Privacy Policy

This policy explains how ELIM GROUP LLC ("estype", "we", "us") handles personal data when you visit estype.com, write to us, buy a plan, or use the estype service at app.estype.com, api.estype.com and your workspace address. It is written to meet the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR") and the EU General Data Protection Regulation 2016/679 ("EU GDPR"). Words like "personal data", "controller", "processor" and "processing" have the meaning those laws give them.

1. Who we are

estype is a typed data platform: a headless CMS, integrations, analytics, a CLI and an API in one workspace. The service is provided by ELIM GROUP LLC. We are a small team and we do not have a designated Data Protection Officer; our privacy contact handles every data protection question and request:

• Privacy and data protection: privacy@elim.io
• Legal notices: legal@estype.com
• Security reports: security@estype.com
• Everything else: hi@estype.com

2. Our two roles: controller and processor

We handle personal data in two different capacities, and the rules differ for each.

• As a controller, we decide why and how data is used. This covers visitors to estype.com, people who write to us, account holders and the people who sign in to a workspace (their names, emails, sign-ins), and billing records. This policy describes that processing in full.
• As a processor, we handle data on behalf of our customers. Everything a customer puts into a workspace, or pulls into it from the systems they connect, is the customer's data: documents, form submissions and leads, job applications, financial transactions, task mirrors and any personal data inside them. The customer is the controller of that data and decides what goes in and why. We process it only to provide the service, under our Data Processing Addendum. If your data is in a customer's workspace, see section 14.

For purchases, Paddle.com is the Merchant of Record and acts as a separate, independent controller of the payment data it collects. Paddle is not our processor and we are not Paddle's. See section 8.

3. Personal data we collect

3.1 When you visit estype.com

This website sets no cookies of its own. We measure traffic with Cloudflare Web Analytics, which does not use cookies and does not track you across sites. Our servers keep ordinary request logs: IP address, date and time, the page requested, the referring page, and your browser's user agent. We use these logs to keep the site running and secure and to investigate faults. If you open the pricing page, Paddle's checkout script loads from Paddle's servers to show prices in your local currency and to run the checkout (see section 5).

3.2 When you write to us

The contact form on estype.com collects your name, email address, company (optional) and your message, together with your IP address, browser user agent and the time you sent it. The enquiry is stored in our own estype workspace and posted to the internal Slack channel and Notion database our team answers from. If you email us, we keep the email and our reply. We use this to answer you, to follow up on the conversation you started, and to keep a record of it.

3.3 When you have an account or a workspace login

• Account and workspace details: the workspace name and address you choose, the plan and its status, and the name and email address of the person who bought it.
• Sign-up details: the email address, company name, workspace address and plan you type on the sign-up form. We keep them until the confirmation link is used or, if it never is, for a week after it stops working. Once the workspace exists we keep the address and the date as the record that it has had its free trial.
• User details: for each person who signs in to a workspace, their name, email address, role (owner, editor, viewer or restricted share) and a password, which we store only as an argon2id hash and never in readable form.
• Credentials you give us: API keys we issue to you are stored only as SHA-256 hashes. Credentials you give us for your own systems (for example a Webflow token or a bank API token) are stored encrypted and used only to reach those systems for you.
• Activity and audit records: who made each content change and when, sign-ins, the runs of each integration (what was fetched, delivered or failed), and the IP address and browser of requests to the service.
• Support conversations: what you tell us when you ask for help, including in a shared Slack channel if we set one up with you.

3.4 When you buy a plan

Orders are processed by Paddle.com, our Merchant of Record. You enter your payment details in Paddle's checkout; card numbers never reach our servers, our logs or our database. Paddle passes back to us what we need to provide the plan: the subscription, its plan and status, the billing period, the buyer's name and email, the country, and an order reference. Paddle's handling of buyer data is described in its own privacy notice.

3.5 Data you put in your workspace

Content you create or upload, form submissions your sites receive, records pulled from the systems you connect, and files you store. We process this as a processor, on your instructions (section 2). We do not look at it except where needed to provide, secure or support the service, or when you ask us to, and we never sell it or use it for advertising.

