Privacy Policy

1Introduction

This Privacy Policy ("Privacy Policy") describes how Eldri ("Eldri", "we", "us", or "our") collects, uses, processes, stores, discloses, and otherwise handles information in connection with the Eldri desktop application, the Eldri website, and any related products, services, features, content, or functionality that reference or link to this Privacy Policy (collectively, the "Services").

Eldri is committed to protecting the privacy and security of individuals who access or use the Services. This Privacy Policy explains the categories of information we collect, the purposes for which such information is processed, the circumstances under which information may be disclosed, the measures implemented to protect such information, and the rights available to individuals under applicable data protection and privacy laws.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. Where your consent is required under applicable law, your continued use of the Services constitutes your consent to the collection, use, disclosure, and processing of your information as described herein.

This Privacy Policy applies solely to information processed by Eldri in connection with the Services. It does not govern information collected, processed, or maintained by independent third-party products, services, websites, platforms, payment processors, authentication providers, artificial intelligence providers, or other organizations that maintain their own privacy policies and practices.

2Scope of this Privacy Policy

This Privacy Policy applies to:

• The Eldri desktop application.
• The official Eldri website.
• User authentication services.
• Account management services.
• Payment-related interactions facilitated through authorized third-party payment processors.
• Customer support communications.
• Marketing communications where permitted by applicable law.
• Any additional products or services that expressly reference this Privacy Policy.

This Privacy Policy does not apply to:

• Third-party artificial intelligence providers selected and configured by users.
• Third-party authentication providers, including Google.
• Third-party infrastructure providers, including Supabase.
• Third-party payment processors, including Paddle.
• Any third-party websites, software, integrations, plugins, or services that are not owned or operated by Eldri.

Your interactions with such third-party services remain subject to their respective terms, privacy policies, and applicable legal documentation. Eldri neither controls nor assumes responsibility for the privacy practices, security practices, or data processing activities of independent third parties.

3Definitions

For purposes of this Privacy Policy, the following definitions shall apply:

"Account" means the authenticated user profile used to access the Services.

"Applicable Law" means all applicable privacy, data protection, consumer protection, and related laws and regulations governing the processing of personal information, including, where applicable, the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, the California Consumer Privacy Act ("CCPA"), the California Privacy Rights Act ("CPRA"), India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and any successor legislation.

"Artificial Intelligence Provider" means any third-party large language model, artificial intelligence platform, or machine learning service selected by the user, including but not limited to providers such as OpenAI, Anthropic, Google, or any other supported provider.

"Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable natural person, as defined under applicable law.

"Processing" means any operation or set of operations performed on Personal Information, whether by automated means or otherwise, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, deletion, destruction, or any similar activity.

"Services" means the Eldri desktop application, website, associated software, related services, and any functionality made available by Eldri.

"User", "you", or "your" means any individual who accesses or uses the Services.

4Privacy Principles

Eldri has been designed around the principle that users should retain meaningful control over their information.

As of the Effective Date of this Privacy Policy, Eldri's architecture is designed so that the categories of information identified below are processed locally on the user's device and are not transmitted to or stored on Eldri-operated servers.

• Eldri does not transmit or store user screen content on Eldri-operated servers.
• Eldri does not transmit or store microphone input on Eldri-operated servers.
• Eldri does not transmit or store system audio on Eldri-operated servers.
• Eldri does not store user-provided API keys on Eldri-operated servers.
• Artificial intelligence requests are transmitted directly between the user's device and the selected Artificial Intelligence Provider under the Bring Your Own Key ("BYOK") model.

If Eldri introduces a feature that materially changes how these categories of information are processed or stored, this Privacy Policy will be updated before such changes take effect where required by applicable law.

5Categories of Information We Collect

The categories of information processed by Eldri depend upon your interaction with the Services, the features you use, and the third-party services you choose to connect.

We collect only the information reasonably necessary to provide, maintain, secure, improve, and support the Services.

5.1Information Provided Through Authentication

Access to the Eldri desktop application currently requires authentication using a supported Google account.

Authentication is facilitated through Google Sign-In and managed using Supabase Authentication.

