Privacy Policy

1. Who is responsible for your data

Elo (“we”, “us”, “our”) is operated by APH, a sole trader based in the United Kingdom. For the purposes of UK data protection law, we are the data controller for the personal data described in this policy.

Contact / data requests:

2. Who can use Elo

Elo is for users aged 18 and over. We do not knowingly process the personal data of anyone under 18. If you believe a minor has provided us with personal data, contact us at [SUPPORT EMAIL] and we will delete it.

3. What personal data we collect

We collect and process the following categories of data:

You provide directly:

Account data: name, email address, password (stored securely/hashed), and authentication details.
Profile data: any profile fields you complete (e.g. institution, subject area, preferences).
Assignment content: briefs, essay questions, the text you write or generate, outlines, drafts, and references within Elo.
Uploaded files: documents you upload, such as assignment briefs, rubrics/mark schemes, lecture notes, slides, and reading materials.
Writing samples: any sample of your writing you provide so Elo can reflect your writing style.
Communications: messages you send us (e.g. support requests).

Collected automatically:

Usage and technical data: limited technical information needed to operate and secure the service (e.g. log data, device/browser information, and similar). [CONFIRM the exact analytics/logging you use and list any analytics provider.]

Payment data (when payments launch):

Handled by our payment processor (e.g. [STRIPE]). We do not store full card details ourselves; the processor handles card data securely. We receive limited information such as subscription status and the last four digits of a card. [TO CONFIRM when payments are built.]

4. How and why we use your data (purposes and legal bases)

What we do	Why	Legal basis (UK GDPR)
Create and manage your account	To provide the service you sign up for	Performance of a contract
Process your assignment content, files, and writing samples to generate AI-assisted outputs	Core functionality of Elo	Performance of a contract
Store your work so you can return to it	To provide the service	Performance of a contract
Secure the platform, prevent abuse, debug and working	To keep Elo safe	Legitimate interests
Respond to your support requests	To help you	Performance of a contract / legitimate interests
Process payments and prevent fraud (when live)	To take payment for the service	Performance of a contract / legal obligation
Send essential service messages	To operate your account	Performance of a contract
Send optional marketing (only if you opt in)	To tell you about Elo	Consent
Comply with legal/tax/accounting obligations	Because the law requires it	Legal obligation

. If any data you process could be “special category” data (e.g. a writing sample or uploaded file that reveals health, beliefs, etc.), additional conditions apply and must be addressed.

5. AI processing — important

To provide AI-assisted features, your content (such as your brief, assignment text, sources, and writing samples) is sent to trusted third-party AI providers (for example, [OPENAI], and may include [ANTHROPIC] and [GOOGLE]) to generate outputs. This means your content is processed by those providers on our behalf as processors, under their applicable terms and data-processing agreements.

We do not sell your personal data.
We do not use your private assignment content to train public AI models, and we select providers/configurations intended to prevent your content being used to train their models. [CONFIRM this is accurate for each provider and configuration you use — e.g. OpenAI API data is not used for training by default; verify and keep this statement true.]
Some AI providers process data outside the UK/EU (e.g. in the United States). See “International transfers” below.

We share data only as needed to run Elo:

Hosting & storage: [SUPABASE] (database and file storage). [CONFIRM hosting region.]
AI processing: [OPENAI / ANTHROPIC / GOOGLE] (to generate outputs).
Payments: [STRIPE or chosen processor] (when payments launch).
Communications/analytics: [LIST any email or analytics providers].
Legal/safety: authorities or advisors where we are legally required, or to protect rights, safety, and the integrity of the service.

We do not sell your personal data or share it with third parties for their own marketing.

7. International transfers

Some of our processors (notably AI and hosting providers) may process your data outside the UK, including in the United States. Where this happens, we rely on appropriate safeguards required by UK data protection law — such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and/or adequacy mechanisms (e.g. the UK–US Data Bridge) where applicable.

8. How long we keep your data

We keep your account and content for as long as your account is active, so you can access your work.

When you delete your account, we delete or anonymise your personal data within [30] days, except where we must keep certain records longer (for example, payment and tax records, which UK law requires us to retain for around 6 years), or where we need limited data to resolve disputes or enforce our terms.

Backups containing your data are overwritten on our normal backup cycle.

retention periods, backup cycle, and deletion process with your technical setup (Supabase deletion, file storage deletion, and processor deletion all need to be addressed so deletion is genuinely effected, including at processors).

9. How we protect your data

We take reasonable technical and organisational measures to protect your data, including [encrypted connections (HTTPS), access controls, hosted infrastructure with security protections]. No system is completely secure, and we cannot guarantee absolute security, but we work to protect your information and to notify you and the ICO of any breach where legally required.

10. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you;
request correction of inaccurate data;
request erasure (“right to be forgotten”) in certain circumstances;
restrict or object to certain processing;
data portability — receive certain data in a portable format;
withdraw consent at any time where we rely on consent;
complain to the ICO (see below).

To exercise any right, contact [SUPPORT EMAIL]. We will respond within the timeframes required by law (usually one month). We may need to verify your identity first.

11. Complaints

If you have concerns about how we handle your data, please contact us first at [SUPPORT EMAIL] so we can help. You also have the right to complain to the UK regulator:

Information Commissioner’s Office (ICO) — https://ico.org.uk — helpline 0303 123 1113.

12. Cookies and similar technologies

[CONFIRM AND COMPLETE.] Elo uses [essential cookies required to run the service and keep you signed in]. [If you use any analytics or non-essential cookies, you must obtain consent via a cookie banner and describe them here.]

Under the Privacy and Electronic Communications Regulations (PECR), non-essential cookies require consent. If you add analytics, you’ll need a compliant cookie banner.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new “Last updated” date and, where changes are significant, take reasonable steps to notify you.

14. Contact

For any privacy questions or to exercise your rights: [SUPPORT EMAIL]

This Privacy Policy should be read together with our Terms of Use.