This policy explains what data Elastly collects, why we collect it, and the choices you have. We keep it in plain language because trusting us with your pricing data is a serious thing, and you deserve to understand exactly how we handle it.
1. Overview
Elastly, Inc. ("Elastly", "we", "us") provides an AI pricing platform for retailers, manufacturers, and distributors. This policy applies to our website and product. When we process data on behalf of a customer under a services agreement, that customer is the data controller and we act as a processor.
2. Information we collect
- Account data: name, work email, company, and role when you sign up or request a demo.
- Customer data: product, cost, sales, and competitor data you connect so we can produce recommendations.
- Usage data: how you interact with the product, captured to keep it reliable and improve it.
- Device & log data: IP address, browser, and timestamps collected automatically for security.
3. How we use it
We use data to provide and secure the service, generate and explain pricing recommendations, communicate with you, meet legal obligations, and improve our models and product. We do not sell your personal data, and we never use one customer's data to benefit another.
4. Legal bases
Where the GDPR applies, we rely on: performance of a contract (to deliver the service), legitimate interests (to secure and improve it), consent (for optional cookies and marketing), and legal obligation (to comply with applicable law). You may withdraw consent at any time.
5. Sharing & disclosure
We share data only with sub-processors under contract, with your consent, or where required by law. Our sub-processor list names each one, what it does and what data it receives. When we process data for a customer, our Data Processing Agreement applies.
We use Anthropic to read customer requests, suggest field mappings, read competitor files and write price explanations. For a customer request we send the full text and attachments you ask us to read, which can include names, signatures and addresses. For mappings and competitor files we send column names and a few sample rows. For explanations we send product, price and margin facts. An Admin can turn AI processing off for a workspace in Settings.
6. Data retention
We keep personal data only as long as needed for the purposes above or as required by law. We delete a workspace and all of its data 30 days after its subscription ends. A workspace that never subscribed is deleted 30 days after its trial or setup period ends, or 30 days after it was created if it never had a trial. The workspace Owner gets an email at least 7 days before the deletion date. Deletion covers every record, uploaded file and stored credential in the workspace. We keep Stripe customer and invoice records for as long as accounting and tax law requires.
7. Security
We encrypt data in transit and at rest, keep each workspace isolated in the database, and store ERP and store credentials in an encrypted secret store. We do not hold a SOC 2 report today. No system is perfectly secure, but we work hard to protect your data and will notify affected customers promptly in the event of a breach.
8. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. We will respond within the time required by applicable law.
9. International transfers
Our database and application servers run in the European Union (Ireland). Some sub-processors are in the United States. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses.
10. Cookies
We use essential cookies to run the site and optional cookies for analytics and marketing. You can change your choices at any time from the cookie preferences control in the footer of any page.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you. Continued use of the service after an update means you accept the revised policy.
12. Contact us
Questions about this policy or your data? Reach our privacy team at privacy@elastly.io. You also have the right to lodge a complaint with your local data protection authority.