Who we are
Elastly is operated by OutheBox, LLC, a Delaware limited liability company doing business as Elastly, with its registered office at 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States ("Elastly", "we", "us").
This policy explains how we handle personal data when you visit elastly.ai, contact us, subscribe to our newsletter, or use the Elastly service as a user of a business account. For questions about this policy, write to privacy@elastly.ai.
When we are controller and when we are processor
Elastly is the controller of the personal data described in this policy: data about our website visitors, the people who contact us, and the users of business accounts, to the extent we use it to create and run user accounts, sign users in, bill, keep the service secure, communicate about the service and improve it from aggregated usage.
When a business connects its systems to Elastly, the records it syncs (for example customer contacts named on quotes, orders and invoices) are processed by Elastly as a processor on that business's behalf. The record of actions taken in a workspace, which your company's administrators can review in its audit log, is also processed by Elastly as a processor on your company's behalf. That processing is governed by our data processing agreement with the business, and the business's own privacy notice tells those individuals how their data is used. If you are such an individual, please contact the business you deal with; we will help it respond to your request.
What we collect
- Account details
Name, business email address, job title, company and role in the workspace.
You or a colleague- Sign-in and security records
Sign-in times, IP address, device and browser, multi-factor settings and actions taken in the product.
Automatic- Billing details
Billing contact, company name and address, tax number and payment method.
Payment processor- Product usage
Features used, pages visited in the app and errors encountered.
Automatic- Messages and support
What you write to us by email, in the demo form or in support conversations.
You- Demo requests
Name, work email, company, the systems you use, catalog size and preferred meeting time.
Demo form- Newsletter
Email address and the date you subscribed.
You- Website analytics
Pages viewed, referring site, approximate location from IP address and device type, through cookies you accept.
With consent
We do not ask for, and ask you not to send us, special categories of personal data such as health information or government identifiers.
How we use it and our legal basis
Under the GDPR and the UK GDPR we rely on the following legal bases.
- Running your account and the service
Creating and running your account and providing the service. Where you sign up for your own business, we rely on our contract with you. Where your company gives you access, we rely on our legitimate interest, and your company's, in providing the service it subscribes to.
Contract or legitimate interest- Security
Keeping the service secure, detecting abuse and investigating incidents.
Legitimate interest- Billing
Billing, invoicing and keeping tax records for the business you act for.
Legitimate interest and legal obligation- Demo requests and support
Answering your messages and demo requests, and supporting the business you work for.
Legitimate interest- Product improvement
Improving the product from aggregated usage that does not identify you.
Legitimate interest- Service emails
Sign-in, invitation, approval and billing emails needed to run the account.
Contract or legitimate interest- Newsletter
Withdraw it with the link in every email.
Consent- Website analytics
Given through the cookie banner.
Consent- Legal compliance
Complying with law and responding to lawful requests.
Legal obligation
Our legitimate interests are providing and securing a service to businesses, answering business enquiries and improving the product. Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time, as described under your rights.
AI features
Elastly includes an AI assistant. When you use it, your question and the workspace records needed to answer it are sent to our AI provider to produce the answer. The provider does not use this data to train its models. Models that Elastly trains on a company's data are used only for that company's own workspaces.
Whether you must give us data
You do not have to give us personal data. Your name and business email address are needed to create an account and sign you in, and billing details are needed to buy a plan. Without them we cannot provide the service. Everything else is optional.
Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Prices set with Elastly apply under rules and approvals that the business using it configures.
Who we share it with
We share personal data only with:
- Service providers that act on our instructions under contracts that restrict how they use the data: cloud hosting and storage in the European Union; the AI provider for the assistant, in the United States; email delivery for service emails and the newsletter, in the United States; business email and document tools for our correspondence; website analytics, only with your consent; error monitoring; and payment processing, in the United States. Our payment processor also processes payment data as an independent controller under its own privacy notice, for example to prevent fraud. You can ask for the names of these providers at privacy@elastly.ai.
- Your company's administrators, who can see the users of their workspace and the audit log of actions taken in it.
- Authorities, when the law requires it. We review each request and disclose only what is legally required.
- A successor business, if Elastly is merged, acquired or sells its assets, under the same protections as this policy and with notice to you.
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it for advertising.
International transfers
Workspace data is stored in the European Union. Some of our service providers, and Elastly itself as a United States company, may process personal data outside the European Economic Area, including in the United States.
Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments where those laws apply, or rely on the EU-US Data Privacy Framework where the recipient is certified. You can request a copy of the safeguards at privacy@elastly.ai.
How long we keep it
- Account details and workspace content
Kept while the account is active, then read-only for 30 days for export, then deleted within 30 days.
Account life + 30 days- Sign-in and audit records
Kept so your company can review who did what.
Workspace life- Raw import files
Files and provider payloads used to load your data.
90 days- Encrypted backups
Overwritten through the backup cycle.
7 days- Billing and tax records
As long as tax law requires.
Up to 7 years- Demo requests and support messages
Counted from the last contact.
24 months- Newsletter subscription
Removed when you unsubscribe.
Until you unsubscribe- Analytics data
Only collected with your consent.
14 months
Cookies
The website uses cookies that are strictly necessary for it to work, such as remembering your cookie choice. These do not need consent.
Analytics cookies help us learn which pages are useful. We set them only if you choose "Sure" in the cookie banner. If you choose "No thanks", no analytics cookies are set. You can change your choice at any time by clearing the cookies for elastly.ai in your browser, after which the banner asks again. We do not use advertising cookies.
The Elastly app uses only the cookies needed to keep you signed in and secure your session.
Security
We protect personal data with encryption in transit and at rest, workspace isolation enforced in the database, multi-factor sign-in, time-limited and logged staff access, and tested backups. Our security page describes these measures. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy
- correct data that is inaccurate or incomplete
- delete your data
- receive your data in a portable format
- restrict or object to how we use it, including objecting to processing based on legitimate interests
- withdraw consent at any time, without affecting processing that took place before
- complain to us at privacy@elastly.ai. We acknowledge a complaint within 30 days and tell you the outcome without undue delay
- complain to your data protection authority, for example the authority in the EU country where you live or work, or the UK Information Commissioner's Office
To exercise a right, write to privacy@elastly.ai from the address linked to your account, or tell us how we can confirm who you are. We reply within one month, or within 45 days where California law applies, and tell you if we need more time. We do not charge for requests unless they are clearly unfounded or excessive.
California residents
Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing. The categories we collect are those listed under what we collect, for the purposes listed under how we use it, and we disclose them only to the recipients listed under who we share it with.
We do not sell or share personal information as those terms are defined in the law, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for exercising your rights. An authorised agent may make a request on your behalf with your signed permission.
Children
Elastly is a service for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to privacy@elastly.ai and we will delete it.
Changes to this policy
When we make a material change, we notify account administrators by email or in the app at least 30 days before it takes effect, and update the date at the top of this page. Earlier versions are available on request.
Contact
OutheBox, LLC, doing business as Elastly, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States
Privacy questions and requests: privacy@elastly.ai
Security reports: security@elastly.ai