Privacy
What is collected
| Data | Why | How long | |
|---|---|---|---|
| Intake answers (the fourteen inputs) | They are the read. Without them there is no output. | For the life of the account. Anonymous intakes: 12 months, then deleted. | |
| Reads and decision-log entries | Your file: position, confidence, window, counter-case, and what you recorded happened. | For the life of the account. | |
| ELDR Chat logs | To keep a conversation coherent across messages, and to show you the thread again later. | For the life of the account, or until you delete the conversation. | |
| ELDR Chat notes | A few short facts about your situation that a model writes from your chats, so a new conversation starts from what you already told it. Never health, sex life, religion, politics or ethnicity, and never contact details. You can read and clear them on your data page. | Until you clear them, delete a conversation, or delete the account. | |
| Date of birth — optional | Reduced to an age band before it reaches the model. Nothing is cast from it and the read is identical without it. | Until you clear it in your account, or delete the account. | |
| Email address | Sign-in codes, the renewal notice, and anything you asked to receive. | For the life of the account. | |
| Analytics events | Page views, step drop-off, device class, coarse country, first-touch campaign tags. Measured by us, on our own servers, with no third-party analytics script. Advertising measurement is separate and described below. | 400 days, then aggregated and the raw rows dropped. | |
| Payment records | Plan, amount, renewal date and Stripe identifiers, so we can bill, renew and refund correctly. | As long as tax and accounting law requires. Card numbers never reach us. | |
| Advertising-measurement choice | So a decision to switch measurement off is honored on the server as well as in the browser, and follows a signed-in account between devices. | On the account until you change it. In the st_ads cookie for two years, or until you clear your cookies. | |
| Technical logs | Errors, rate-limit counters, and hashed IP addresses for abuse prevention. Addresses are hashed, not stored in the clear. | 90 days. |
Advertising measurement
We buy advertising, which means we need to know which advertising produced an account and which produced nothing. There is no honest way to run that without telling the advertising platform when something happened. So: when you take an action that matters commercially — you finish an intake, you open an account, you pay — we tell Meta that an action of that kind occurred.
What goes to Meta, and nothing beyond it:
- the name of the event, the time it happened, an event identifier, and the page you were on;
- your IP address and browser user-agent string, which Meta’s API requires in order to match an event to an ad click;
- the
_fbpand_fbccookie values, if present; - your email address as an irreversible SHA-256 hash, and only if you have given us one. The address itself never leaves our servers in a readable form.
What does not go: the decision you typed, the read we produced, anything you said in ELDR Chat, your answers to any question, or any content of any kind. Those are the whole product and they stay here.
Two parts of this are worth naming plainly rather than burying. The event is sent from our servers as well as from your browser, deliberately, because the browser copy is unreliable and we would rather measure correctly than guess — both copies carry the same identifier so Meta counts one event, not two. And under some US state privacy laws, passing an identifier to an advertising platform counts as a “share” even though no money changes hands and nothing is sold. We think you should know that regardless of which state you live in.
You can switch it off. There is a link in the footer of every page and a switch on your account page; neither needs an account and neither blocks anything while you decide. Switching it off stops both halves — the tag is never installed in your browser, so fbevents.js is not fetched and no _fbp cookie is set, and our server stops sending conversions for you as well. An opt-out that only silenced the browser would be a promise the code breaks, so it does not work that way. If your browser sends a Global Privacy Control signal (Sec-GPC: 1), that is treated as the same request and you do not have to press anything. The choice is held in a first-party cookie named st_ads, so clearing your cookies clears it, and another device will ask again. Nothing about the product changes either way.
