Skip to content

Privacy notice

What personal data Elara One collects about visitors, customers and their staff, why, how long we keep it and the rights you have.

Last updated

Draft — under legal review. This is a working draft. It may change before it takes effect, and the values marked in brackets are still to be confirmed.

In short

We collect what we need to run this website, answer enquiries, provide the service and bill for it. We never sell personal data and we do not run advertising trackers on elaraone.app.

For the shoppers, leads and contacts in a store that runs on Elara One, the store is in charge of that data and we process it on its behalf, under our data processing agreement.

You can ask to see, correct or delete your data at any time by emailing [email protected].

Who we are

Elara One is a trading name of Elara Labs Ltd, a company registered in England and Wales with company number 17541993, whose registered office is at 128 City Road, London, United Kingdom, EC1V 2NX.

In this notice "we", "us" and "our" mean Elara Labs Ltd. We are the controller of the personal data described here, which means we decide why and how it is used. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].

Privacy questions
[email protected]
Post
Elara Labs Ltd, 128 City Road, London, United Kingdom, EC1V 2NX
Everything else
[email protected]

Our two roles

Elara One is a platform businesses use to run a shop, capture leads and talk to their customers. That gives us two different roles under data protection law.

  • Controller, for our own business. This notice covers the people we deal with directly: visitors to elaraone.app and its documentation, people who contact us or book a demo, our customers' account and billing contacts, the staff who sign in to a store's admin, and people on our mailing list.
  • Processor, for our customers. When a business uses Elara One, the details of its shoppers, leads and contacts are its data. The business is the controller and decides how they are used; we only process them on its instructions, under our data processing agreement.

What we collect

When you visit our website

  • Technical details your browser sends with every request, such as your IP address, browser type and the page you asked for. Our servers use them to deliver the page and keep the site secure.
  • Signals from Cloudflare Turnstile when you send one of our forms, used only to tell a person from an automated bot.
  • Your light or dark theme choice, stored in your own browser if you pick one. See the cookie notice.

When you contact us or book a demo

  • Your name, work email address, phone number if you give it, company name, website and the message you send.
  • Notes of our conversations and any follow-up emails.

When your business signs up

  • The business name, the store address you choose, your website, and the name and email address of the person signing up.
  • Billing details: billing contact, business address and VAT number if you have one. Card details are entered on Stripe and held by Stripe; we never see the full card number.
  • Records of your plan, invoices, payments and usage.

When you sign in to a store admin

  • Your name, email address, role and permissions.
  • Sign-in security data: your password (stored only as a one-way hash), two-step sign-in settings, passkeys, recovery codes, and the browsers you have signed in from, so we can email you when a new device signs in.
  • A record of actions you take in the admin, which forms part of the store activity log.

When you hear from us

  • Your email address and your preferences, including whether you have unsubscribed.

How we use it, and our lawful basis

UK data protection law requires a lawful basis for each use of personal data. These are ours.

Purpose
Showing you this website and keeping it secure
Data
Technical request details, Turnstile signals
Lawful basis
Legitimate interests: running a safe, working website
Purpose
Answering enquiries and arranging demos
Data
Contact details, your message, our notes
Lawful basis
Legitimate interests: replying to people who ask us; or steps you asked for before a contract
Purpose
Providing the service and managing your account
Data
Account and sign-up details
Lawful basis
Contract with your business
Purpose
Billing, invoices, tax and accounting
Data
Billing details, invoices, payment records
Lawful basis
Contract, and our legal obligations under tax and company law
Purpose
Securing staff sign-in: two-step sign-in, passkeys, new-device emails
Data
Sign-in security data, device records
Lawful basis
Legitimate interests: protecting stores and their customers from account takeover
Purpose
Service emails: security alerts, usage notices, billing and changes to the service
Data
Name, email address
Lawful basis
Contract, and legitimate interests in keeping you informed
Purpose
Product news and marketing emails
Data
Name, email address, preferences
Lawful basis
Consent, or for existing customers the soft opt-in; for business addresses, legitimate interests. You can unsubscribe in one click.
Purpose
Improving the service
Data
Aggregated usage information
Lawful basis
Legitimate interests: making the product better
Purpose
Meeting legal duties and defending legal claims
Data
Whatever is relevant to the matter
Lawful basis
Legal obligation, or legitimate interests

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to what the purpose needs. You can object at any time (see your rights).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Marketing emails

We send product news only to people who asked for it, to existing customers about similar services (the "soft opt-in" under the Privacy and Electronic Communications Regulations), and to business addresses where that is lawful. Every marketing email has a one-click unsubscribe, and we keep a short record of your address after you unsubscribe so we never email you again by mistake.

We never sell or rent your details, and we do not upload them to advertising platforms.

Who we share it with

We share personal data only with:

  • Our sub-processors, the companies that host and run parts of the service for us, such as Vultr (hosting), Cloudflare (network, spam checks and encrypted backups), Stripe (billing) and Mailgun (email). The full list, with what each does and where, is on the sub-processors page.
  • Professional advisers such as accountants, lawyers and insurers, under a duty of confidentiality.
  • The police, regulators, courts or other authorities, where the law requires it.
  • A buyer or investor, if all or part of our business is sold or reorganised, under confidentiality and only as far as needed.

Each sub-processor is bound by a written contract that limits it to our instructions and requires it to keep the data secure.

