Privacy Policy

1. Information we collect

• Contact & business information you enter into our intake and quote forms, for example your name, business name, email address, what your business does, and what you want built. This is the core of what you give us and it may include whatever details you choose to add.
• Account information if you create an account: your name and email address. On the Elevare iOS app you may create an account with an email address and a password, or sign in with Apple or with Google. When you choose a password, it is set and checked by Supabase, our authentication provider, which stores it only as a one way hash. Elevare never sees, stores, or is able to recover your password. On elevarestudio.co you may also sign in with a one time link sent to your email address, with a passkey on your own device, or with Google or Apple where those options are offered.
• Payment information. We invoice our percentage through Square. Your full card number never touches our servers. We receive limited, non-sensitive details such as the amount, an invoice or customer identifier, the email on the receipt, and whether a payment succeeded. Payments your own customers make on the site we build for you go directly to your own payment processor, in your own account. We never hold that money. Tap card orders are paid on a checkout page run by Square; Section 11 says what we receive from it.
• Web subscriptions, on Square. If you buy an Elevare plan on the web, at app.elevarestudio.co, you pay on a checkout page run by Square, not by us. You give Square your card details and the contact details its page asks for there, and we fill in the email address on your Elevare account for you. Square keeps your card and those details under its own privacy policy. We never see or store your card number. We keep a record of each checkout you start (the plan, monthly or annual, whether it began with a free week, and the identifiers Square gives the payment link, the order and the subscription it created), and on your subscription record we keep Square’s identifiers for your subscription and for you as its customer, the plan you bought, Square’s status for it, and the dates of the current billing period. The checkout records and the subscription record are deleted with your account. We also keep a log of each change Square tells us about: its identifier and kind, the subscription, when it arrived, and the account identifier it was for. That log is not deleted when you delete your account, and it still holds the identifier your account had.
• Consent records. When you accept our Terms at checkout, we record the terms version and a timestamp with your order so we can show what you agreed to.
• Usage and device data, on elevarestudio.co only. Pages visited, approximate location from IP, referral source, timestamps, and similar analytics, collected to understand and improve the Site. The Elevare iOS app collects none of this.
• Cookies & similar technologies: see Section 6.

Bot check. On elevarestudio.co, our sign-in and sign-up forms run a bot check from Cloudflare Turnstile. The Elevare iOS app runs the same check, as described below. On the site it runs in your browser before the form is submitted, and Cloudflare sees your IP address and signals about your browser in order to decide whether you are a person. It does not ask you to identify photographs, and we do not receive anything back from it except a one time token showing the check was passed.

