Privacy Policy
This policy explains what [COMPANY LEGAL NAME NOT YET SET] (“Elmer,” “we,” “us”) collects when you use the Elmer application and website (the “Service”), how we use it, and the choices you have. It is written to describe what the product actually does — no more, no less.
We collect what you type in and the minimum needed to sign you in. No advertising, no analytics trackers, no selling data, no reading your emails. Your CRM data is processed only to run the product for you.
1. What we collect
Information you provide
- Account information: your email address, your name, and — for team members — the name your administrator entered when inviting you.
- CRM content: the customers, contacts, notes, tasks, follow-up dates, tags, and file attachments you or your team add or import. Attachments are stored in our database. This content typically includes personal information about your contacts (names, phone numbers, emails, addresses); you are responsible for having the right to store it.
- Settings: your preferences — colors, notification choices, and, if you turn on text reminders, the mobile number you enter.
- Messages inside your team: in a company account you can message your administrator, and they can message you, without leaving Elmer. We store what you write so the thread is still there tomorrow. Nobody but the two of you can read it.
Before you have an account
- The waitlist: if you ask for an invite on our website, we store the email address you typed and the date you typed it, so we know who is waiting and in what order, and so we can email you when a seat opens. That is the only thing we ask for and the only thing we keep. Email priv8development@gmail.com and we will take you off the list.
- Invite codes and referrals: when someone uses an invite code, we record the email address it was used by, so we can tell who was handed a code apart from who actually showed up. If someone joins through your referral link, we store the email address of the account they created next to your credit, so the free month lands with the right person.
Information collected automatically — deliberately minimal
- Activity history: when something changes on a customer — the stage moves, a note is added, a lead is imported — Elmer writes a plain-English line to that customer’s history saying what happened and who did it. We also record roughly when you last used the app, which is what stops a reminder text going out to somebody already sitting in front of their board.
- Sign-in and session records: hashed sign-in tokens and session identifiers, and — for billing consent records — the IP address and browser identification string at the moment of consent, kept as legal evidence.
- Cookies — four, all strictly necessary: one keeps you signed in (for up to 30 days, or until you sign out); two are short-lived (10-minute) security checks that protect the “Sign in with Google” and Gmail-connect steps against forgery, and are deleted as soon as that step finishes; and one remembers an invite code you entered, for up to 45 minutes, only while you finish signing in. We set no analytics, advertising, or cross-site tracking cookies of any kind.
- Browser storage — kept on your device, never sent to us: a note that you answered the cookie notice; a few screen preferences, so Elmer opens the way you left it (how the board is grouped, whether it opens on your own tiles or the whole team’s, the period Analytics shows, how Contacts are sorted, and that you closed this month’s referral reminder); on our front page, a yes-or-no note that you joined the waiting list from this browser (it holds the number 1, never your email address); and, for a single browser tab, a note that stops Elmer reloading more than once when our Terms or Privacy Policy change while you have it open. The full list, with how long each item lasts, is in the cookie notice. You can open it again any time from Settings → Account & security → Review cookie notice.
Email sync — only if you connect it, and headers only
If you choose to connect Gmail, we request read-only access and fetch message metadata only: sender, recipient, and date. We do not read, fetch, or store message bodies or subject lines. We use this metadata for one purpose: keeping your “last touched” dates honest and suggesting contacts you emailed who aren’t in your CRM yet (which you review before anything is added). Your Google tokens are encrypted at rest with AES-256-GCM. You can disconnect at any time in Settings → Email sync, which stops all collection.
Elmer’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Address and business lookup — part of the customer form
When you type a company name or an address into a customer form, Elmer suggests matches as you type. From the third character onward, what you have typed in that one field is sent through our servers to Google Maps Platform to find those matches. If you pick a suggestion, Google returns that place’s address — and, for a company lookup, its public phone number and website. Only the text in that one field goes — never your name, your account, or anything else from your CRM — and the request carries our own key rather than your identity. This is part of how the field works, so it happens whether or not you use Google sign-in; if the lookup is unavailable, the field is simply a plain text box.
Payments
Payments are processed by Stripe. Your card number goes directly to Stripe and never touches our servers. We store only what Stripe returns to run your subscription: customer and subscription identifiers, plan, and billing period dates. When you consent to automatic renewal we keep a permanent record of that consent — timestamp, the exact disclosure text you saw, price, IP address, and browser string — because subscription law requires us to be able to prove it.
