Privacy Policy

Who is responsible

Elevantro, established in Belgium and run by Bo Van Meervenne. Send privacy questions to bo@elevantro.com.

For our clients' accounts and their users, Elevantro is the controller. For the data of leads and prospects that a client processes through its campaigns, the client is the controller and Elevantro processes that data on the client's behalf.

What data the portal processes

• Your account: name, email address and the client you have access to.
• The client's campaign data: leads and prospects (name, business email address, job title, company, LinkedIn profile), their replies and the conversations about them, taken from the tools the client uses (ClickUp, Instantly, HeyReach, Google Sheets).
• Content you put in the portal yourself: replies to leads, notes and comments.
• Credentials of connected tools and mailboxes, always stored encrypted (AES-256-GCM).
• Technical data: error reports (Sentry) and, only if you consent, usage analytics (PostHog).

Connecting your mailbox with Google

A client can connect their business mailbox, so a reply to a lead sent from the portal leaves from their own address. Connecting through Google grants the portal exactly three permissions:

• openid and email address: to check that the account you sign in with is the address you entered.
• gmail.send: to send a reply that you wrote in the portal and chose to send. The portal never sends anything unless you press Send.

What the portal does, and does not do, with Google data

• The portal does not read your mailbox. It has no access to your inbox, your other email, your contacts or your calendar.
• It stores only your email address, an encrypted access token from Google and the replies you sent from the portal yourself, so your conversation with the lead stays complete.
• What the portal receives from Google (your email address and the access token) is not sold, not used for advertising, not shared with third parties except to provide the service, and not used to train AI models. It is not sent to any AI model.
• People at Elevantro do not read it, except with your explicit consent, where needed for security, or where the law requires it.
• Elevantro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access

You can disconnect at any time under Account in the portal (Disconnect). Disconnecting deletes the stored access token. You can also revoke access in your Google Account, under Security, Third-party apps and services; the token then stops working and the portal can no longer send anything on your behalf.

Where the data is stored and who processes it

Data is stored in the European Union: the database at Supabase (Frankfurt) and the application at Vercel (Frankfurt). Elevantro uses these sub-processors: Supabase (database, sign-in, storage), Vercel (hosting), Inngest (scheduled jobs), Upstash (abuse protection), Resend (email sent by the portal), Sentry (error reports) and PostHog (usage analytics, only with consent). In addition, the tools the client connects itself: ClickUp, Instantly, HeyReach and Google.

Incoming replies from leads are classified as positive or negative by an AI model (Anthropic). This applies to replies from the client's outreach tools, never to data from a connected Google mailbox.

How long data is kept

For as long as the engagement with the client runs. After it ends, the client's data is erased within 30 days, unless the client first asks for an export or the law requires longer retention. Older backups may still hold that data for a while; on request we erase it there too. An anonymous summary of the results, without personal data, may be kept.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. Send your request to bo@elevantro.com. If you are a lead of one of our clients, you can also contact that client directly. You may lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

Changes

If this policy changes, the new version is published on this page, with the date at the top.