Privacy policy.

Elabela Ltd, a company registered in the United Kingdom, is the data controller for personal data collected via elabela.co. Contact: sam@elabela.co.

For enquiries, we collect the details you submit through our website forms or send by email. These may include your name, email address, optional organisation, subject, and the contents of your message. Website forms use Cloudflare Turnstile to prevent spam and Resend to deliver your enquiry to us. We store a hashed email identifier and request counts to limit repeated submissions; we do not store the enquiry content in our website database.

If you create an account, we process your email address, account identifier, email-verification status, and profile name if provided. You can use email and password or choose Google or Microsoft sign-in. Supabase handles account authentication. Your selected provider handles social sign-in. Resend delivers account confirmation and password-reset emails through our authentication service.

If you enable API or MCP access, we store key names, hashed credentials, creation and expiry times, revocation status, and usage information needed to operate and protect the service. OAuth connection records identify the client and the research access you authorised. A connected tool receives the research you request through it and handles that information under its own terms and privacy settings.

For institutional access, we store workspace names, membership roles, seat assignments, invitation details, and subscription status. We also store Stripe customer and subscription identifiers needed to manage billing. Payment details are entered through Stripe, rather than on Elabela's own forms.

The Site does not use analytics cookies or tracking pixels. Public pages can be browsed without an account. Protected institutional research requires sign-in and paid access. Essential browser storage keeps your Supabase session signed in and supports the sign-in process; signing out clears the local session.

We use enquiry information to respond to your enquiry and, where relevant, to enter into or perform a consulting or sponsorship engagement with you or your organisation.

We use account and workspace information to verify sign-in, provide the research subscription, manage membership and invitations, process billing through Stripe, and respond to account or payment problems.

We process account, access and billing information to perform our contract with you and take steps you request before entering into a contract. We rely on our legitimate interests to respond to enquiries, secure the service and prevent misuse. We also process records where needed to meet legal, accounting and tax obligations.

We do not sell or share your data with third parties for marketing. Personal data is processed by service providers that help us operate the Site and email.

• Cloudflare — hosting, content delivery and Turnstile spam prevention for the Site.
• Your email provider and ours — delivery of email messages you send us.
• Resend — delivery of website enquiries, account confirmation and password-reset emails.
• Supabase — account authentication and storage of workspace, subscription-access, invitation, API/OAuth and rate-limit records.
• Google — optional Google sign-in, if you choose it.
• Microsoft — optional Microsoft sign-in, if you choose it.
• Stripe — subscription checkout, payment processing and billing management.

Workspace owners and administrators can see their workspace's member names, email addresses, roles and invitations so they can manage access.

We retain enquiry emails for up to 24 months from last contact, then delete them. Records relating to a consulting engagement are retained for as long as needed to comply with our legal, accounting, and tax obligations.

Account and workspace records are retained while your account or workspace is in use. Invitation, API-key and OAuth-connection records support access management, expiry, revocation and security investigation. Expiring or revoking access disables the credential and can leave a record of that action. Retention depends on whether the account remains open, the record is needed to provide or secure the service, or an unresolved billing issue, dispute or legal obligation requires it.

You can request account deletion using the contact details below. We review associated access records as part of that request and retain records required for legal, accounting and tax obligations for the applicable retention period.

Under UK GDPR you have the right to access, correct, delete, or restrict processing of your personal data, and to object to processing based on legitimate interests. To exercise any of these, email sam@elabela.co.

To request deletion of your account, contact us at the address above. Account deletion is handled by request; there is currently no self-service deletion button. Subscription cancellation is available separately through the billing controls in your account. Billing records may need to be retained for legal, accounting and tax obligations.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Some of our service providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

We may update this policy from time to time. The current version will always be at this URL, with the "Last updated" date above.