Elephate.ai logoElephate.ai

Privacy Policy

Last updated: 22/06/2026

This privacy policy applies to the services of Elephate.ai B.V. We respect the privacy of our users and treat your personal data confidentially, in accordance with the General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act (UAVG) and the Dutch Telecommunications Act.

1. Data controller

The controller for your personal data is:

Elephate.ai B.V.

Registered office in Delft, place of business at Coolsingel 139, 3012 AG Rotterdam

Chamber of Commerce number: 42088251

VAT number: NL869655966B01

Email: contact@elephate.ai

Phone: +31 6 54 79 52 75

2. What data we collect

We process the following categories of personal data:

  • Account data: name, email address, company name, password (stored encrypted)
  • Usage data: uploads, generated estimates, search history within the platform
  • Technical data: IP address, browser type, device information, cookies
  • Payment data: processed by our payment provider and not stored by us

3. Legal basis for processing

We process your data on the basis of the following legal grounds (Article 6 GDPR):

  • Performance of the agreement, necessary to provide our services to you
  • Legitimate interest, to improve our services and prevent fraud
  • Consent, when you explicitly give it, for example for marketing communications
  • Legal obligation, when we are legally required to retain data

4. Purpose of processing

We use your personal data for the following purposes:

  • Providing and maintaining our services
  • Creating and managing your account
  • Communication about your account, orders and services
  • Improving and personalising our services
  • Complying with legal obligations

5. Sharing with third parties

We never sell your personal data to third parties. We may share your data with:

  • Processors and sub-processors: service providers that process data on our behalf (hosting, authentication, AI services, payments), on whom we impose at least the obligations that apply to us.
  • Legal authorities, if we are legally required to do so.

Some of these processors may process data outside the European Economic Area (EEA). Where that is the case, we ensure appropriate safeguards in accordance with the GDPR, including the Standard Contractual Clauses. See also our data statement for the processing location during pilot and implementation projects.

6. Retention periods

We do not retain your personal data longer than necessary for the purposes for which it was collected:

  • Account data: up to 12 months after closing your account
  • Financial data: 7 years (statutory retention obligation)
  • Technical log files: up to 12 months

Projects and company data you have uploaded are deleted within 30 days after termination of the agreement (see our data statement).

7. Security

We take appropriate technical and organisational measures to protect your personal data, including:

  • SSL/TLS encryption for all data transfers
  • Encrypted storage of passwords and sensitive data (AES-256)
  • We aim to process data within the EEA; where processing or transfer takes place outside the EEA, we put appropriate safeguards in place in accordance with the GDPR
  • Regular security updates

8. Cookies

Our website uses strictly necessary (functional) cookies only:

  • Functional cookies: necessary for the website to function, for example for authentication, security and remembering your language preference. Under the Dutch Telecommunications Act, no consent is required for these.
  • We do not place any analytical, tracking or marketing cookies and do not use any external analytics or advertising services.

Because we only use functional cookies, we do not ask for consent and do not show a consent banner, only an informational notice. You can also manage or delete cookies at any time via your browser settings; disabling functional cookies may affect the operation of the website. Should we wish to place non-essential cookies (such as analytical cookies) in the future, we will ask for your prior consent via a cookie banner.

9. Your rights

Under the GDPR you have the following rights: access, rectification, erasure, restriction of processing, data portability and objection. You can exercise these via contact@elephate.ai. We respond to your request within 30 days. If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

10. Changes

We reserve the right to amend this privacy policy. Changes are published on this page. In the event of substantial changes, we will notify you by email.