The Elevare iOS app

• Your email address. Held by Supabase as part of your sign in, for as long as your account exists. It is how the app knows which business’s records to show you, and it is the address shown on the Account screen under “Signed in as”.
• Your name, in two cases. If you sign in with Apple and choose to share your name, Apple gives it to us once and we store it on your account. Separately, the trading name you enter during setup is often a sole trader’s own name, so we treat that field as personal data too. Both are kept for as long as your account exists.
• Your account identifier. A random identifier Supabase assigns to your account. Every record the app reads for you is looked up by it. It is kept for as long as your account exists, except in the three purchase logs described in this section, which keep it afterwards.
• What you tell us about your business. Your trading name, what kind of business it is, what you want from your site, and, if you add them, your website address, the town or city you work in, your time zone and your currency, or that you have no business yet. It is kept for as long as your account exists.
• Your business details, from a public web lookup. If you allow it, Elevare looks up your business on the public web, as described in section 3, and keeps what it found: a short summary and a list of details, each with the address of the public page it came from. You can confirm each detail or mark it wrong, and we keep your answers. A detail is kept only if it came from a page that was actually retrieved during the lookup. If you tell the app you have no business yet, nothing is looked up and we keep only what you typed. This is deleted with your account.
• Your answer about sharing. When you answer the app’s question about sending information to Anthropic, described in section 3, we save your answer to your account, with the version of the question you answered, what it covers and when. If you later say no, we mark the earlier answer as withdrawn rather than deleting it. Your phone also keeps a copy. These records are deleted with your account.
• Your Boardroom readings. On a plan that includes the Boardroom, each weekly reading is kept, with the sources it cites, so that you can read it again. Readings are deleted with your account.
• Subscription records. If you subscribe inside the Elevare iOS app, Apple processes the payment and tells our server that it happened. We store an identifier Apple assigns to your subscription, which product you bought, whether it is live, and the dates of the current billing period. We never receive your card number and we never receive your Apple Account credentials. Your name and billing address are held by Apple, not by us. We keep the subscription record for as long as your account exists, and it is deleted with your account.
• A log of purchase events. Each time Apple, or the app on Apple’s behalf, tells our server about a purchase, a renewal or another change to a subscription, we keep one entry recording Apple’s identifiers for that event and for the subscription, the product, the kind of event, whether it was a test purchase, when it arrived, and the account identifier it was for. This log is our record of what Apple told us. It is not deleted when you delete your account, and it still holds the identifier your account had.
• One time purchases in the app. If you buy something once inside the app, such as extra use of the assistant or a pack of work from Elevare, Apple processes the payment, as it does for a subscription. We keep one entry per purchase: the product, what kind of purchase it was, Apple’s identifiers for the transaction, whether it was a test purchase, when it was bought and when we recorded it, and the account identifier it was for. Entries are never changed or removed, and they are not deleted when you delete your account. If the purchase is a pack of work, we also keep a record of that work’s progress, which is deleted with your account.
• Notifications. This version of the app does not ask to send you notifications and stores no push token. If a later version asks and you say yes, it will store a push token for your device against your account, so that Expo and Apple can deliver the notifications you chose to that phone. A push token identifies the app on one device; it is not an advertising identifier. It is deleted with your account.
• A bot check when you use email to sign in. Before the app sends an email and password sign in or sign up, a request for a new sign up code, or a request to reset your password, it opens a page from elevarestudio.co that runs Cloudflare Turnstile. Cloudflare sees your IP address and signals about your device and the in-app web page at that moment, in order to decide whether you are a person, and we receive only a one time token showing the check was passed. That page runs nothing else: no analytics, no page view counter, no cookie prompt and no advertising pixel. Signing in with Apple or with Google does not use it.
• Nothing else is recorded about how you use the app. Apart from when each assistant, Boardroom or lookup request ran and what it cost, and, on the free plan, how many questions you have asked this month, both described in section 3, it does not record which screens you open, what you tap, how long you stay, your device’s location, or your advertising identifier. There is no analytics software, no crash reporter, and no advertising software in the app at all.

Our Services are for businesses; please do not send us sensitive categories of personal data (such as health, biometric, or government-ID information) unless we specifically request it for a deliverable.

2. How we use your information

• To provide, deliver, and support the Services you request.
• To make, program, ship and support tap cards you order, and to run their short links (Section 11).
• To process payments, prevent fraud, and send receipts.
• To generate and refine deliverables (which may involve AI processing; see Section 3).
• To communicate with you about your account, orders, and support requests.
• To operate, secure, analyze, and improve the Site and Services.
• To send marketing communications where permitted. You can opt out at any time (Section 7).
• To comply with law and enforce our Terms.

3. Sub-processors and third-party services

We share information with the service providers below strictly to run the Services. Each processes data under its own terms and privacy policy.

The Elevare iOS app checks for updates when it starts. That check reaches Expo, which operates the update service, and Expo sees your device’s IP address and basic device information. Elevare does not receive or store that information.

If you sign in with Apple, Apple tells us an identifier for your account and, only if you choose to share it, your name and an email address. If you choose Apple’s private relay address, we never see your real one.

The Elevare iOS app can send information to an AI model, and it asks you first. Three things in the app use Anthropic, the company that makes Claude: the assistant, where you type questions about your business; the Boardroom, which writes a short reading of where your business stands (on a plan that includes it); and a lookup of your business on the public web. None of them runs until you have said yes on the app’s sharing screen. Your answer is saved to your Elevare account, and our server checks it before every request, so a request without a yes is refused before anything leaves. Every request goes out from our own server, not from your phone, and Anthropic sends the answer back.