3.6 Data from systems you connect

When you connect a source (for example Webflow, Ashby, Notion, Quire or a bank), estype receives the data that source holds for you, using the credentials you provide, and sends data on to the destinations you choose. Which data flows, and where, is set by you. Those services are your providers under your own contracts with them, not ours.

3.7 Security reports

If you report a vulnerability to security@estype.com, we keep your report, your contact details and our correspondence to investigate, fix and credit the finding if you want credit.

4. How we use it and our lawful bases

Under the UK GDPR and EU GDPR we need a lawful basis for each use of personal data where we are the controller. These are ours:

Where we rely on legitimate interests, we have weighed them against your rights and you may object (section 12). We do not process special category data (such as health or ethnic origin) as a controller, and we ask you not to send it to us. We do not profile you, and we do not build look-alike audiences from our customers' data.

5. Cookies and local storage

We use only what is strictly necessary to run the website and the service. There are no advertising cookies, no tracking pixels and no cross-site tracking. Because nothing here is used for advertising or analytics profiling, there is no cookie banner to accept.

Third parties. Cloudflare Web Analytics on estype.com counts page views without cookies. On the pricing page and during checkout, Paddle's script and checkout may use their own cookies or storage to operate the checkout and prevent fraud; Paddle explains this in its privacy notice. You can block or delete cookies in your browser settings; if you block the viewer_session cookie you will not be able to sign in.

6. AI, agents and automated decisions

• There is no AI model inside estype. We do not train any AI model on your data, and we do not send your data to AI providers.
• You can connect your own AI agents to estype through the CLI or API. They act with the credentials you give them, under your control and responsibility, and whatever they send to their own provider is governed by your agreement with that provider, not by us.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic actions in the service, such as suspending a workspace when a subscription is cancelled or rate limiting an API key, follow the plain rules in our Terms, and you can always ask a person to review them.

7. Email we send

The service itself does not send email today. When we write to you about your account, your trial or plan, an incident, a security matter or a change to our terms or this policy, a person on our team writes to you from our business email. These messages are part of the service and you cannot opt out of them while your account is open. Paddle sends receipts and invoices for your purchases.

We do not buy email lists and we do not add an address to a mailing list because it reached us some other way. If we start a newsletter or product announcements, we will ask first, say exactly what we will send, and include a working unsubscribe link in every message.

8. Who we share it with

We do not sell personal data, and we do not share it for advertising. We share it only with:

• Subprocessors and service providers that host and run the service for us: Google Cloud (hosting, storage and backups in the EU), Cloudflare (DNS, the network edge for customers' own domains, form bot checks, storage of files uploaded through job application forms, and the cookieless analytics on this site) and Slack (our internal operational alerts). The full list, with what each receives and where, is on our Subprocessors page. Each is bound by a written contract to use the data only to provide its service to us and to protect it.
• Paddle, as Merchant of Record and independent controller, for payments, invoicing, tax and refunds. Paddle's handling of buyer data is governed by its privacy notice.
• Tools our team works in: website enquiries are posted to our internal Slack channel and Notion database, and our business email provider carries the emails we exchange with you.
• Systems you connect. Sending data onward to them is the service you asked for. They are your providers, not our subprocessors.
• Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
• Authorities and others where the law requires it, or where disclosure is reasonably necessary to comply with a legal obligation or a valid legal request, to enforce our Terms, to detect and prevent fraud or security problems, or to protect the rights, property or safety of our customers, the public or us. Where we receive a request for customer workspace data, we refer it to the customer where we can and tell the customer unless the law forbids it.
• A buyer or successor, if all or part of our business is sold, merged or reorganised. The data would remain subject to this policy, and we would tell you before it becomes subject to a different one.

9. Where data is stored and international transfers

The service and its data are hosted on Google Cloud in the European Union: in Belgium (europe-west1), on disks replicated across two zones, with a continuous backup replica in Finland (europe-north1), and a weekly encrypted backup copy in Cloudflare R2 under its EU jurisdiction. Files uploaded to your workspace are stored in Belgium. Files uploaded through job application forms are held briefly in Cloudflare R2 in Western Europe until they are delivered.

Some data leaves the EU: our team and some providers (such as Slack and Cloudflare's global network, and Paddle in the United Kingdom) operate outside the European Economic Area, and ELIM GROUP LLC itself operates the service from outside the EEA and the UK. Where personal data is transferred from the EEA or the UK to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, together with the safeguards described in section 11. You can ask privacy@elim.io for a copy of the relevant safeguards.