Subject to the permissions granted by you during authentication, Eldri may receive the following information from your Google account:

• Full name;
• Email address;
• Profile image; and
• A unique authentication identifier associated with your account.

Eldri does not request or access your Google password at any time.

Authentication credentials remain under Google's authentication infrastructure.

5.2Account Information

To maintain your Eldri account and provide access to the Services, we may maintain information including:

• Account identifier;
• Authentication status;
• Account creation date;
• Last authentication timestamp;
• Subscription status;
• License status; and
• Other account metadata reasonably necessary for operating the Services.

Such information is processed solely for account administration, authentication, licensing, fraud prevention, security, and customer support purposes.

5.3Technical and Device Information

When you use the Services, certain technical information may be collected automatically for operational, diagnostic, compatibility, reliability, and security purposes.

Depending upon your operating environment, such information may include:

• Device type;
• Operating system and version;
• Application version;
• Language settings;
• Device identifiers;
• IP address associated with requests made to Eldri infrastructure or services operated on Eldri's behalf;
• Session information;
• Diagnostic metadata;
• Crash reports; and
• Performance-related telemetry.

This information is used exclusively for maintaining, securing, diagnosing, improving, and supporting the Services.

5.4Diagnostic and Crash Information

To improve stability, reliability, and software quality, Eldri may automatically collect diagnostic information relating to application errors, unexpected terminations, crashes, and technical failures.

Diagnostic information may include:

• Error identifiers;
• Stack traces;
• Operational application state immediately preceding an error, including technical runtime information such as loaded modules, active feature flags, memory allocation data, software version, and execution state. This does not include user screen content, prompts, AI responses, local documents, microphone recordings, system audio, clipboard contents, or API keys;
• Software version;
• Operating system version;
• Device characteristics relevant to diagnosing the issue; and
• Other technical metadata reasonably necessary to investigate and resolve software defects.

Diagnostic information is not collected for advertising or behavioral profiling purposes.

5.5Usage Information

Eldri may process limited usage information necessary to understand product reliability, feature utilization, software performance, and overall product quality.

Such information may include:

• Feature usage;
• Application events;
• Session activity;
• Anonymous performance metrics;
• Reliability statistics; and
• Aggregate usage trends.

Where reasonably practicable, usage information is processed in aggregated or de-identified form.

Eldri does not use such information to build advertising profiles or sell behavioral data to third parties.

6Information We Do Not Collect

Protecting user privacy is a fundamental architectural objective of the Services.

Unless expressly stated otherwise within this Privacy Policy, Eldri does not collect, transmit, retain, or store the following categories of information on Eldri-operated servers:

• Screen recordings;
• Screen captures;
• Selected screen regions;
• Desktop content;
• User prompts submitted to Artificial Intelligence Providers;
• Artificial Intelligence responses generated by third-party providers;
• Microphone recordings;
• System audio recordings;
• Clipboard contents;
• User-provided API keys under the Bring Your Own Key ("BYOK") model;
• Files stored locally on the user's device; or
• The contents of documents processed by the Services.

Processing of such information occurs locally on the user's device or is transmitted directly between the user's device and the selected Artificial Intelligence Provider in accordance with the configuration chosen by the user.

Eldri does not operate as an intermediary for such requests and does not maintain server-side copies of such information.

7How We Collect Information

Information processed by Eldri may be obtained from one or more of the following sources:

• Directly from you during account authentication;
• Automatically from your interaction with the Services;
• Through authorized third-party authentication providers;
• Through authorized payment processors;
• Through diagnostic systems used to identify and resolve software issues; and
• Through customer support communications initiated by you.

Eldri does not purchase personal information from data brokers, advertising networks, or other third-party data aggregation services.

8Purposes of Processing

Eldri processes Personal Information only for legitimate business and operational purposes, including:

• Providing access to the Services;
• Authenticating users;
• Managing subscriptions and licensing;
• Maintaining account security;
• Preventing fraud and unauthorized access;
• Diagnosing software issues;
• Improving reliability and product performance;
• Responding to customer support requests;
• Complying with applicable legal obligations;
• Enforcing our contractual rights; and
• Protecting the security, integrity, and availability of the Services.

