Privacy notice

Who is responsible for what

Two different roles apply, and the distinction matters if you need to make a request.

For your own account and studio — your name, email, password, business details and portfolio — Elvoric is the controller. Write to us and we will deal with it.

For the briefs your clients submit through your storefront, you are the controller and Elvoric is the processor. We hold and render that data on your instructions, for as long as your account is open. If a client asks you to erase their brief, you can delete it from your dashboard and it is gone from our systems with it. If they ask us directly, we will point them to you rather than act behind your back.

There is one record we keep on our own account rather than yours. When a client asks us to stop the reminders a studio set for their brief, we keep their email address alone as the record of that request: the request is theirs and not the studio’s, and the record has to outlive the brief it suppresses, so no studio can delete it from its dashboard. Nothing else is kept about them — no name, no message, no link between the address and the brief — and Elvoric is the controller of that record, because it is the one thing here that is not about a studio’s work. It is deleted whenever they ask us to, under “Your rights” below.

What we collect

• Account data: your name, email address, a password stored only as a salted scrypt hash, your role, and the times you sign in.
• Studio data: your business name, tagline, biography, location, logo, chosen craft, storefront address, colour and typography choices, the questions on your brief form, and your generation guardrails.
• Portfolio data: the pieces you upload, their titles, descriptions and tags, and which of them you have marked as references.
• Client brief data: whatever your form asks for — typically the client’s name, email, phone number, occasion, event date, servings, flavour, allergies, budget and their written vision — plus any images they upload and the reference pieces they pick.
• Generation data: the prompt built from a brief, the rendered images, the model used, the inspection flags raised, and the cost of each run.
• Credit data: your sign-up credit grant, every reservation, capture and release, and any credits an administrator grants you.
• Technical data: the IP address a request came from, kept briefly for rate limiting and abuse prevention, and server logs recording errors.
• Counters: how many times a page was viewed and which page, grouped as landing, craft, pricing or preview; which campaign link brought a visit, counted once for each arrival that carries a campaign tag, with the campaign label as the only thing stored beside the count; when a client opens your brief form and which step they reach; the first time a studio adds a piece, publishes its storefront or receives a brief; and every page load we served in English because a translation was missing. A counter holds a number, which kind of event it was, when it happened and, where the event is a studio’s own, which studio. The one that keeps a little more is the page load that fell back to English: it also records the language that was asked for, the page group it happened on, and up to five of the site’s own message-key names — the names of strings we have not translated yet, never text you or your visitor wrote. A campaign label is folded to lower-case letters, digits, dots, dashes and underscores and cut to sixty-four characters. No IP address, no cookie, no session identifier and no free text is stored with any of them, and a count is never linked back to a brief or to a person, so they can tell you how many people opened the form but not who any of them were. A count that belongs to a studio is attached to that studio’s own account and never to its clients.

Why we are allowed to hold it

We rely on performance of our contract with you to hold your account, studio, portfolio and credit data — without them there is no product to deliver. We rely on the same basis to process a brief, because rendering a concept is the service you asked for.

We rely on our legitimate interests to keep the service secure: rate limiting, abuse prevention, and error logs. Those interests are limited to keeping the platform working for everyone, and the data involved is kept to a minimum.

We rely on our legitimate interests to measure which channel produced a signup: the campaign a visitor arrived with is recorded with the account it produced, held for as long as that account is open, and never shared with anyone. It tells us which link worked, and nothing about the person who followed it — no identifier, no IP address and no profile is built from it.

We rely on your consent for the optional things: product feedback you choose to send, and any email that is not transactional. You can withdraw that consent at any time and nothing else stops working.

Who else sees it

We use a small number of processors, each bound by a data processing agreement. None of them may use your data for their own purposes.

• Oracle Cloud Infrastructure — application hosting, database storage and file storage, in the European Union.
• Oracle Cloud Infrastructure Email Delivery — transactional email only: the account and security messages a studio receives, the brief and concept notices a studio’s client receives on the studio’s behalf, and the notices a decided report sends, to the person who filed it and to the studio if something of theirs was taken down.
• Our AI gateway and the image model provider behind it — receives the prompt built from a brief, plus the reference images the client selected. It returns an image. It does not receive your clients’ contact details, and prompts are not retained by us beyond the concept record you can see.
• Google Fonts — the typefaces on our marketing pages are fetched from Google’s servers, which therefore see the IP address of the visitor.

What we never do

• We do not sell personal data, and we do not share it with advertisers or data brokers.
• We do not use your portfolio, your clients’ briefs or the prompts built from them to train any model.
• We do not run third-party analytics or advertising trackers. There is no pixel on this site, and the counters described above are our own, hold no identifier, and cannot follow anyone from one page to the next.
• We do not read your clients’ briefs for any purpose other than operating and supporting the service.

Cookies

Two cookies are set on this site: one keeps you signed in and one remembers the language you chose. Neither is shared with anyone else and neither follows you to another site.

elvoric_session holds an opaque session token so you stay signed in. It is HTTP-only, SameSite=Lax, and it expires after thirty days of inactivity. Without it you cannot sign in, which is why it is set without asking.

elvoric_locale is written only when you pick a language in the switcher, and it holds nothing but the code of that language — en, de, fr, es or ar. It lasts a year, it is how the site remembers your choice on your next visit, and picking again overwrites it. You asked for it by choosing, so nothing is put to you first.

We run no third-party analytics or advertising trackers, no ad network sets a cookie here, there is no pixel on this site, and there is no cookie banner to dismiss. Those two are the only cookies you will find.

How long we keep it

• Account and studio data: for as long as your account is open, then deleted. Deleting your account removes your storefront, portfolio, briefs, concepts and credit history.
• Briefs and concepts: until you delete them. Deleting a brief removes its concepts, its renders and its client share link.
• Rate-limiting counters: minutes to hours, then discarded.
• Server error logs: thirty days.
• Counter events (page views, sign-up and onboarding steps, published studios, briefs, concept views, and page loads that fell back to English): thirty days. They record a count, at most a language, a page group and a handful of the site’s own message-key names — never an IP address, a session, a cookie value or anything that names or follows a person.
• Billing records: retained for as long as tax law requires, in a form that no longer identifies individual clients.
• Reminders a client has stopped: for as long as they are what stops the reminders. This one record deliberately outlives the brief it concerns, so it has no end date of its own — deleting it is the one thing that would let the reminders start again. Ask us and we delete it; if a brief with that address is still waiting on its reminders, we will tell you first.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to a particular use. You can also ask for it in a portable format. Most of this you can do yourself from your dashboard; for anything else, write to us and we will respond within thirty days.

If your request concerns a brief your client sent to a maker, contact that maker first — they control it. If you would rather not, contact us and we will pass the request on.

To exercise any right, email contact@elvoric.com.

If you believe we have handled your data badly you can complain to your national data protection authority. In the United Kingdom that is the Information Commissioner’s Office.

Where it is stored

Application data and uploaded files are stored in Oracle Cloud Infrastructure’s European Union regions. The image model provider may process a generation request outside the European Economic Area; that transfer is covered by standard contractual clauses. No client contact details are included in those requests.

Changes

If this notice changes in a way that affects what we collect or who we share it with, we will email account holders before the change takes effect. Correcting a typo will not generate an email.