Privacy policy
Introduction
This Privacy Policy is provided by ELVRA AI Solutions Ltd, a company registered in England and Wales under company number: 17390942 with registered office 26 Field Farm Close, Stoke Gifford, Bristol, England, BS34 8XX (‘we’, ‘our’ or ‘us’) for use of our products and services, including our AI brand and marketing platform, ELVRA Brand OS, available at https://elvrabrandos.com, which is the web hub through which we deliver and manage our services, and our website at https://elvraaisolutions.com/ (Services).
We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).
It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are the controller of personal data obtained via the Services, meaning we are the organisation legally responsible for deciding how and for what purposes it is used, except for Customer Data (see ‘What this policy applies to’ below).
What this policy applies to
This privacy policy relates to your use of the Services only. Our Services are designed for businesses and the people who work for or with them. They are not intended for children, and we do not knowingly collect personal data from children.
The Services may link to or rely on other apps, websites, APIs or services owned and operated by us or by certain trusted third parties to enable us to provide you with Services. These other apps, websites, APIs or services may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to these other apps, websites or services, please consult their privacy policies as appropriate. For more information see the section ‘Who we share your personal data with’ below.
Our customers use the Services to create, rebrand and market their own businesses. In doing so, they may upload or connect content and information that includes personal data about other people, such as their staff, their own customers, clients and leads, people who message them, respond to their adverts or receive their invoices, or visitors to their websites (Customer Data). We process Customer Data on our customer’s behalf and on their instructions, as their processor, under our agreement with them. The customer is the controller of that Customer Data, and must have its own privacy policy explaining to those people how their personal data is used. Customer Data includes the information we receive from the accounts our customers connect to the Services (see ‘Information we receive from connected platforms’ below). This privacy policy does not apply to Customer Data.
If you have a question about Customer Data, please contact the business concerned. We will help them to respond where we are required to do so.
Personal data we collect about you
The personal data we collect about you depends on the particular activities carried out through the Services. We will collect and use the following personal data about you:
| Category of data | In more detail |
|---|---|
Identity and account data you input into the Services Registration is mandatory in order to use the Services |
|
| Content you provide | Any personal data about you or your team included in the information and content you give us, or create, approve or publish through the Services, such as names, photographs or biographies |
| Information about people who approve content | If you add people to approve content on your behalf (for example a colleague or a client), their name, email address and mobile number, a record of what they approve or reject and when, and, if they use our mobile approval features, their device notification identifier. If you are an approver, we received your details from the person who added you. |
| Data collected when you connect other accounts | If you connect your website, social media or other marketing accounts to the Services, we process the information we receive from them on your behalf, as your processor (see ‘Information we receive from connected platforms’ below) |
| Payment and billing data | Your billing name and address and records of your purchases and payments |
| Usage and technical data |
|
| Data collected when you make an enquiry with us or contact our support team | Your name, contact details and the details of your enquiries and correspondence with us, including support requests and feedback |
| Marketing preferences | Whether you have agreed to receive, or have opted out of, marketing communications from us |
If you do not provide personal data we ask for where it is required, it may prevent us from providing the Services to you.
We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.
Sensitive Data
Sensitive personal data (also known as special category data) means information related to personal data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation.
Please note that we do not knowingly or intentionally collect sensitive personal data or information about criminal convictions from individuals and that you should not submit sensitive data to us.
If you do include sensitive data in the information or content you give us or upload to the Services, we will only use it as needed to provide the Services you have asked for, and we may delete it.
How your personal data is collected
We collect personal data from you directly when you sign up to the Services, give us information about your business, upload content or connect your other accounts, contact us directly or reach out to us via social media, or indirectly, such as from your activity while using the Services. We may also receive personal data about you from the business you work for or represent (for example, where it adds you as a user of its account or asks you to approve content), from social media, advertising and website platforms you connect to the Services (see ‘Information we receive from connected platforms’ below) and from our payment provider about payments you make.
We and our service providers use cookies and similar technologies on our website and in the Services. Some of these are strictly necessary to make the Services work, for example to keep you logged in and to keep the Services secure. We will only use other cookies, such as those used for analytics, with your consent or where the law otherwise allows, and you can change your choices at any time. More information is available in our cookies policy at https://app.elvrabrandos.com/legal/cookies.
How we use artificial intelligence
Our Services use artificial intelligence (AI) tools to generate brand names, brand assets, written content, images and other marketing material based on the information and content you provide. This means that information you give us, which may include personal data, is processed by AI tools provided by our third-party technology providers.
