Privacy Policy

People who create an account on the Service (business owners and their team members), visitors to our website, and people whose data our customers load into the CRM (their leads, contacts and customers).

For data a business loads or receives in its CRM (for example, its leads and conversations), that business is the controller and Elevate Hub Agency LLC acts as a processor: we process it only to provide the Service and according to its instructions. If you are a lead or customer of a business that uses Elevate Hub CRM, please direct your requests to that business; we will help if they ask us to.

Account data: name, email, phone, profile photo and password (handled in encrypted form by our authentication provider).

Business data: name, industry, website, logo, settings, sales team, products and services.

Data you load or receive in the CRM: leads and contacts (name, email, phone, source, campaign), conversations (Instagram, Facebook, WhatsApp, web chat, email and, when available, SMS and calls), notes, tasks, events, forms, content and files.

Billing data: plan, subscription status and payment history. Card details are processed directly by Stripe; we don't store them.

Integrations: when you connect external services (Google, Meta/ManyChat, Stripe or others), we store the required tokens or keys, encrypted.

Technical data: IP address, browser, device, pages visited, error logs and the cookies needed to keep you signed in.

Pixel and web chat: if a business installs our pixel or chat on its website, we collect visit and conversion events and chat messages on behalf of that business.

To provide and maintain the Service: show your CRM, reply to your leads with the AI Setter, send the emails and messages you set up, generate reports and run your automations.

To charge your subscription, support you, send service notices (security, billing, changes) and prevent fraud and abuse.

To improve the Service using aggregated usage metrics.

We don't sell your data or your leads' data, and we don't use it for our own or third-party advertising.

Jen AI, the AI Setter and other features use models from Anthropic (Claude) and Voyage AI. To generate each response we send those providers only the data needed. Under their commercial terms, they don't use it to train their models.

AI responses may contain mistakes: review them before relying on them for important decisions.

If you connect your Google account, Jen AI accesses your Google Calendar and Gmail only for the features you ask for: checking your calendar, creating events and sending emails from your account (always after your confirmation). We don't read your inbox: the Gmail permission is send-only.

We don't use Google data for advertising, we don't sell it and we don't transfer it to third parties except to the providers needed for those features (for example, the AI model that drafts a reply), to comply with the law or for security. No person reads it unless you allow it, for security or when required by law, and it isn't used to train general AI models.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What data we use: from Google Calendar, your events (title, date, time, guests and Meet link) and the ones you create from the CRM; from Gmail, only the emails you send from the CRM (recipients, subject, text and attachments); we don't access the emails you receive. We don't use aggregated or anonymized Google data for any other purpose.

Artificial intelligence: to draft the emails you send or your events, the necessary text is sent to Anthropic's AI model (Claude) through its API, which doesn't use that data to train its models. We don't use Gmail or Google Calendar data to develop, improve or train AI or machine-learning models, and we don't transfer it to services that do.

Protection: Google access tokens are stored encrypted (AES-256) in our database, all traffic is encrypted (HTTPS/TLS) and only the user who connected the account can use them; internal team access is restricted.

Retention and deletion: we don't keep copies of your emails; we only keep the events you bring into the CRM calendar, which you can delete anytime. When you disconnect Google we delete the tokens and revoke access; if you ask us to delete your account, we delete all your Google data within 30 days.

You can disconnect Google at any time in Integrations → APIs & services; when you do, we delete the tokens and revoke access.

Mobile information and SMS opt-in consent are not shared with third parties or affiliates for marketing purposes. This data is used only to send the messages the business and the recipient agreed to. Reply STOP to stop receiving SMS.

With providers that help us run the Service, under contract and only for that purpose: Supabase (database and authentication), Vercel (hosting), Stripe (payments), Anthropic and Voyage AI (artificial intelligence), Resend (email), Twilio (SMS and calls, when available), AssemblyAI (transcription), Apify (public social media and ad data), Meta and ManyChat (messaging, when you connect them) and Google (when you connect it).

If your business also hires Elevate Hub Agency LLC for marketing services, our agency team only sees your contact details and the work we do with you; it doesn't see your leads, sales or conversations unless you invite it from your settings.

We may also share data when required by law, to protect our rights or the safety of others, or in a merger or sale of the company (with prior notice).

We keep data while your account is active. If you cancel, you can export it and we delete it within 90 days, except what we must keep by law (for example, billing records). Backups are deleted on their normal cycles.

We use encryption in transit (HTTPS), encryption of stored keys and tokens, database-level isolation of each business's data and minimal internal access. No system is 100% secure; if we detect a breach that affects you, we will notify you as required by law.

You can request access to, correction, export or deletion of your data, and object to certain uses, by writing to support@elevatehubconnect.com. We will respond within 30 days (45 where the law allows).

California residents (CCPA/CPRA): you have the right to know what data we process, to delete and correct it, and not to be discriminated against for exercising your rights. We don't sell or share personal data for cross-context behavioral advertising.

If you are in the European Economic Area or the United Kingdom, you may also lodge a complaint with your data protection authority.

In the CRM we only use cookies needed to sign you in and keep you signed in. We don't use advertising cookies. The language is taken from your browser settings.

If a business installs our pixel on its website, that business is responsible for informing its visitors and, where required, obtaining their consent.

The Service is not directed to children under 16 and we don't knowingly collect their data.

Data is processed mainly in the United States. If you use the Service from another country, you agree to that transfer with the safeguards required by applicable law.

If we make material changes to this policy, we will notify you by email or in the CRM before they take effect.

Elevate Hub Agency LLC · support@elevatehubconnect.com