Elephate.ai logoElephate.ai

Data Statement

Last updated: 22/06/2026

1. Data storage and processing location

Your documents, estimates and project data are stored separately per company account. Other users or companies have no access to your data.

During pilot and implementation projects (the development phase) we engage sub-processors, including hosting and AI or language model providers, who may process your data outside the European Economic Area (EEA). You agree to this when entering into such a project. Where personal data is transferred, we base this on a valid transfer mechanism under the GDPR, including the Standard Contractual Clauses.

In the fully operational service (the production phase) we aim to process your data entirely within the EEA. This is a best-efforts intention; we give no guarantee unless expressly agreed otherwise in writing.

2. Encryption

Elephate.ai applies encryption at multiple levels:

  • In transit: all communication between your browser and our servers is via SSL/TLS encryption (HTTPS).
  • At rest: stored data is encrypted with AES-256.
  • Passwords: passwords are stored hashed and are never available in readable form, not even to us.

3. GDPR compliance

Elephate.ai complies with the General Data Protection Regulation (GDPR). This includes:

  • We only process personal data for the purposes for which it was collected.
  • You have the right to access, correct and delete your data.
  • We maintain a register of processing activities.
  • In the event of a data breach, we report it within 72 hours to the Dutch Data Protection Authority and to affected users, to the extent legally required.
  • Insofar as we process personal data on your behalf in performing the agreement, we act as processor and conclude a data processing agreement with you in accordance with Article 28 GDPR. We impose on the sub-processors we engage at least the obligations that apply to us.

4. Sharing with third parties

Elephate.ai never sells your data and does not share it with third parties for commercial purposes. Your data is only shared with:

  • Sub-processors: service providers necessary for the functioning of the platform (hosting, authentication, AI services). A current overview of our sub-processors and the countries in which they process data is available on request.
  • Legal authorities: if we are legally required to do so.

Your uploaded documents and estimates are not used to train, calibrate or refine our models or algorithms for the general operation of the platform, unless expressly agreed with you. Your company data always remains yours.

5. Data retention and deletion

  • We retain your projects and related company data for as long as the agreement is in force. After termination of the agreement we delete these within 30 days, except for data we are required to retain longer under a statutory retention obligation.
  • You can request an export of your data prior to termination.
  • For account and personal data, the retention periods from our privacy policy apply.
  • We retain financial data for 7 years in accordance with the statutory retention obligation.

6. Contact

Do you have questions about how we handle your data, or would you like to know which sub-processors we engage? Please contact us at contact@elephate.ai or view our privacy policy for more information.