We also use AI tools to:
suggest article and post ideas relevant to your business and sector, using AI with web search. To do this we send the business and sector information you have given us to our AI technology provider, which may run web searches based on it
draft promotional posts for your approval when an article is published to your website
where you choose to, copy an approved post to other Pages or accounts you connect, and reword its opening line, and
where we offer these features, create images, video, voiceovers and other media from the information and content you provide, and score or compare your draft creative content against examples of high-performing content on social media platforms before you approve it.
Our AI technology providers process this information on our behalf, under contract. Some of them process it in the United States (see ‘Transferring your personal data out of the UK’ below).
We do not use your personal data to train AI models. Under their terms, or their written confirmation to us, our AI technology providers do not use the information we send them to train their own models. Some of them keep it for a limited period (usually up to 30 days) to detect and prevent misuse of their services, and for longer where the law requires it or where they identify a breach of their usage policies.
Please review AI-generated content before you approve or publish it. We do not use AI to make decisions about you that have legal or similarly significant effects on you (see ‘Your rights’ below).
If you give us a recording or image of another person (for example for a voiceover or video), you must have their permission to use it in this way.
Information we receive from connected platforms
Where you choose to connect a social media, advertising or website account to the Services, we receive the account identifiers, names and handles, the access tokens or permissions you authorise, and identifiers and results of the posts and adverts we publish for you (including campaign settings, budgets and spend for advertising accounts). We process this information on your behalf, as your processor (see ‘What this policy applies to’ above), only to publish content and run advertising you have approved, show you the results, keep the connection working and provide any messaging, lead or other features you turn on.
Nothing is connected to the Services, published to your accounts or spent from your advertising budget without your approval.
We do not sell this information, use it to advertise to you or profile you, or use it to train AI models. Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect an account at any time from your account settings or by contacting us. We delete the access tokens when you disconnect the account or close your Services account (see ‘Deleting your data’ below). These platforms use information in accordance with their own terms and privacy policies.
Mobile numbers, messaging and notifications
Giving us your mobile number is optional. If you do, we will use it only for messaging features you choose to turn on, such as notifications by WhatsApp, and only with your consent. We do not send marketing messages to it. You can withdraw your consent and stop these messages at any time by contacting us.
If you use our mobile app or mobile approval features, we collect the device and notification identifiers needed to send you push notifications, for example to tell you that content is waiting for your approval. You can turn notifications off in your device settings or in the Services. Our mobile app uses the same sign-in as the web platform, and this policy applies to it in the same way.
How and why we use your personal data
Under data protection law, we can only use your personal data if we have a proper reason, e.g.:
where you have given consent
to comply with our legal and regulatory obligations
for the performance of a contract with you or to take steps at your request before entering into a contract, or
for our legitimate interests or those of a third party
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below).
The table below explains what we use your personal data for and why.
| What we use your personal data for | Our reasons |
|---|---|
| Create and manage your account with us | Depending on the circumstances:
|
| Providing services and/or the functionalities of the Services to you, including creating or rebranding your brand, generating content using AI tools, publishing content to accounts you connect and running your marketing through the web hub | Depending on the circumstances:
|
| Sending you notifications by WhatsApp or other messaging features you choose to turn on | Where you have given consent |
| To enforce legal rights or defend or undertake legal proceedings | Depending on the circumstances:
|
| Communications with you not related to marketing, including about changes to our terms or policies or changes to the Services or service or other important notices | Depending on the circumstances:
|
| Protect the security of systems and data | To comply with our legal and regulatory obligations we may also use your personal data to ensure the security of systems and data to a standard that goes beyond our legal obligations, and in those cases our reasons are for our legitimate interests or those of a third party, i.e., to protect systems and data and to prevent and detect criminal activity that could be damaging for you and/or us |
| Operational reasons, such as improving efficiency, training, and quality control or to provide support to you | For our legitimate interests or those of a third party, i.e., to be as efficient as we can so we can deliver the best service to you |
| Statistical analysis to help us manage our business, e.g., in relation to our performance, customer base, Services and functionalities and offerings or other efficiency measures | For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service to you and improve and develop our Services |
| Sending you marketing about our Services, such as updates, offers and promotions (see ‘Marketing’ below) | Depending on the circumstances:
|
| Updating and enhancing user records | Depending on the circumstances:
|
| To comply with our legal and regulatory obligations | Depending on the circumstances:
where neither of the above apply, for our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our customers about their accounts and new products or functionalities related to the Services and our services |
To share your personal data with members of our group and third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary |
Depending on the circumstances:
|
See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.
