Privacy Policy

This privacy policy applies to website.eldris.ai and is operated by EldrisAi OÜ, an Estonian company registered under number 17298529 with its registered office at Ruunaoja tn 3, Tallinn, 11415, Estonia. We are the data controller for any personal information you submit through this site or any of its forms. The named contact for any privacy question is the founder, reachable by email at compliance@eldris.ai, by phone on 020 3996 2101, or through the Talk to Eldris chat on every page. We are an EU-established company (Estonia), and we treat the GDPR as the floor of our practice rather than the ceiling.

We collect only what we need to quote, deliver and support your website translation engagement. From the contact form we take your name, work email, current website URL, target markets, rough product count and your free-text message. We do not store IP addresses against form submissions. If you pay the activation fee online, the card form is Stripe's: your card details go straight to Stripe and never reach our servers, and we keep your name, email address, business name if you give one, billing address, the amount, and Stripe's reference for the payment. We use Google Analytics to count visits and see how the site is used. The site also carries one advertising measurement tool, the Meta pixel: the part of this policy headed Meta pixel says whether it is switched on today and exactly what it does. Our network-edge layer is Cloudflare, which inspects request metadata briefly for security and abuse-prevention purposes and does not retain it for marketing.

We use your information to respond to quote requests, deliver the migration and translation work you have engaged us for, send operational updates while your site is being built, and bill you accurately during your monthly engagement. We do not send marketing emails to anyone who has not explicitly opted in. The named processors we share data with are Cloudflare (edge security and DNS), Supabase (our database, hosted in EU regions), Resend (transactional email delivery), Stripe (card payments, only if you pay online), Google (Google Analytics, which counts visits), LiveKit (voice conversations in the Talk to Eldris drawer) and OpenAI (drafting replies to messages typed into the Talk to Eldris chat). Cloudflare, Supabase and Resend sit under written processor agreements with EU-standard data protection terms. We do not sell your data. Beyond these processors, the only other party that can receive anything from us is Meta, and only in the two ways set out in the next two parts of this policy: the Meta pixel, and customer lists and purchases.

This site uses a minimal cookie banner that loads on first visit. Functional cookies needed to make the site work — session, language, security — are set without consent because they are strictly necessary under GDPR Article 6. The site also loads Google Analytics, which sets its own cookies (such as _ga) to count visits and see how pages are used. The Meta pixel sets Meta's own cookies (_fbp and _fbc) only while it is switched on; the Meta pixel part of this policy says whether it is. We run no other advertising tracker: no TikTok pixel, no LinkedIn Insight Tag. Both load when you arrive. To turn the Meta pixel off in this browser, use the button under Meta pixel on this page. To stop Google Analytics in your browser, Google offers an opt-out add-on at tools.google.com/dlpage/gaoptout. The site's typefaces are loaded from Fontshare and Google Fonts, so those two services see your IP address when your browser fetches them. Stripe's payment form loads only if you reach the payment step, and Stripe may then set its own cookies, which it uses to take the payment and prevent fraud.

You have the full set of GDPR rights over any data we hold on you. The right of access — ask us what we hold and we will send it. The right of rectification — tell us what is wrong and we will correct it. The right of erasure — ask us to delete your record and we will, subject only to bookkeeping retention obligations. The right to restrict processing, the right to data portability, and the right to object to any specific processing activity. To exercise any of these rights, email compliance@eldris.ai or use Talk to Eldris on any page, marking it as a GDPR request and naming the right you are exercising. We respond inside 30 calendar days. We do not charge a fee for any standard request.

Quote requests where we did not win the business are deleted automatically 12 months after submission. Active client records are retained for the full duration of your engagement plus seven years afterwards, because UK and Estonian bookkeeping law requires invoice and contract records to be kept for that period for tax and audit purposes. Backups roll on a 90-day window, which means a deletion request takes up to 90 days to fully clear from backup snapshots. After seven years, archived client records are purged in their entirety. None of this data leaves our processor stack, except where the Meta parts of this policy say an email address may be shared with Meta in hashed form.

Our database (Supabase) runs in the EU-Frankfurt region. Cloudflare edge security operates globally but does not retain personal data at non-EU edges. Transactional email delivery (Resend) processes inside EU and US regions, covered by EU Standard Contractual Clauses for the US leg. Google Analytics, Stripe, LiveKit and OpenAI may process data outside the EU, and so may Meta where the Meta pixel or the customer-list matching described in this policy is in use. We are an Estonian-registered operator, not a US or UK entity, which means your data falls under direct EU jurisdiction without an adequacy bridge. We do not transfer personal data to any country outside the EU/UK without an SCC in place and a documented lawful basis.

We update this policy when our processing genuinely changes — a new processor, a new data category, a new retention window — and we update the last-updated date at the top of this page every time. Material changes that affect active clients are notified by email at least 14 days before they take effect, so you can object or close your account if you disagree. We do not use vague catch-all clauses about updates from time to time. Every revision has a date, a reason, and a record. Old versions are available on request by email to compliance@eldris.ai.

Privacy questions go directly to the founder by email to compliance@eldris.ai, or through Talk to Eldris on any page, marked as a privacy question. The founder personally reviews these requests and responds inside 30 calendar days, sooner in most cases. If you are unhappy with the resolution, you have the right to escalate to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) as our supervisory authority, or to your own national data protection authority if you are an EU resident outside Estonia. We would always rather resolve a concern directly first.