This policy explains what personal data Elastcode Ltd, a company registered in Cyprus, of Paphos, Cyprus ("Elastcode", "we", "us") collects, why, how long we keep it, and the rights you have over it. It covers our websites and the Elastbiz cloud service. If you run Elastbiz on your own server, your data stays on your infrastructure and we do not receive it at all.
The short version. On our website we store a random first-party identifier and the source you arrived from, so we can count visits and attribute them to a channel. We never write your IP address to our records and we use no third-party advertising or analytics pixels. In the cloud service we process your account details, whatever you put into your workspace, payment records through Stripe, and the content of AI requests you ask us to run.
We act as a controller for personal data about website visitors, prospects and the administrators of customer accounts. We act as a processor for the business data that a customer puts into their Elastbiz workspace — their customers, orders, invoices, files, mail and chat. In that case the customer is the controller and decides what is stored; we process it on their instructions under a data processing agreement.
| Data | Why | Basis |
|---|---|---|
eb_vid — a random identifier generated in your browser |
To count distinct visits rather than raw page loads | Consent |
eb_ref — the first traffic source you arrived from |
To attribute a signup to the channel that produced it | Consent |
| Page path and referring URL | To understand which pages lead to signups | Consent |
| Email address, if you write to us or subscribe | To answer you | Contract / legitimate interest |
What we deliberately do not collect: we do not write your IP address into our visit records, we set no third-party cookies, and we embed no advertising, social or analytics pixels. The two identifiers above are stored in your browser's local storage on our own domain and are never shared with another company.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting for the cloud service | European Union (Germany) |
| Stripe | Payment processing and invoicing | EU / United States |
| Anthropic | AI model inference for AI features | United States |
Email for the service is delivered by our own mail infrastructure, so no third-party email provider processes your messages. Where a transfer outside the EEA occurs, it is covered by Standard Contractual Clauses. A current sub-processor list is available on request.
Self-hosting removes this entirely. If you run Elastbiz on your own server under the Elastic License v2, your data never reaches us and none of the sub-processors above are involved.
You have the right to access your data, correct it, have it erased, restrict or object to its processing, and receive it in a portable format. Where processing relies on consent, you may withdraw it at any time. Write to hello@elastbiz.com and we will respond within one month.
If you believe we have handled your data improperly you may complain to the Cypriot supervisory authority, the Office of the Commissioner for Personal Data Protection, or to the authority in your own country of residence.
Access to workspace data is governed per partition and per credential rather than granted account-wide. Traffic is encrypted in transit. Administrative access is limited to the people who need it to operate the service.
Our services are not directed to children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
If we change this policy materially we will say so on this page and, for account holders, by email. Questions, requests and data protection matters: hello@elastbiz.com. See also our GDPR statement, Terms of Service and EULA.