Google, Microsoft and Meta accounts you connect

A store's staff can connect their own Google, Microsoft and Meta accounts to Elara One. We only reach an account after someone chooses to connect it, we only ask for the permissions the features they switch on need, and we only use what we receive for that store.

Account
Gmail, Outlook and Microsoft 365 (a staff member's own or a shared mailbox)
What we access
Email messages in the mailbox, and permission to send from it.
What we use it for
We keep only messages where someone else on the message is a contact in the store's CRM, or works at a company in it. Mail between staff, from no-reply senders, or with people the CRM does not know is never stored. Kept messages appear on the contact's timeline and are used to notice replies, and the mailbox sends the one-to-one emails the staff member writes in the CRM.
Account
Google Calendar, Outlook calendar
What we access
Calendar events, and permission to create and change them.
What we use it for
Meetings with CRM contacts appear on their timeline, and busy times are used for booking pages. Private events count only as busy time; no details are stored.
Account
Google Ads, Microsoft Advertising, Meta (Facebook and Instagram)
What we access
The ad accounts, pixels, conversion actions, Pages and lead forms the store chooses, and their spend reports.
What we use it for
Sending the store's sales and leads back as conversions (only with the shopper's consent), reporting ad spend, keeping audiences of customers who agreed to it, and bringing lead-form answers into the CRM.

For data from Google, and in the same way for data from Microsoft and Meta:

  • We use it only to provide and improve the features described above, for the store that connected the account.
  • We do not transfer it to anyone else, except where that is needed to provide those features (our hosting sub-processors store it for us under contract), to comply with the law, or as part of a merger, acquisition or sale of our business, with the data still protected by these commitments.
  • We never use Gmail, Outlook or calendar data to serve, target or measure advertising, and we never sell any of it.
  • We do not use it to decide anyone's creditworthiness or for lending.
  • No one at Elara One reads it, unless the user asks us to and agrees (for example, for a support question about a particular message), it is needed to investigate security or abuse, the law requires it, or it has been aggregated and anonymised for running the service.
  • We do not use it to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.

Sign-in tokens for these accounts are encrypted with their own key and stored in London with the rest of the store's data. Disconnecting an account stops our access at once and deletes our tokens. Messages, meetings and leads it already brought in stay with the store until the store deletes them. Our deleting your data page explains how.

Where it is processed

Our application and live databases run in London, on UK servers. Nightly backups are encrypted on our own servers before they leave them and are kept in Cloudflare R2 storage with EU jurisdiction; Cloudflare holds them but cannot read them. A separate encrypted copy for recovery to a point in time is kept in UK storage.

Some sub-processors, including Stripe, PayPal and Twilio, may process data outside the UK, including in the United States. The UK recognises the EU as giving adequate protection. Where data goes to a country without UK adequacy regulations, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") where the recipient is certified. You can ask us for a copy of the safeguards that apply.

How long we keep it

We keep personal data only as long as the purpose needs, then delete it or make it anonymous.

Data
Enquiries and demo requests that do not lead to an account
How long
[24 months after our last contact — confirm]
Data
Customer account and contract records
How long
While the account is open, then six years, the period in which a legal claim can be brought
Data
Invoices, payments and other accounting records
How long
Six years after the end of the financial year they belong to, as tax law requires
Data
Store activity log, including staff actions in the admin
How long
730 days (about two years), then deleted automatically
Data
Records of browsers you have signed in from
How long
Up to 400 days after the browser was last used to sign in
Data
Application logs (requests to our servers and errors)
How long
14 days. They never record the query string or a visitor's IP address.
Data
Nightly encrypted backups
How long
14 days, then deleted automatically
Data
Point-in-time recovery copy
How long
Always covers at least the last 14 days and is deleted a week at a time, so data stays in it for up to 22 days
Data
Unsubscribe records
How long
For as long as we send marketing email, so we never contact you again by mistake
Data
Security reports and the related correspondence
How long
[24 months — confirm]

Backups are used only to recover from data loss. If we ever restore from one, every erasure carried out since that backup was taken is carried out again before the restored data is used, so a restore never brings deleted data back into use.

How we protect it

Every store has its own database. Two-step sign-in is required for every staff account, and backups are encrypted before they leave our servers. Our security page explains the measures in plain English, and how to report a vulnerability.

Your rights

Under the UK GDPR you have the right to:

  • Be informed about how your data is used, which is what this notice is for.
  • Access the personal data we hold about you, and receive a copy.
  • Rectification: have inaccurate data corrected or incomplete data completed.
  • Erasure: have your data deleted where there is no good reason for us to keep it.
  • Restrict how we use your data, for example while a complaint is looked into.
  • Data portability: receive data you gave us in a machine-readable format, or have it sent to another organisation.
  • Object to our use of your data based on legitimate interests, and to direct marketing at any time.
  • Withdraw consent at any time, where we rely on it. This does not affect what we did before.

To use any of these rights, email [email protected]. We may ask you to confirm your identity. We reply within one month, and tell you if a complex request needs up to two more. There is normally no charge.

Complaints

If you are unhappy with how we have handled your data, please tell us first at [email protected] so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint (opens in a new tab), or by phone on 0303 123 1113.

Children

Elara One is a service for businesses. Our website and service are not aimed at children, and we do not knowingly collect personal data from anyone under 18 for our own purposes.

Changes to this notice

We will update this notice when our use of personal data changes, and change the date at the top. If a change matters to you, for example a new purpose, we will tell customers by email before it takes effect.