Marketing
We may send you email marketing about our Services, such as updates, offers and promotions, where the law allows us to, as explained below. We do not buy marketing lists or send marketing emails to people who have not dealt with us.
We will always ask you for your consent before sending you marketing communications, except where you have explicitly opted-in to receiving email marketing from us in the past or except where you were given the option to opt-out of email marketing when you initially signed up for your account with us and you did not do so.
You will have the right to opt out of receiving marketing communications at any time by:
contacting us at info@elvraaisolutions.com
using the ‘unsubscribe’ link included in all marketing emails you may receive from us
We will always treat your personal data with the utmost respect and never sell or share it with other organisations for marketing purposes.
For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.
Who we share your personal data with
We routinely share personal data with service providers we use to help us run our business or provide the services or functionalities in the Services. These service providers fall into the following categories:
cloud hosting and data storage providers
AI and machine learning technology providers that help generate content and brand assets through the Services
image processing providers, for example to convert your logo into a vector file
software development, IT support and security providers
email delivery, marketing automation and customer relationship management providers
website and product analytics providers
communication, scheduling and customer support tools
print and fulfilment providers, where you order printed items
We only allow service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you.
Where you ask us to connect the Services to your website, social media or other accounts, we will share the content you approve, and any personal data it contains, with those platforms so that it can be published. Those platforms use that information in accordance with their own terms and privacy policies.
If you order printed or physical items through the Services, for example business cards, we share the delivery name, address and telephone number, and the artwork you have approved, with our print and fulfilment provider so that it can produce and deliver your order. We keep a record of the order for accounting purposes.
We or the third parties mentioned above may occasionally also need to share your personal data with:
external auditors, e.g. in relation to the audit of our accounts and our company —the recipient of the information will be bound by confidentiality obligations
professional advisors (such as lawyers and other advisors)—the recipient of the information will be bound by confidentiality obligations
law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations
other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations
If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).
We do not name our service providers in this policy. Instead, we keep a separate, live list of the service providers that process personal data for us, what each one does and where it processes personal data, at https://app.elvrabrandos.com/legal/subprocessors. We update that list whenever our service providers change.
How long your personal data will be kept
We will keep your personal data for as long as you have an active account with us. After you close your account, we will delete or anonymise it as described in ‘Deleting your data’ below, except for the accounting and legal records we are required to keep (such as invoices and payment records), which we keep for up to 6 years to comply with our accounting or legal obligations, including in the event of the pursuit or defence of legal claims. Once you have closed your account with us, we will move those records to a separate database so that only key stakeholders in our business on a ‘need to know basis’ have access to such data. This does not apply to access tokens or other information we receive from connected platforms, which are deleted as described in ‘Deleting your data’ below.
We delete the access tokens for accounts you connect to the Services when you disconnect the account, when you ask us to or when you close your account, and in any case within 30 days after that. See ‘Deleting your data’ below.
Following the end of the aforementioned retention period, we will delete or anonymise your personal data.
If you opt out of receiving marketing from us, we will keep a record of your opt-out so that we do not send you marketing again.
Customer Data that we process on behalf of our business customers is kept and deleted in accordance with our agreement with the relevant customer.
Deleting your data
You can ask us to delete your personal data at any time (see also ‘Your rights’ below). We will do so except for the information described under ‘What we keep’ below.
Disconnecting a Facebook or Instagram account. You can remove ELVRA Brand OS in your Facebook settings (Settings > Business integrations) and choose to delete your data. Facebook tells us automatically, and we delete the Facebook and Instagram access tokens we hold for you straight away, and the other information we received from those accounts within 30 days. You will be given a reference that you can check at https://app.elvrabrandos.com/legal/data-deletion.
Disconnecting any other account. You can disconnect any connected account from your account settings, or by contacting us. We delete its access tokens when you do, and in any case within 30 days.
Deleting your whole account. Email info@elvraaisolutions.com from the address you signed up with and ask us to delete your account. We will confirm and complete this within 30 days.
What we delete. Your account details, content, brand assets and the information we received from connected platforms. We cannot delete content that has already been published to your website, social media or other accounts, but you can remove it from those platforms directly.
What we keep. Records we are required to keep by law, such as invoices and payment records, which we keep for up to 6 years in a restricted area and do not use for anything else. We also keep a record of any marketing opt-out so that we do not send you marketing again (see ‘How long your personal data will be kept’ above).