Cookies
Four of ours, and two of Meta’s when advertising measurement is running:
st_session— set when you sign in. Holds a signed token identifying your session. Removed when you sign out.st_anon— a random identifier with no name attached to it, set on your first visit so an anonymous intake and its read can find each other, and so page views can be counted without identifying you. Expires after a year.st_attr— first-touch campaign tags, if you arrived from a link that carried them. Expires after 90 days.st_ads— your answer on advertising measurement,offoron. Set only when you press the control, never by default, and readable by JavaScript on purpose: the measurement tag’s own guard reads it before deciding whether to install itself. Expires after two years.
_fbpand_fbc— set by Meta’s measurement tag, described in Advertising measurement above._fbconly exists if you arrived from a Meta ad. Meta sets their lifetimes, not us; today that is 90 days.
No third-party analytics script is loaded. Our own measurement runs on our servers, and the numbers on this site are counted by us. Meta’s tag is the one third-party script here, it exists only to tell us which advertising worked, and it is the subject of the next section.
Who your data is sent to
Five categories of processor, and no-one else:
- The model provider — your intake answers, chat messages and the notes ELDR Chat keeps are sent to the configured provider (Anthropic, OpenAI or Google, directly or through Vercel’s AI Gateway, depending on the route set in the admin) to generate output. Your date of birth is not sent; only an age band is. We do not permit the use of your content for training.
- TypeSafe’s Jev model, through Vercel’s AI Gateway — the question you type into Yes or No or a quiz, to choose the next question; and, once you have a long chat history, your last few chat messages, to judge whether suggesting a course would fit.
- Hosting and database — the servers that run the application and store your rows.
- Stripe — payments. They handle card data; we never see it.
- The email provider — sign-in codes, renewal notices and dispatch emails if you enable them.
Your data is not sold and not rented. There is no deal with a data broker and no arrangement under which anybody pays for access to you. The one exception to “not shared” is the advertising measurement described above: Meta is told that an event happened and is given what it needs to match it to an ad click. That is the entire relationship, it is listed field by field in that section, and it carries none of the content of what you write here.
Why we are allowed to hold it
To perform the contract you entered into when you used the service (intake, reads, chat, billing); for our legitimate interest in keeping the product working and free of abuse (rate limits, error logs, first-party analytics); and for consent where you gave it (marketing email, dispatch email). Consent can be withdrawn at any time in your account without losing anything you paid for.
How to delete it
- Delete your account — account page, one confirmation. Removes intakes, reads, chat threads and the notes ELDR Chat keeps, your quiz and Yes or No answers, feedback you sent, the decision log and your profile. Billing records that tax law requires us to keep are retained in a form that no longer identifies your content.
- Delete one thing — individual reads, chat threads, the notes ELDR Chat keeps and the date of birth can be removed on their own. Deleting a chat thread clears the notes as well, since they may have come from it.
- Export — a machine-readable copy of everything is available from the account page.
- By email — write to support@eldr.space from the address on the account. Requests are completed within 30 days, usually within two working days.
Anonymous intakes are keyed to the st_anon cookie. If you never made an account, clearing that cookie leaves the row unreachable, and it is deleted on the 12-month schedule regardless.
Your rights
Depending on where you live you have the right to access, correct, export, restrict or delete your personal data, to object to processing based on legitimate interest, and to complain to your data protection authority. We do not make automated decisions that produce legal effects about you — the output of this product is a second opinion, not a determination.
Security
Traffic is encrypted in transit. Sessions can be revoked server-side. Provider API keys are encrypted at rest. IP addresses are hashed before storage. Access to production data is limited to the people who operate the service. No system is perfect; if there is a breach affecting you, you will be told, and told what to do about it.
Children
The service is for adults, 18 and over. We do not knowingly collect data about children. If you believe a child has used the service, write to support@eldr.space and the data will be deleted.
Changes
If this notice changes materially, account holders are emailed at least seven days before it takes effect, and the effective date at the top of this page changes.
Contact
ELDR is operated by Growly Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA, which decides how your data is used and is responsible for it.
Data questions, export requests, deletion requests, complaints: support@eldr.space, or +1 (302) 271-7854. One address, answered by a person.