When you use the assistant or the Boardroom, Anthropic receives Elevare’s own instructions and: the questions you type, with the earlier messages in the same conversation; your business profile, meaning your business name, the kind of business you told Elevare you run, the goals you chose, your website and location, and whether you said you have no business yet; your business details from the lookup, meaning their summary, each detail, whether you confirmed it, and where it came from, leaving out any detail you marked wrong; and your plan, its status and the dates of its current period. If Elevare builds your site, it also receives your account record, meaning the name your account is filed under, its status and stage, your preview link, and the dates it was opened and approved; your build record, meaning what is being built, its status, progress, milestone, delivery estimate, live address, revisions and dates; and your most recent updates from your Elevare team, up to 40, each with its headline, kind and date. Your email address and your password are never sent. Our server does not store the questions you type or the answers you get; the only answers we keep are the Boardroom readings described in section 1.

The lookup uses public web data only. When Elevare looks up your business, Anthropic receives the business name, website and location you typed, and nothing else about you. It then searches the public web and reads a small number of public pages, and sends back details about your business, each with the page it came from. The lookup is given no access to your Elevare account or to anyone else’s. We keep only the details whose page was actually retrieved, and you can confirm each one or mark it wrong. If you tell the app you have no business yet, nothing is looked up and nothing is sent.

For each request we record when it ran and what it cost, against your account, so that a monthly limit can be enforced; on the free plan we also count how many questions you have asked this month. Those records hold times, sums of money and a count, not anything that was sent, and they are deleted with your account. If you say no, nothing is sent to Anthropic for you and the assistant, the Boardroom and the lookup do not run for you. The rest of the app works the same. Anyone else with access to your business’s Elevare account is asked separately, and if they say yes, your account record and your updates from your Elevare team are sent when they use the assistant or the Boardroom. You can change your answer at any time in the app, under Account, then Privacy.

We may also disclose information to comply with law, respond to lawful requests, protect our rights, or in connection with a business transfer (such as a merger or sale). We do not sell your personal information and do not share it for cross-context behavioral advertising in exchange for payment.

4. Data storage and security

Data is stored with Supabase and Vercel. Connections are encrypted in transit (TLS). Passwords are handled entirely by Supabase and are stored only as one way hashes. Elevare does not hold your password in any form and cannot recover it for you or for anyone else. Card processing is handled entirely by Square, a PCI-DSS compliant processor. No method of storage or transmission is 100% secure, so we cannot guarantee absolute security.

Abuse limits. To stop automated abuse, our forms, sign in pages and tap card short links limit how many requests can come from one network address in a short time. The counter that does this holds a scrambled form of the network address, never the address itself, is never linked to you, your account, a card or a tap, and is kept for about a day and then deleted.

5. Data retention

We keep personal information for as long as your account is active or as needed to provide the Services, and afterwards as needed to meet legal, tax, accounting, fraud-prevention, and record-keeping obligations (for example, transaction and consent records). Aggregated or de-identified data that no longer identifies you may be kept indefinitely. When you ask us to delete your account, we remove or de-identify your personal data within a reasonable period (typically within 30 days), except records we must retain by law. Section 11 says how long tap card orders, links and tap records are kept.

Deleting your account from the Elevare iOS app

You can delete your Elevare account from inside the app, on the Account screen, under “Delete your account”. It happens straight away and it cannot be undone.

A web subscription is stopped first. If you have an Elevare plan bought on the web through Square, deletion first asks Square to stop every such subscription tied to you, and goes ahead only once Square’s own answer shows each one stopped. Stopping a subscription ends future billing; it does not charge or refund anything. If Square does not confirm, nothing is deleted and you are told, so that your account is never removed while a subscription is still billing you. A subscription bought inside the app is billed by Apple, not by us, and deleting your Elevare account does not cancel it: cancel it in your Apple Account settings.

When it runs, your sign in is destroyed, along with every session and every sign in method attached to it, so your credentials stop working immediately. The business details you entered about your business, your business details from the lookup, your answers about sharing, your Boardroom readings, your usage records, your web checkout records, your profile, your notification registrations and your subscription record are all removed with it. We then read your account back to confirm it is gone before the app tells you it is. If we cannot confirm it, the app says so rather than telling you it worked.

Business records that are not about your account are not deleted by this. Invoices and payment records are kept to meet our tax, accounting and record keeping obligations. Three purchase logs described in section 1 are also kept, and each still holds the identifier your account had: the log of Apple purchase events, the record of one time purchases in the app, and the log of changes Square told us about.

