Privacy

Who we are

The controller of Elanza users' data is [Raison sociale], [adresse du siège]. Questions about your data: [e-mail données personnelles].

For data of creators managed by an agency, the agency is the controller and Elanza acts on its behalf (see the data processing agreement).

Data we process

Account: name, email, language, connected devices (security).

Content: brand-related emails and attachments (contracts, quotes, invoices), brands and contacts, deals, amounts, dates, usage rights, exclusivities, reminders, invoices, billing details (company name, address, company ID, VAT, IBAN).

Subscription: plan, status, payment history (card data is handled by Stripe).

Technical: sign-in and security logs, IP address (abuse prevention).

What we never do

No advertising, no resale, no commercial profiling. Emails not about a brand are read automatically then forgotten, not stored. Your content is never used to train AI models.

Google data (Gmail)

If you connect Gmail, Elanza only requests read access (gmail.readonly). The access token is encrypted. Information received from Google APIs is used in line with the Google API Services User Data Policy, including the Limited Use requirements: only to provide the sorting and tracking features visible to you; no transfer to third parties except to provide those features, comply with the law or in a merger with your consent; no advertising use; no human reading without your explicit consent, except for security or legal obligations.

You can revoke access at any time from the Mailbox page or your Google account, or use only the forwarding address, with no mailbox access at all.

Why, and on what basis

Providing the service and support: contract.

Billing and accounting: legal obligation.

Securing accounts, preventing fraud, improving reliability: legitimate interest.

Service updates: legitimate interest (you can object any time); beta newsletter: consent.

Our processors

Hosting: [hébergeur, adresse et téléphone], in the European Union.

Payments: Stripe (Ireland / United States).

Artificial intelligence: Anthropic (United States), with no retention beyond processing and no training on your data.

Sending and receiving email: transactional email provider (sign-in, forwarding address).

Google (if you connect Gmail).

Transfers outside the EU rely on the European Commission's standard contractual clauses and, where relevant, the Data Privacy Framework.

Retention

Account and content: as long as the account exists. On deletion, everything is erased at once, except subscription invoices (10 years, accounting law) and security logs (12 months).

Inactive accounts: after 3 years without sign-in, we warn you, then delete the account.

Security

Encrypted connections (HTTPS), per-space isolation at database level, encrypted access tokens, rate limiting, security headers, restricted and logged internal access.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and may set instructions for your data after death.

Most of it is self-service in "My account": "Download all my data" and "Delete my account". Otherwise: [e-mail données personnelles]. We reply within one month.

You may complain to your data protection authority (in France, the CNIL).

Minors

The service is not for under-16s. If you believe someone under 16 gave us data, tell us and we will delete it.

Changes

This policy may change; important changes will be announced in the app or by email.