Transferring your personal data out of the UK
We store your personal data on servers located in the UK and the European Economic Area (EEA), in London and Ireland. Some of our service providers, in particular our AI and image-processing providers, are based in or process personal data in the United States. We transfer personal data to them only where there is a lawful transfer mechanism in place, as described below. This does not cover content you ask us to publish to your own website, social media or other accounts, which those platforms handle as described in ‘Who we share your personal data with’ above. Our service providers, and where they process personal data, are listed at https://app.elvrabrandos.com/legal/subprocessors. Any new destinations will be shown there and notified to you in accordance with ‘Changes to this privacy policy’ below.
Under UK data protection laws, we can only transfer your personal data to a country outside the UK where: the UK government has approved that country as providing an adequate level of protection for personal data (known as ‘adequacy regulations’); there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law. Accordingly, where we transfer your personal data from the UK to:
the EEA (including our hosting in Ireland): we rely on the adequacy regulations made by the UK government in respect of the EEA countries; and
the United States and any other country outside the UK and the EEA: we rely on adequacy regulations where they apply (for the United States, the UK Extension to the EU-US Data Privacy Framework, also known as the UK-US data bridge, where the provider is certified under it) or otherwise on appropriate safeguards under the UK GDPR, namely the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, in our agreements with the relevant service provider.
In the event we could not or choose not to continue to rely on either of those mechanisms at any time we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative mechanism or exception provided by UK data protection law.
You can ask us for more information about the safeguards we use, including a copy of them, by contacting us (see ‘How to contact us’ below).
Your rights
You generally have the following rights, which you can usually exercise free of charge. For more information regarding these rights, please visit the Information Commission’s website at www.ico.org.uk.
| Access to a copy of your personal data | The right to be provided with a copy of your personal data. |
|---|---|
| Correction (also known as rectification) | The right to require us to correct any mistakes in your personal data. |
| Erasure (also known as the right to be forgotten) | The right to require us to delete your personal data—in certain situations (see ‘Deleting your data’ above). |
| Restriction of use | The right to require us to restrict use of your personal data in certain circumstances, e.g. if you contest the accuracy of the data. |
| Data portability | The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations. |
| To object to use | The right to object:
|
| Automated decisions | Where a significant decision about you is made solely by automated means (including profiling), the right to be told about it, to make representations about it, to have a person review it and to challenge it. We do not make any such decisions based on data collected by the Services. |
For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). You may also find it helpful to refer to the guidance from the UK’s Information Commission (also known as the ICO) on your rights under the UK GDPR.
Where we rely on your consent to use your personal data, you can withdraw it at any time by contacting us (see ‘How to contact us’ below). This does not affect anything we did with your consent before you withdrew it.
If you would like to exercise any of those rights, please email or write to us (see below: ‘How to contact us’). When contacting us please:
provide enough information to identify yourself (e.g., your full name and username) and any additional identity information we may reasonably request from you, and
let us know which right(s) you want to exercise and the information to which your request relates
We will respond within one month of receiving your request. We may extend this by up to two further months where your request is complex or you have made a number of requests, and we will tell you within the first month if we need to do so. The time limit is paused while we wait for any information we reasonably need to confirm your identity or to clarify your request.
Keeping your personal data secure
We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.
How to complain
Please contact us if you have any queries or concerns about our use of your information, or if you would like to make a complaint (see below ‘How to contact us’). We will acknowledge your complaint within 30 days of receiving it, look into it and let you know the outcome without undue delay. We hope we will be able to resolve any issues you may have.
You also have the right to lodge a complaint with the Information Commission, the UK’s data protection regulator (also known as the ICO).
The Information Commission can be contacted at https://ico.org.uk/make-a-complaint or telephone: 0303 123 1113.
Changes to this privacy policy
We may change this privacy policy from time to time. When we make significant changes we will take steps to inform you, for example via the Services or by other means, such as email.
We publish the current list of the platforms we connect to and of our service providers at https://app.elvrabrandos.com/legal/subprocessors, and we update it when we add a platform or provider. We will tell you before we begin using a new provider for a purpose that is materially different from those described in this policy and, where the law requires it, we will ask for your consent.
How to contact us
You can contact us by email or post if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.
Our contact details are shown below:
info@elvraaisolutions.com
ELVRA AI Solutions Ltd, 26 Field Farm Close, Stoke Gifford, Bristol, England, BS34 8XX
Data protection contact: Ed Mant, at ed.mant@elvraaisolutions.com
ELVRA AI Solutions Ltd is registered with the Information Commission (also known as the ICO) under registration number ZC288441.