We keep the same kind of record when a company administrator adds a paid seat. Because the thing being agreed to is a seat for a named person, that record contains the email address of the person being invited. Like the renewal records, these are kept permanently — a charge we cannot prove somebody agreed to is the one we cannot defend.
2. What we never do
- We do not sell or rent your data — including your CRM contacts — to anyone.
- We do not run ads and we do not share data with advertisers or data brokers.
- We do not use third-party analytics or tracking pixels.
- We do not read your email bodies or subject lines — ever, on any plan.
- We do not use your CRM data to train AI models.
3. How we use information
- To provide the Service: showing your board, sorting it, sending the reminders and reports you turn on.
- To power Elmer, the built-in AI assistant (see section 4).
- To sign you in securely and protect accounts (including optional two-factor authentication).
- To bill subscriptions, send legally required renewal notices, and keep required records.
- To respond when you contact support.
- To comply with law.
We send operational emails (sign-in links, invitations, your daily digest if enabled, billing notices). We do not send third-party marketing.
4. The AI assistant
Elmer’s intelligence comes from Anthropic (the maker of Claude), in the United States. Here is every moment your data goes there — including the ones you do not start yourself:
- When you chat with Elmer or run a weekly meeting. We send your message, the recent messages of that conversation, Elmer’s rolling memory of earlier ones, and a snapshot of your top accounts: company and contact names, stage, deal value, how long since each person was spoken to, and the opening of your latest note on each.
- Twice a day, on his own, when you open the board. Elmer writes his check-in question, and that sends the same kind of account snapshot even though you asked him nothing. Turn it off in Settings → Notifications.
- Elmer's brief on a tile — when you hover, and for your top accounts on their own. Each tile carries a short brief of where that deal stands. To write it, Elmer sends that one account's notes (the latest 25), the people on it (name and title), its stage, value, and activity dates. This happens when you hover over a tile whose brief is out of date, and in the background for the twelve highest-priority tiles on your board each time it loads. A brief is written once and kept on the tile until something on it changes — it is not re-sent on every visit.
- Photo and paste import. The actual photograph of the business card, or the text you pasted, is uploaded to Anthropic to be read. A business card carries another person’s name, phone number, email and employer, and that person is not the one pressing the button — so import only cards you were given.
- The weekly manager report, if your company has a team. Each rep’s name and email address, their follow-up numbers, how many days since they last opened the app, and excerpts from their meeting summaries. This one runs on a schedule, with nobody pressing anything.
Under Anthropic’s commercial API terms, none of this is used to train Anthropic’s models. Anthropic does hold a copy for a limited period to run the service and enforce its own usage policies before deleting it, and that copy is outside our control — which is why the list above spells out exactly what is in it. Elmer’s changes to your board are always shown to you with an undo option.
5. Who can see your data inside your own team
Your boss (the account owner) can see the work stuff; your private tasks stay private.
In a company account, the account owner can view the organization’s CRM data, including each rep’s customers, and can reassign leads. Reps see their own book of business and any tile a colleague or an admin shares with them. If your company uses Elmer as a team, colleagues who can open a shared team folder can see the names and sizes of the customer tiles in it, but not the details behind them, unless the tile’s owner or an admin shares a tile with them. Personal tasks a rep marks private are excluded from the owner’s board, reports, and exports. Company owners can export the organization’s data; reps cannot export.
One limit worth understanding, if you use a work email address. Signing in to Elmer means clicking a link we send to your email address. So if your Elmer account uses an address your employer controls — anything at the company’s own domain — then whoever administers that mailbox can request a sign-in link and reach your account, including anything you marked private. That is a property of company email itself, true of most workplace software, and not something Elmer can prevent. If you want items that stay private from your employer even so, keep them in an Elmer account on an email address you control personally.
When someone is removed from a company account, their customer records stay with the company and pass to the account owner. Items that were theirs — private tasks, and any personal leads they brought with them when they joined — remain in their own account and are never transferred to the company.
