely automated decisions with legal/significant effects; AI insights are advisory and require human review.
• Withdraw consent: at any time for consent-based processing.

To exercise these rights, contact info.elevon@proton.me. We respond within one month (Art. 12 GDPR).

10. Complaints

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with your local supervisory authority.

11. Security

We implement appropriate technical and organisational measures (Art. 32 GDPR), including encryption in transit and at rest, access controls, and row-level isolation. See our Security Policy.

12. Changes

We may update this policy. Material changes will be communicated via email or in-app notice.