Draft
Privacy policy
This policy explains what personal data we handle for ELOS and this website, why, who we share it with, how long we keep it, and the rights you have.
On this page
Who we are
ELOS is provided by [Legal entity name], registered at [Registered address] ("we", "us"). You can reach us about privacy at elos@sanshivashell.app.
Our two roles
- For content in a customer's workspace (people, services, documents, access records, Ask ELOS conversations), the customer is in control and we process it only on their instructions, as their processor (a "data processor" under the GDPR, a "data processor" engaged by a "data fiduciary" under India's DPDP Act, and a "service provider" under California law). If your employer uses ELOS and you have a question about your data in it, please contact your employer first; we will help them respond.
- For account, billing, website and support data, we decide how it is used, as controller (or data fiduciary).
What we collect
- Account data: name, work email, organization, role, and sign-in events.
- Workspace content: what customers and their tools put into ELOS, processed on the customer's behalf.
- Usage and security data: product events, audit records and technical logs (such as IP address and browser type) needed to run and protect the service.
- Support and sales communication: what you send us when you contact us.
- This website sets no cookies and uses no third-party analytics or advertising trackers. It is hosted by Cloudflare, whose servers keep short-lived technical logs for security and reliability.
- Demo requests: the name, work email, company and the optional details you enter in the demo form, kept for 24 months and then deleted. They are stored with Cloudflare, our website host, and passed to the ELOS service, hosted on Google Cloud, so we can set up your workspace. To limit abuse we keep a one-way hash of your network address for an hour's rate limit, never the address itself.
We do not collect sensitive categories of personal data on purpose, and we ask customers not to put them into ELOS unless they need to.
How we use it
- To provide, secure and support ELOS and this website.
- To run the account: sign-in, billing and service communication.
- To detect, investigate and prevent abuse, fraud and security incidents.
- To meet legal obligations.
We do not sell personal data, use it for targeted advertising, or use workspace content to train AI models.
Legal bases
Where the GDPR applies, we rely on: performance of our contract with you or your organization; our legitimate interests in securing and improving the service (balanced against your rights); compliance with legal obligations; and consent where we ask for it, which you can withdraw at any time. Under India's DPDP Act, we process personal data with consent or for the legitimate uses the Act allows, such as the purpose for which you provided it.
AI processing
Ask ELOS processes workspace content to answer questions, only within the asker's permissions and the data domains the workspace administrator allows. The question and the content retrieved for it are sent to an AI model provider to write the response, under terms that prohibit training on it. Details: AI and your data.
Sharing
- Sub-processors who host and operate parts of the service for us, under written agreements that bind them to our instructions and to confidentiality and security obligations. See sub-processors.
- Authorities where the law requires it. We push back on requests that are unlawful or overbroad, and tell the customer where we are allowed to.
- A successor in a merger or acquisition, under the same protections.
International transfers
Where personal data moves between countries, we use the safeguards the applicable law requires, such as the European Commission's standard contractual clauses and the UK addendum for data from the EU and UK, and we follow any restrictions the Government of India sets for transfers under the DPDP Act.
Retention
Workspace content is kept according to the retention settings the customer chooses, and deleted after the customer leaves, except where the law requires us to keep it. Account and billing records are kept for as long as the account is active and then for the period tax and accounting law requires. Technical logs are kept for a short, fixed period for security.
Security
We protect personal data with workspace isolation, access control, encryption and a tamper-evident audit log. See Security and trust. If a personal data breach affects you, we notify the customer, the people affected and the authorities as the applicable law requires.
Your rights
Wherever you are, you can ask us for a copy of your personal data, ask us to correct or delete it, and ask how it is used. Contact elos@sanshivashell.app. We verify requests before acting on them and respond within the time the applicable law sets. We will not treat you differently for exercising your rights.
India (Digital Personal Data Protection Act, 2023)
As a data principal you can obtain a summary of your personal data and how it is processed, have it corrected, completed, updated or erased, withdraw consent, and nominate another person to exercise your rights. For grievances, contact our grievance officer at elos@sanshivashell.app. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
European Union and United Kingdom (GDPR)
You have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent. You can complain to your local data protection authority or, in the UK, the Information Commissioner's Office. [EU/UK representative, if required]
California (CCPA as amended by the CPRA)
California residents can ask to know the categories and specific pieces of personal information we collect, and to delete or correct it. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. You can use an authorised agent, and we will not discriminate against you for exercising these rights.
Children
ELOS is a workplace product and is not directed at children. We do not knowingly collect children's personal data.
Changes
We will post changes here with a new effective date, and tell customers in advance of material changes.
Contact
[Legal entity name] · [Registered address] · elos@sanshivashell.app
Related: Terms of service · Sub-processors · AI and your data