One case cannot be done automatically. If you have signed an agreement with us, that signature record blocks the automatic deletion, because deleting it would destroy the evidence of what you agreed to. The app will tell you so and give you a phone number, and a person will handle the request.

6. Cookies and Do-Not-Track

We use cookies and similar technologies for: essential purposes (authentication and session security); analytics (Vercel Analytics, which is designed to be privacy-friendly and does not use cross-site advertising cookies); and advertising measurement (the Meta Pixel, which helps us measure and improve our own ad campaigns). You can control cookies through your browser settings; blocking essential cookies may break parts of the Site. Because there is no common industry standard, we do not currently respond to browser “Do-Not-Track” signals.

The Meta Pixel loads only after you choose “Allow” in our cookie banner. Choosing “No thanks”, or ignoring the banner, keeps it off. If your browser sends a Global Privacy Control signal, we treat it as “No thanks”: the Pixel does not load and the banner does not ask. Your answer is stored in your browser; to change it, clear this site’s data in your browser and the banner will ask again.

The Cloudflare bot check on our sign-in forms runs inside a frame served by Cloudflare, so any storage it needs belongs to Cloudflare’s own domain rather than to this one. Clearing this site’s storage in your browser does not clear it.

A tap card short link sends your phone straight on to the card owner’s chosen link. That redirect places no analytics, advertising or tracking cookie and runs no pixel (Section 11).

7. Marketing email and your choices

We send transactional emails (receipts, account and project updates) that are part of the Services. We may also send marketing emails. In line with the CAN-SPAM Act, every marketing email identifies us, includes our physical mailing address, and has a clear unsubscribe link. You can opt out at any time and we will stop sending marketing email promptly. You can also opt out by emailing owner@elevarestudio.co. Opting out of marketing does not stop transactional messages you need to use the Services.

8. Your privacy rights

Depending on where you live, you may have some or all of the following rights. To exercise any of them, email owner@elevarestudio.co. We will verify your request and respond within the time the law allows, and we will not discriminate against you for exercising a right.

California (CCPA/CPRA)

• Know what personal information we collect, use, and disclose.
• Access a copy of your personal information and request deletion.
• Correct inaccurate personal information.
• Opt out of “sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined, so there is nothing to opt out of, but you may still contact us.
• Limit use of sensitive personal information (we do not use it for such purposes).

Connecticut (CTDPA)

ELEVARESTUDIO LLC is based in Connecticut. If you are a Connecticut resident, the Connecticut Data Privacy Act gives you the right to confirm whether we process your personal data and to access it, to correct inaccuracies, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects. We do not sell personal data and we do not use it for profiling of that kind. We do use advertising cookies for targeted advertising only after you accept them in our cookie banner, and you can withdraw that at any time by declining or clearing the choice stored in your browser.

To exercise a right, contact us at owner@elevarestudio.co. We respond within 45 days and may extend once where the law permits. If we decline, you may appeal by replying to our decision, and we will respond to the appeal within 60 days. If the appeal is denied you may submit a complaint to the Connecticut Attorney General.

Other U.S. states

Several other states have comprehensive privacy laws granting similar rights of access, correction, deletion, portability, and opt-out. We extend the rights described in this section to all U.S. residents regardless of state, so you do not need to determine which law applies to you before contacting us.

EEA / UK (GDPR)

Our Services are directed to U.S. businesses, but if you are in the EEA or UK you may have rights to access, correct, delete, restrict, or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time. Our legal bases are typically performance of a contract, our legitimate interests in operating and improving the Services, consent (for certain marketing/cookies), and compliance with legal obligations.

9. Children

The Site and Services are intended for businesses and adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

10. Data from your own website’s customers

If we build or host a site for you, your customers’ personal data (from contact forms, bookings, or orders) belongs to you and you are the controller of it. You are responsible for giving your customers a privacy notice and honoring their rights. We process that data only to run your site on your behalf.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date and version above, and material changes will be posted here.

13. Contact

For privacy questions or to exercise a right, contact ELEVARESTUDIO LLC at owner@elevarestudio.co, 36 Russ Street, 3rd Floor #1448, Hartford, CT 06106.