Privacy Policy

1. Data controller

The data controller is:

2. What data we process

• Registration and account data: name, email address, credentials (handled in encrypted form by the authentication provider), any team membership.
• User content: conversations with the assistant, notes, reminders, uploaded files and documents, generated images, workspace sources.
• Usage and technical data: access and security logs, session identifiers, IP address, consumption counts (tokens) for the purposes of plan limits.
• Billing data: data required for the subscription, processed by the payment provider (we do not store full card details).
• Connector data (optional): if you connect external services (e.g. email, Google Drive, OneDrive), we process access tokens in encrypted form and only the content strictly necessary for the requested function.

Google user data (Limited Use): if you connect your Google account, Elestre accesses only the scopes you authorize (reading Gmail messages and preparing drafts, managing Google Calendar events, reading Google Drive files) and uses them solely to provide you with the features visible in the app. We do not sell this data, nor use it for advertising or to train AI models. The use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including the Limited Use requirements. (Elestre’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.)

We ask you not to enter special categories of data (Art. 9 GDPR) or third-party data without a valid legal basis.

3. Purposes and legal bases

• Provision of the service (account creation, chat, content generation, connectors): performance of the contract | Art. 6(1)(b).
• Security, abuse prevention and service improvement: legitimate interest | Art. 6(1)(f), subject to balancing against your rights (in line with EDPB Opinion 28/2024 on AI models).
• Billing and tax/accounting obligations: legal obligation | Art. 6(1)(c).
• Non-technical cookies and tools: consent | Art. 6(1)(a) (see the Cookie Policy).
• Service communications (verification, security, notifications): performance of the contract and legitimate interest.

We do not use your content to train artificial-intelligence models, nor do we sell it to third parties for marketing purposes. Inference providers are contractually bound not to use the data to train their own models.

4. Recipients and processors

To provide the service we rely on providers acting as processors (Art. 28 GDPR): infrastructure, AI inference engine, image generation, authentication and database, file storage, email delivery, payments and network. The full list, with location and safeguards, is on the Sub-processors page. We may also disclose data to public authorities where required by law.

5. Transfers outside the European Union

The application server is hosted on Asincrona’s infrastructure in the European Union; the database and files reside on infrastructure in the European Union and payments at Mollie B.V. (the Netherlands). Some AI inference processing, however, takes place on Keyfinanz GmbH’s compute infrastructure, headquartered in Germany (European Union), in addition to network services (CDN). Such transfers are carried out on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission and of adequate technical and organizational measures (Art. 46 GDPR). You can request a copy by writing to hello@elestre.ai.

6. Retention period

• Account data and content: for the lifetime of the account; deleted on request or within a reasonable period of closure.
• Technical and security logs: normally up to 12 months.
• Billing data: for the period required by tax obligations (normally 10 years).

7. Your rights

You have the right to access your data, rectify it, erase it, restrict or object to its processing, request its portability and withdraw consent at any time (Arts. 15–22 GDPR). You can exercise many of these rights directly from the app, in Settings → Privacy and data (account export and deletion), or by writing to hello@elestre.ai. We respond within 30 days. You also have the right to lodge a complaint with the supervisory authority.

8. Automated decisions

The assistant generates answers and content automatically, but we do not make decisions producing legal or similarly significant effects on you based solely on automated processing (Art. 22 GDPR). AI outputs may contain errors: they must always be verified before any significant use.

9. Minors

The service is not intended for children under 14. If you are a minor, use Ele only with the consent of the person holding parental responsibility.

10. Security

We adopt technical and organizational measures appropriate and proportionate to the risk (Art. 32 GDPR): encryption in transit (TLS) and at rest, access control on a least-privilege basis, environment segregation, encrypted handling of connector credentials, logging and monitoring of security events, backups and recovery procedures. Our security program is aligned with the controls of the ISO/IEC 27001 standard, toward which we are establishing our Information Security Management System.

11. Personal data breaches

In the event of a personal data breach that poses a risk to your rights and freedoms, we notify the supervisory authority within 72 hours of becoming aware of it (Art. 33 GDPR) and, where the breach poses a high risk, we also inform the data subjects without undue delay (Art. 34 GDPR). We keep an internal register of breaches and the measures taken.

12. Changes

We may update this policy. In the event of material changes we will give notice through the service or by email and, where necessary, request a new acceptance.