Elphame Privacy Policy

Last updated: September 17, 2026

This Privacy Policy explains how Elphame, LLC ("Elphame," "we," "us," or "our") collects, uses, shares, and protects personal information when you use elphame.com, our web application, emails, and related services (the "Service").

If you have questions or want to exercise a privacy right, contact us at hello@elphame.com.

1. Who we are

Elphame is operated by Elphame, LLC, a Delaware limited liability company. We are the controller of the personal information described in this policy.

2. Age requirement

Elphame is for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us and we will delete it.

3. Information we collect

3.1 Information you give us

  • Account information: An account is required to use Elphame's core features, including saving journeys and paid plans. When you sign up, we collect your email address and, if you sign in with Google, your name and profile picture as provided by Google. If you sign up with email, we collect your email and password. Passwords are handled by our authentication provider and are never stored in plain text.
  • Payment information: If you buy a paid plan, payments are processed by Stripe. We receive limited details such as your name, email, plan, and payment status. We never see or store your full card number.
  • Your content: Topics you search, research journeys, notes, bookmarks, uploaded images (such as course thumbnails), settings, and anything else you save or submit in the Service. Do not submit passwords, government IDs, payment card numbers, or other sensitive information in searches, notes, or chats. If you do, that content may be processed like other user content.
  • Communications: Messages you send us, including replies to our emails, survey answers, and notes from feedback calls you agree to join.

3.2 Information collected automatically

  • Usage data: Pages and features you use, searches you run, how many journeys you create, and when you last used the Service.
  • Device and log data: IP address, browser type, operating system, referring pages, and dates and times of visits.
  • Cookies and similar technologies: We use essential cookies to keep you signed in and remember preferences. We also use analytics cookies, including Google Analytics and Firebase Analytics, to understand how the Service is used. You can control cookies in your browser settings, though some features may not work without essential cookies.
  • Email engagement: Our email provider may record whether an email was delivered, opened, or clicked.

4. How we use your information

We use your information to:

  • Provide the Service: create and manage your account, generate research journeys and other AI-assisted content, save your work, and process payments.
  • Communicate with you: send account and security emails (such as sign-in and billing notices), product updates, tips, and offers, and ask for your feedback about Elphame, including invitations to short optional calls.
  • Improve Elphame: understand how people use the Service, what works, and why people stop using it.
  • Keep the Service safe: prevent fraud and abuse, enforce our Terms of Service, and fix security or technical issues.
  • Meet legal obligations: comply with applicable laws and respond to valid legal requests.

We do not sell your personal information. We do not use your content to train our own AI models. To generate results, we send your queries and limited related context to third-party AI providers, who process that data under their own terms and privacy policies.

5. Legal bases (EEA, UK, and similar laws)

Where these laws apply, we rely on:

  • Contract: to provide the Service you signed up for.
  • Legitimate interests: to improve the Service, ask for feedback, keep the Service secure, and send updates to existing users. You can object at any time.
  • Consent: where the law requires it, for example for certain cookies or marketing. You can withdraw consent at any time.
  • Legal obligation: where we must process data to comply with the law.

6. How we share information

We share personal information with service providers that help us run Elphame, and only as needed for them to do their job:

  • Google (Firebase and Google Cloud): authentication, database, file storage, hosting, analytics, and bot protection (including reCAPTCHA and App Check).
  • Cloudflare: API hosting and image storage.
  • Groq, OpenAI, Anthropic, and other AI providers: we send your search queries and limited context needed to generate results. These providers process data under their own terms and privacy policies.
  • Google APIs (including image search): to display related images and external content.
  • Google Analytics / Firebase Analytics: usage analytics.
  • Stripe: payment processing.
  • Brevo: sending emails and managing email preferences.

We may also share information:

  • If required by law or to protect the rights, safety, or property of Elphame, our users, or others.
  • In a business transfer, such as a merger, acquisition, or sale of assets. We will notify you if this happens.
  • With your direction, for example when you share a journey through a public link or publish content to Explore. Anyone with that link, or anyone who can view the public page, can see the shared content.

Our service providers may only use personal information as needed to provide their services to us, except where they act as independent controllers under their own policies (for example, AI providers processing queries, or Google if you sign in with a Google account).

7. International data transfers

We and our service providers are based in the United States and other countries. If you use Elphame from outside the United States, your information will be transferred to and processed in the United States and other countries that may have different data protection laws. Where required, we rely on appropriate safeguards such as the Standard Contractual Clauses offered by our service providers.

8. How long we keep information

  • Account data and content: kept while your account is active. When you delete your account, we delete your personal data and journeys within 30 days, except where we need to keep some information for legal, tax, or security reasons.
  • Payment records: kept as long as required by tax and accounting laws.
  • Email and feedback data: kept while you are a user or until you ask us to delete it. If you unsubscribe, we keep your email on a suppression list so we do not email you again.
  • Logs and analytics: kept for a limited period and then deleted or aggregated.
  • Publicly shared content: remains available until you unshare it or we delete it after account deletion.

9. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS) and encryption at rest for stored journeys. Access to personal data is limited to what is needed to run the Service. Providing the Service requires us and our processors to handle your queries and saved content. No system is completely secure, so we cannot guarantee absolute security.

10. Your rights and choices

  • Unsubscribe: click "unsubscribe" in any marketing or feedback email, or email us. You will still receive essential account and billing emails.
  • Access and correction: ask for a copy of your personal information or ask us to correct it.
  • Deletion: delete your account in the app, delete specific journeys yourself, or ask us to delete your data.
  • Objection and restriction: object to certain processing, such as feedback emails or analytics.
  • Portability: ask for your data in a commonly used format.
  • Withdraw consent: where we rely on consent, you can withdraw it at any time.
  • Complaints: if you are in the EEA or UK, you can complain to your local data protection authority.

To use any of these rights, email hello@elphame.com. We will respond within 45 days, or sooner where the law requires (including 30 days where GDPR applies). We may need to verify your identity first, and we may refuse a request if the law allows.

11. California residents

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion or correction, to opt out of sale or sharing of personal information, and to not be discriminated against for using these rights. You may also use an authorized agent to make a request, and you may appeal a denied request by emailing us.

In the past 12 months we have collected identifiers (such as name, email, and IP address), commercial information (such as plan and payment status), internet and network activity (such as usage and device data), and user content you submit. We collect this information from you, your device, Google if you sign in with Google, and our service providers. We use it for the purposes in Section 4.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics about you. We do not currently respond to browser "Do Not Track" signals.

To make a request, email hello@elphame.com.

12. Third-party services and links

The Service may display content or links from third parties, including search results and images. Their sites and services are governed by their own privacy policies. If you sign in with Google, Google's privacy policy also applies to information Google collects.

13. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above, and if the changes are significant, we will notify you by email or through a notice on the Service.

14. Contact us

Elphame, LLC
1111B S Governors Ave STE 34031
Dover, DE 19904
United States
Email: hello@elphame.com

Last Updated: September 17, 2026