Privacy Policy

1. Data controller

The data controller is Elephant in the Room (société par actions simplifiée, SAS, RCS Paris 107 908 337), 16 rue de Vézelay, 75008 Paris, France, represented by its President, Louis Alexandre Leibovici. For any question relating to your personal data, you can reach us at hello@elephantintheroom.ai.

2. Data we collect

We collect information you provide directly, such as your name, business email, and company details when you contact us or book a call. When you use the platform, we process the operational data your organization chooses to share with us.

We also collect limited technical data (such as browser type and pages visited) to operate and improve our website.

3. How we use data

We use personal data to provide and improve the platform, respond to your requests, and communicate with you about our services. We do not sell your personal data.

Operational data submitted to the platform is used solely to deliver the service to your organization, in line with our contractual commitments.

4. Legal basis

Where the GDPR applies, we process personal data on the basis of your consent, the performance of a contract, our legitimate interests, or to comply with a legal obligation, depending on the context.

5. Google API Services and Limited Use

When you connect a Google account, we access data from Google APIs (such as Gmail, Google Calendar, and Google Drive) only to the extent you authorize during the connection flow, and only to provide and improve the features you have asked us to run.

Elephant in the Room's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising, we do not sell it, and we do not allow humans to read it except where you explicitly ask us to, where it is necessary for security or to comply with applicable law, or where the data has been aggregated and anonymized. You can revoke our access at any time from your Google account security settings or by contacting us.

6. Artificial intelligence processing

The platform relies on third-party large language models provided by Anthropic (Claude) and OpenAI (GPT) to generate analyses, drafts, and recommendations.

Data is transmitted to these providers only through secured APIs (HTTPS/TLS). Your data is never used to train our providers' models, and we operate under zero-data-retention terms with them where available, so prompts and outputs are not retained on their side beyond what is required to return a response.

AI-generated output is a suggestion, not certified legal, financial, or professional advice. It should be reviewed and validated by a qualified human before any decision is made or communication is sent.

7. Data sovereignty and security

We work with clients in regulated professions where confidentiality is not optional. Data sovereignty, professional secrecy, and access controls are designed into the platform.

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access to data is restricted to the personnel strictly necessary to operate the service, and each client's data is logically isolated from every other client's. We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or disclosure.

8. Data retention

We retain personal data only as long as necessary for the purposes described in this policy, or as required by applicable law. Transient processing data is purged automatically within 30 days; conversation history is kept for the duration of the contract plus one year; account data is kept for the duration of the contract plus three years; technical logs are kept for up to 12 months.

When a retention period ends, or when you ask us to delete your data, we delete or irreversibly anonymize it, subject to any legal obligation to keep it longer.

9. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you may withdraw that consent at any time.

To exercise these rights, contact us at hello@elephantintheroom.ai. You also have the right to lodge a complaint with your local supervisory authority; in France, this is the CNIL (www.cnil.fr).

10. Third-party providers

We rely on selected infrastructure and AI providers, which may include Google Cloud, Vercel, Anthropic, and OpenAI, to operate the platform. These providers process data on our behalf under appropriate data-processing agreements, and are bound by confidentiality and security commitments consistent with this policy.

11. Changes to this policy

We may update this Privacy Policy from time to time. The updated version is indicated by the “Last updated” date above.