10. How long we keep it

We keep personal data only as long as we need it for the purposes above:

You can delete content from your workspace at any time. We may keep data longer where the law requires it, or to establish, exercise or defend a legal claim, and only for that purpose.

11. How we protect it

Each customer's data lives in its own isolated database. All traffic is encrypted in transit with TLS. Credentials for your connected systems are encrypted with XChaCha20-Poly1305, and the key is held outside the database and outside the backups. API keys and passwords are stored only as hashes. Access to production is limited to the few people who operate it, and server access goes only through Google's Identity-Aware Proxy. Every content change is logged with who made it. The details are on our Security page and in Annex II of our DPA.

No system is perfectly secure. If a personal data breach affects you and is likely to put your rights at risk, we will tell you and the relevant authority as the law requires.

12. Your rights

Under the UK GDPR and EU GDPR, and subject to the conditions and exceptions those laws set, you have the right to:

• Access the personal data we hold about you and get a copy of it.
• Rectification: have inaccurate data corrected and incomplete data completed.
• Erasure: have your data deleted where there is no good reason for us to keep it.
• Restriction: ask us to pause the use of your data while a question is resolved.
• Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another provider. Workspace data can be exported directly from the app and the CLI.
• Object to processing based on our legitimate interests, and object at any time to direct marketing.
• Withdraw consent where we rely on it, without affecting what came before.
• Not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.
• Complain to a data protection authority (section 19).

We give these rights to everyone, wherever you live, to the extent we can, even where your local law does not require it.

13. How to exercise your rights

Email privacy@elim.io and tell us what you would like us to do. We will answer within one month. If a request is complex or we receive many, we may extend that by up to two further months, and we will tell you why within the first month.

• We may ask you to confirm your identity before acting, usually by replying from the email address on the account. We use the information you give us for this only to verify you.
• Someone you authorise can make a request for you; we will ask for proof of that authority.
• We do not charge a fee, unless a request is clearly unfounded or excessive, in which case we may charge a reasonable fee or decline and explain why.
• You will not be treated differently for exercising your rights.
• For data Paddle holds about a purchase (the invoice, the payment, the buyer record), contact Paddle through paddle.net. We cannot change or delete Paddle's records, and Paddle cannot change or delete ours.

14. If your data is in a customer workspace

If you submitted a form on a website built with estype, applied for a job through such a site, or appear in records a customer keeps in estype, that customer is the controller of your data and their privacy notice applies. We process the data only on their instructions. Please send your request to them; if you send it to us, we will pass it to the customer where we can identify them and help them answer it.

15. California and other US states

If you live in California or another US state with a consumer privacy law, you have rights similar to those in section 12: to know what personal information we collect, use and disclose, to access it, to correct it, to delete it, and to opt out of its sale or sharing.

• In the last 12 months we collected these categories of personal information: identifiers (name, email address, IP address), commercial information (the plan bought, from Paddle), and internet activity (request logs and activity in the service). The sources, purposes and recipients are those described in sections 3, 4 and 8.
• We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not use or disclose sensitive personal information for any purpose that would give a right to limit it.
• Where we process personal information on behalf of a customer, we act as that customer's service provider, and the customer handles your request.

To make a request, email privacy@elim.io. We will verify your request as described in section 13 and will not discriminate against you for making it.

16. Children

estype is a business service and is not meant for children. We do not knowingly collect personal data from anyone under 16 as a controller. If you believe a child has given us personal data, write to privacy@elim.io and we will delete it.

17. Links to other websites

Our website and documentation link to other sites and services, such as Paddle, GitHub and the services estype connects to. We are not responsible for how they handle personal data; read their own privacy notices before giving them yours.

18. Changes to this policy

We may update this policy as the service or the law changes. The date at the top shows when the current version took effect. If a change materially affects how we handle your personal data, we will email account owners before it applies and, where the law requires it, ask for your consent.

19. Contact and complaints

For anything about this policy or your data, write to privacy@elim.io. Legal notices go to legal@estype.com.

If you are unhappy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU or EEA, the data protection authority of the country where you live or work, or where you think the problem happened.