We do not process Personal Information for the purpose of selling user data or providing behavioral advertising based upon user activity within the Eldri desktop application.

9Legal Bases for Processing (Where Applicable)

Where the General Data Protection Regulation ("GDPR"), the UK GDPR, or similar data protection legislation applies, Eldri processes Personal Information only where a lawful basis exists.

Depending upon the nature of the processing activity, we may rely upon one or more of the following legal bases:

Performance of a Contract

We process Personal Information where such processing is necessary to provide the Services requested by you, including but not limited to:

• Creating and maintaining your account;
• Authenticating your identity;
• Managing subscriptions and licensing;
• Providing customer support;
• Maintaining service functionality; and
• Delivering updates relating to the Services.

Legitimate Interests

We may process Personal Information where such processing is necessary for our legitimate business interests, provided that such interests are not overridden by your rights and freedoms.

Examples include:

• Maintaining platform security;
• Detecting fraudulent or unauthorized activity;
• Preventing abuse of the Services;
• Improving software stability;
• Diagnosing technical issues;
• Monitoring system reliability;
• Conducting internal analytics; and
• Developing and improving product functionality.

Compliance with Legal Obligations

We may process Personal Information where required to comply with applicable laws, regulations, judicial proceedings, governmental requests, or other legally binding obligations.

Consent

Where required by applicable law, Eldri will obtain your consent before processing Personal Information for purposes requiring consent.

You may withdraw such consent at any time, subject to legal or contractual restrictions.

Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

10Authentication Services

Access to the Services currently requires authentication through a supported Google account.

Authentication is facilitated through Google Sign-In and managed using Supabase Authentication.

Authentication services are provided by independent third-party providers operating under their own privacy policies and terms of service.

Eldri does not receive, process, store, or have access to your Google account password.

Authentication providers may independently process technical information necessary to authenticate users, secure accounts, detect suspicious activity, and comply with applicable legal obligations.

Google and Supabase process certain authentication information under their respective privacy policies. Eldri remains responsible for the Personal Information it receives and processes in connection with your Eldri account.

11Artificial Intelligence Processing

Eldri functions as a software platform that enables users to interact with third-party Artificial Intelligence Providers.

Eldri is not itself an Artificial Intelligence Provider.

Artificial intelligence requests are transmitted directly from the user's device to the Artificial Intelligence Provider selected by the user.

Because Eldri does not proxy or relay these requests through Eldri-operated infrastructure, Eldri cannot inspect, retrieve, or store the prompts or responses exchanged between your device and the selected Artificial Intelligence Provider.

As of the Effective Date of this Privacy Policy:

• Eldri does not relay AI requests through Eldri-operated servers.
• Eldri does not inspect prompts submitted to AI providers.
• Eldri does not store prompts submitted to AI providers.
• Eldri does not store responses generated by AI providers.
• Eldri does not modify responses returned by AI providers except as required for local presentation within the application.

The processing of prompts, context, and responses by third-party Artificial Intelligence Providers is governed solely by the privacy policies and contractual terms of those providers.

Users are responsible for reviewing the privacy practices of any Artificial Intelligence Provider they choose to connect to the Services.

12Bring Your Own Key (BYOK)

Eldri currently operates under a Bring Your Own Key ("BYOK") model.

Under this model:

• Users provide their own API credentials for supported Artificial Intelligence Providers.
• API credentials are stored locally on the user's device.
• API credentials are not transmitted to or stored on Eldri-operated servers.
• Eldri personnel cannot view, recover, access, or retrieve user API credentials.

Users are solely responsible for protecting their API credentials and for complying with the applicable terms and usage policies of their selected Artificial Intelligence Provider.

Loss, disclosure, or misuse of user-provided API credentials occurring outside the control of Eldri shall remain the responsibility of the user.

13Screen, Audio, and Context Processing

Certain functionality of the Services requires temporary access to contextual information available on the user's device.

Depending upon the functionality selected by the user, Eldri may locally process:

• Screen content;
• Selected screen regions;
• Application windows;
• Microphone input;
• System audio; and
• Other contextual information necessary to provide requested functionality.

