Privacy Policy
Effective 4 August 2026
1. Who we are
ELF Gate Ltd (Company No. 16755816, G12 Ferneberga House, Alexandra Road, Farnborough, GU14 6DQ, England) is the data controller for personal data processed through www.elf-app.com. Contact us about privacy at info@elf-app.com.
2. What we collect and why
- Account data — name, email, password (stored as a secure hash). Purpose: providing your account. Lawful basis: contract.
- Learning data — lessons completed, XP, streaks, level test results. Purpose: tracking your progress. Lawful basis: contract.
- Subscription & payment data — subscription status and subscription records. Card details are collected and stored by Stripe, not by us; we hold only Stripe references and payment status. Lawful basis: contract; retention of transaction records: legal obligation.
- AI coach & speech data — text you type to the coach, and short voice clips when you use speaking practice, are sent to OpenAI to generate responses and transcriptions. We instruct OpenAI not to use this data to train its models (API data is not used for training). Don't include sensitive information in practice conversations. Lawful basis: contract (providing the feature).
- Correspondence — messages you send via the contact form or email. Lawful basis: legitimate interests (responding to you).
- Technical data — our hosting provider processes IP addresses and request logs to serve and secure the site. Lawful basis: legitimate interests (security, operation).
3. Cookies
We use only strictly necessary cookies: a session cookie to keep you signed in and a CSRF protection cookie. We do not use advertising or third-party analytics cookies, so we don't show a cookie banner.
4. Who we share data with
We don't sell personal data. We share it only with the service providers (processors) we need to run ELF:
| Provider | Purpose | Location / safeguard |
|---|---|---|
| Vercel Inc. | Website hosting | USA / EU (SCCs) |
| Neon Inc. | Database (account & learning data) | EU region |
| Stripe Payments Europe Ltd | Payment processing | EU / USA (SCCs) |
| Resend (Plus Five Five Inc.) | Sending our emails | EU sending region / USA (SCCs) |
| OpenAI LLC | AI coach conversations & speech processing | USA (SCCs) |
| Microsoft Ireland | Our mailbox (when you email us) | EU |
Where providers process data outside the UK/EEA, transfers are protected by UK-approved safeguards such as the UK Addendum to the EU Standard Contractual Clauses (SCCs) or adequacy decisions.
5. How long we keep data
- Account and learning data: while your account is active, then deleted within 30 days of account closure.
- Transaction records: 6 years (UK tax law).
- Contact-form correspondence: up to 2 years.
- AI coach conversations: not stored by us beyond your session; OpenAI retains API data briefly for abuse monitoring, then deletes it.
6. Your rights
Under UK GDPR you can ask for access to, correction of, deletion of, or a portable copy of your personal data; you can object to or ask us to restrict processing; and where we rely on legitimate interests you can object at any time. Email info@elf-app.com and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to help first.
7. Children
ELF accounts are for users aged 16 and over. Younger learners may use ELF through an account created and managed by a parent or guardian, who remains responsible for the account and its data.
8. Security
All traffic is encrypted (HTTPS). Passwords are hashed with bcrypt. Payment card data never touches our servers. Access to production data is restricted to those who need it to operate the Service.
9. Changes
We will post any changes here and, for material changes, notify you by email. See also our Terms of Service.