Privacy Policy

1. Who We Are

Eleven Elves is operated by Eleven Elves LLC, a Texas limited liability company (“Eleven Elves,” “we,” “us”), [MAILING ADDRESS]. For website visitors and waitlist members, we are the controller of your personal information. For business data our customers put into the Eleven Elves software, our customer is the controller and we act as its processor (service provider), handling that data only on the customer's instructions.

Contact us about privacy at privacy@11elves.com. [IF REQUIRED: our EU representative under GDPR Article 27 is NAME, ADDRESS; our UK representative is NAME, ADDRESS.]

2. Information We Collect

We collect the following kinds of personal information:

• Information you give us: your name, brand or company name, email address, the sales channels and accounting software you use, and anything you write in a message to us.
• Your choices: whether you agreed to our Terms, and whether you asked to receive our weekly strategy emails.
• Account and billing information (after launch): your login details, team members you invite, and billing contact details. Payment card details are handled by our payment processor; we don't store full card numbers.
• Customer business data (after launch): orders, products, inventory, suppliers, financial records, employee records, and other data from the apps you connect, such as Shopify, your bank, or your 3PL.
• Technical information: IP address, browser and device type, pages visited, and timestamps, collected automatically by our hosting and security providers to keep the site running and safe.
• We don't knowingly collect sensitive personal information (such as health data) through the website. If you put employee records into the People or Payroll apps after launch, that data is customer business data handled under Section 1.

3. How We Use Your Information

We use personal information to:

• Manage the waitlist, give you early access, and tell you about the launch.
• Respond to your questions and support requests.
• Send our weekly strategy emails, only if you opted in. Every email has an unsubscribe link.
• Provide, secure, and improve the Eleven Elves software, including running the AI agents that do work on your behalf.
• Bill for subscriptions, prevent fraud and abuse, and meet our legal, tax, and accounting obligations.
• Understand, in aggregate, how the website is used so we can make it better.

4. Legal Bases for Processing

If you're in the European Economic Area, the United Kingdom, Switzerland, or another place with similar laws, we rely on these legal bases: performance of a contract (to run the waitlist, your account, and the service); legitimate interests (to secure our systems, answer questions, and improve our products, balanced against your rights); consent (for our weekly strategy emails and any optional cookies, which you can withdraw at any time); and legal obligation (for tax, accounting, and responding to lawful requests).

5. AI Agents and Your Data

Eleven Elves uses AI agents to do work inside your account, such as reconciling payouts, drafting customer replies, and writing your morning report. To do this, relevant data is processed by AI models, which may be provided by third-party AI vendors acting as our subprocessors under contracts that restrict how they use it.

We do not use your business data to train AI models that are shared with other customers, and our contracts with AI vendors prohibit them from training their models on your data. The elves don't make legally significant decisions about individuals on their own; anything with real consequences, like paying a bill or filing a report, is presented to a person to review and approve.

6. How We Share Information

We never sell your personal information, and we don't share it for cross-context behavioral advertising. We share it only with:

• Service providers who help us run Eleven Elves, under contracts that limit their use of the data. Today these include Cloudflare (website hosting and security) and Formspree (delivering form submissions). After launch, these will include our cloud hosting, payment, email, and AI providers. We'll keep a current list of subprocessors available on request.
• Apps you choose to connect, such as Shopify or your bank, which receive data as needed to make the connection work.
• Professional advisers, such as our lawyers and accountants, under confidentiality duties.
• Authorities, when the law requires it, or to protect the rights, safety, and property of our customers, the public, or us.
• A buyer or successor, if Eleven Elves is involved in a merger, acquisition, or sale of assets, in which case this policy will continue to protect your information.

7. International Transfers

We're based in the United States, and our providers may process data in the United States and other countries. When we transfer personal information out of the EEA, UK, or Switzerland, we use recognized safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for a copy of the relevant safeguards.

8. How Long We Keep It

We keep personal information only as long as we need it:

• Waitlist details: until launch plus 24 months, or until you ask us to remove you, whichever comes first.
• Messages to us: up to 3 years after our last exchange.
• Customer business data: for as long as your account is active, then deleted within 90 days after your account closes, after you've had at least 30 days to export it, unless the law requires us to keep it longer.
• Billing and tax records: as long as tax and accounting laws require, typically 7 years.

9. How We Protect It

We use industry-standard security, including encryption in transit (HTTPS) and at rest, access limited to people who need it, multi-factor authentication for staff, and monitoring for abuse. No system is perfectly secure. If a breach affects your personal information, we'll notify you and the relevant authorities as the law requires.

10. Your Rights

Depending on where you live, including under the GDPR, UK GDPR, the California Consumer Privacy Act as amended by the CPRA, other U.S. state privacy laws, Canada's PIPEDA and Quebec's Law 25, Brazil's LGPD, and Australia's Privacy Act, you may have the right to:

• Know what personal information we hold about you and get a copy of it, in a portable format.
• Correct information that's inaccurate or incomplete.
• Delete your information.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent at any time, such as unsubscribing from our emails, without affecting processing done before.
• Opt out of the sale or sharing of personal information and of targeted advertising. We don't do either, and we honor Global Privacy Control browser signals.
• Appeal our decision if we deny your request, and complain to your local data protection authority.
• Exercise these rights without being treated differently for doing so.

11. How to Exercise Your Rights

Email privacy@11elves.com or use our contact form. We'll confirm your identity, usually by checking that the request comes from the email address we have on file, and respond within the time the law requires (generally 30 days, or 45 days in some U.S. states). You can use an authorized agent; we may ask for proof of their authority. If we deny your request, you can appeal by replying to our decision, and we'll respond to the appeal within the time the law allows. If you're a customer's employee or customer, we may refer your request to the business that controls your data.

12. Cookies and Similar Technologies

Today our website doesn't use advertising, analytics, or tracking cookies, and it doesn't load content from third parties: our fonts and files are served from our own domain. Our hosting and security provider may set strictly necessary cookies to protect the site from attacks; these don't track you and don't require consent. If we add analytics or other non-essential cookies, we'll update this policy first and, where the law requires, ask for your consent with a clear choice to accept or decline.

13. Children

Eleven Elves is a business service for adults. It isn't directed at anyone under 16, and we don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we'll delete it.

14. Changes to This Policy

We'll update this policy as Eleven Elves grows. When we make a material change, we'll update the date at the top and tell waitlist members and customers by email before the change takes effect.

15. Contact Us

Eleven Elves, Eleven Elves LLC, a Texas limited liability company, [MAILING ADDRESS]. Email: privacy@11elves.com. If you're in the EEA or UK and aren't satisfied with our response, you can contact your local data protection authority.