6. Service providers we share data with
We share data only with the processors below, only so they can perform services for us, under their own contractual confidentiality obligations:
| Provider | Purpose | What they process |
|---|---|---|
| Neon | Database hosting | All Service data |
| Vercel (or equivalent host) | Application hosting | Data in transit through the app |
| Stripe | Payments | Billing details, card data (directly) |
| Backblaze | Encrypted off-site backups | A nightly copy of all Service data, encrypted before it leaves us — Backblaze cannot read it — kept under a 60-day lock and removed within 61 days |
| Anthropic | AI assistant, tile briefs, import reading, weekly manager report | Account snapshots and chat history; one account's notes, people, stage and value for its brief; business-card photos and pasted text; rep names, emails and activity stats (see section 4) |
| Resend | Transactional email | Email address, message content we send you |
| Twilio | Text reminders (if enabled) | Your mobile number, reminder text |
| Sign-in and Gmail sync (if you connect them); address and business lookup in customer forms | OAuth identity; message metadata as described above; the text typed into the company/address field |
Beyond service providers, we disclose information only: to comply with law or valid legal process; to protect the rights, safety, or property of Elmer or others; or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to your data until changed with notice).
7. Security
- All traffic is encrypted in transit (HTTPS).
- Sign-in links and invitations are single-use, expiring, and stored only as cryptographic hashes.
- Gmail tokens and two-factor secrets are encrypted at rest (AES-256-GCM); recovery codes are stored hashed.
- Optional two-factor authentication (authenticator app) on every account.
- Organization data is separated by access controls checked on every request.
No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you as required by law.
8. Retention
- Your CRM data is kept while your account is active.
- Expired sign-in links and sessions become unusable at expiry.
- If you close your account, it stays fully usable for 30 days in case you change your mind — one click in Settings calls it off. After that we permanently delete your Customer Data: tiles, notes, contacts, files, messages and your sign-in records.
- We keep billing consent records and transaction history even then, because subscription and tax law requires proof of what you agreed to and what you paid. Those records hold your email, the plan and price you agreed to, and when — and no CRM data at all: no customers, no notes, no contacts. We also keep a one-line record that the deletion happened (account name, who asked, the date), so that if a backup were ever restored we could re-apply your deletion — and the record of when you agreed to these Terms and this Policy, which is proof of the agreement itself.
- Backups. We take an encrypted backup every night and keep it for 60 days, so that a mistake, an outage or an attack cannot destroy your work. Those backups are held under a lock that prevents anyone — including us — from altering or deleting them early; that is exactly what makes them a safety net. So for up to 61 days after you delete something, an encrypted copy still exists in that backup set, after which it ages out permanently. While it is there it is never read, restored or used for any other purpose, and if we ever did restore a backup we would re-apply your deletion straight afterwards.
9. Your rights and choices
- Export: account owners can download all CRM data as a CSV in Settings, self-serve, any time.
- Correction: you can edit any of your data directly in the app.
- Deletion: account owners can close the account themselves in Settings → Account & security. We ask you to type the account name, send a confirmation link to your email, and ask for your two-factor code if you use one — then give you 30 days to change your mind. You can also email priv8development@gmail.com instead. Subject to the billing and backup retention described above.
- Email sync: disconnect any time in Settings → Email sync.
- Text messages: turn off any time in Settings → Notifications.
- Cookies: the four we set are strictly necessary; blocking them in your browser will prevent sign-in. Clearing your browser’s storage only resets your screen preferences and shows the cookie notice again.
Depending on where you live, you may have additional rights (such as access, portability, deletion, and non-discrimination under U.S. state privacy laws). We honor these rights on request at priv8development@gmail.com, and we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of on that front. If you are a contact stored in one of our customers’ CRMs, that customer is responsible for your data; contact them directly, and we will assist them as their processor.
10. Children
The Service is a business tool for adults. It is not directed to children under 18, and we do not knowingly collect information from them.
11. Where data is processed
We are a U.S. company and process data in the United States through the providers listed above. If you use the Service from outside the U.S., you consent to processing in the U.S.
12. Changes to this policy
If we change this policy materially, we will notify you by email or in-app notice before the change takes effect, and update the date at the top. We will never quietly weaken what section 2 promises.
Contact
[COMPANY LEGAL NAME NOT YET SET] · Miami, Florida · priv8development@gmail.com