Such processing occurs locally on the user's device.

As of the Effective Date of this Privacy Policy:

• Eldri does not transmit such contextual information to Eldri-operated servers.
• Eldri does not permanently store such contextual information.
• Eldri does not build datasets from user screen content, microphone input, or application activity.
• Eldri does not use such information for advertising, profiling, model training, or commercial resale.

Where contextual information is transmitted to a third-party Artificial Intelligence Provider, such transmission occurs directly from the user's device to the provider selected by the user and is governed by that provider's own privacy practices.

14Payment Processing

Subscriptions, purchases, renewals, refunds, taxation, and related payment services are processed by Paddle, our authorized third-party Merchant of Record.

Paddle independently collects and processes payment-related information necessary to complete transactions, comply with applicable financial regulations, prevent fraud, calculate taxes, and maintain financial records.

Depending on the nature of the transaction, Paddle may process information including:

• Name;
• Billing email address;
• Billing country or region;
• Payment method information;
• Transaction identifiers;
• Subscription information;
• Invoice information;
• Tax-related information where required by law; and
• Other information reasonably necessary to process payments.

Eldri does not receive, process, or store complete payment card numbers, card verification values (CVV/CVC), banking credentials, or other sensitive payment authentication data.

Eldri may receive limited transaction information from Paddle necessary to:

• Verify successful payment;
• Activate or maintain subscriptions;
• Manage licensing;
• Respond to billing inquiries;
• Process refunds where applicable; and
• Detect fraudulent activity.

Payment information is processed in accordance with Paddle's own Privacy Policy, Terms, and applicable financial regulations.

15Website Analytics

The Eldri website may use Simple Analytics to better understand website performance, visitor activity, and overall product interest.

Analytics information may include:

• Pages visited;
• Referral sources;
• Browser information;
• Device type;
• Operating system;
• General geographic region;
• Session duration;
• Website performance metrics; and
• Anonymous usage statistics.

Analytics are used solely to:

• Improve website usability;
• Measure website performance;
• Identify technical issues;
• Understand product interest; and
• Improve documentation and user experience.

Analytics collected through the website are not used to inspect your desktop activity, screen content, AI interactions, prompts, responses, local files, or workflow activity within the Eldri application.

Where reasonably practicable, analytics are processed in aggregated or de-identified form.

16Cookies and Similar Technologies

The Eldri website may use cookies, local storage, session storage, and similar technologies to support website functionality, improve user experience, maintain security, and measure website performance.

Cookies may include:

Essential Cookies

Essential cookies are necessary for the operation of the website and cannot generally be disabled without affecting core functionality.

These cookies may be used for:

• Security;
• Session management;
• Authentication state;
• Website functionality; and
• Fraud prevention.

Functional Technologies

Functional technologies may be used to remember user preferences and improve website usability.

Examples include:

• Theme preferences;
• Language preferences;
• Accessibility settings; and
• Other user-selected website configurations.

Analytics Technologies

Where implemented, analytics technologies may be used to understand aggregate website usage and improve website performance.

Analytics are not intended to identify individual users unless required for security, fraud prevention, or legal compliance.

Additional information regarding cookies may be provided through a separate Cookie Policy where required by applicable law.

17Marketing Communications

Where permitted by applicable law, Eldri may send communications relating to:

• Product announcements;
• Software updates;
• Security notices;
• New features;
• Service-related notifications;
• Product newsletters; and
• Other information relating to the Services.

Marketing communications are sent only where legally permitted or where you have elected to receive them.

You may unsubscribe from marketing communications at any time by:

• Using the unsubscribe mechanism contained within the communication; or
• Contacting Eldri through the Contact Us page.

Certain operational communications—including security notices, account notifications, billing confirmations, and important service announcements—may continue to be sent where necessary for the administration of the Services.

18Data Retention

Eldri retains Personal Information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, comply with applicable legal obligations, resolve disputes, enforce contractual rights, and maintain the security and integrity of the Services.

Unless a longer retention period is required or permitted by law, Personal Information is generally retained as follows:

Where Personal Information is no longer required, Eldri will take reasonable steps to securely delete, anonymize, or otherwise render such information incapable of identifying an individual, unless continued retention is required by applicable law.

19International Data Transfers

Eldri is made available to users worldwide.

Accordingly, Personal Information may be processed, accessed, stored, or transferred across multiple jurisdictions depending upon:

• Your location;
• The location of our infrastructure providers;
• The location of authentication providers;
• The location of payment processors;
• The location of Artificial Intelligence Providers selected by you; and
• Other service providers engaged in connection with the Services.

Where Personal Information is transferred internationally, Eldri will take reasonable measures to ensure such transfers are conducted in accordance with applicable data protection laws.

Eldri implements appropriate contractual, technical, and organizational safeguards where required by applicable law to facilitate international transfers of Personal Information.

By using the Services, you acknowledge that your information may be transferred to countries whose data protection laws may differ from those of your country of residence.

20Security

Eldri maintains administrative, technical, and organizational measures designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, misuse, or other unlawful forms of processing.

Such safeguards may include, where appropriate:

• Transport Layer Security (TLS) encryption for communications with Eldri-operated services;
• Access controls based on the principle of least privilege;
• Security monitoring; and
• Authentication controls.

No method of transmitting information over the Internet or storing electronic information can be guaranteed to be completely secure.

Accordingly, while Eldri employs commercially reasonable safeguards, we cannot warrant or guarantee absolute security.

Users remain responsible for maintaining the confidentiality of their own devices, authentication credentials, API keys, and local computing environments.

21Your Privacy Rights

Subject to applicable law, you may have one or more of the following rights regarding your Personal Information.

Depending upon your jurisdiction, these rights may include:

Right of Access

You may request confirmation regarding whether Eldri processes your Personal Information and, where applicable, request access to such information.

Right to Deletion

You may request deletion of Personal Information maintained by Eldri, subject to applicable legal, contractual, regulatory, tax, fraud prevention, security, or legitimate business retention obligations.

Deletion requests may also be initiated by deleting your Eldri account where supported.

Right to Correction

Where Personal Information maintained by Eldri is inaccurate or incomplete, you may request correction of such information.

Where information originates from your Google account or another third-party provider, updates may need to be performed directly through that provider.

Right to Withdraw Consent

Where processing is based upon consent, you may withdraw such consent at any time.

Withdrawal of consent shall not affect processing lawfully carried out before such withdrawal.

Right to Lodge a Complaint

If you believe your Personal Information has been processed in violation of applicable law, you may have the right to lodge a complaint with the competent data protection authority within your jurisdiction.

Nothing in this Privacy Policy limits any statutory rights available under applicable law.

Requests submitted through the Contact Us page will be reviewed after reasonable verification of the requestor's identity. Eldri will respond within the timeframes required by applicable law.

22Children's Privacy

The Services are not directed toward, intended for, or knowingly designed for use by children under the age of thirteen (13), or such higher minimum age as may be required under applicable law within the relevant jurisdiction.

Eldri does not knowingly collect Personal Information from children in violation of applicable law.

If we become aware that Personal Information has been collected from a child contrary to applicable law, we will take reasonable steps to delete such information within a reasonable period.

Parents, legal guardians, or individuals who believe a child has provided Personal Information to Eldri may contact us through the Contact Us page to request review and deletion of such information.

23Third-Party Services

The Services integrate with, rely upon, or otherwise interact with third-party products and services.

As of the Effective Date of this Privacy Policy, such services may include, without limitation:

Each third-party provider operates independently and maintains its own privacy practices, security measures, contractual terms, and legal obligations.

Eldri neither owns nor controls such third-party services and is not responsible for their independent privacy practices, security measures, or data processing activities.

Users are encouraged to review the privacy policies and legal documentation published by such providers before using their services through Eldri.

24Disclosure of Personal Information

Eldri does not sell, rent, or commercially license Personal Information to third parties.

We may disclose Personal Information only where reasonably necessary to operate the Services, comply with applicable law, prevent fraud, maintain platform security, enforce licensing terms, or enforce our legal rights.

Personal Information may be disclosed under the following circumstances:

Service Providers

We may disclose limited Personal Information to trusted third-party service providers that perform services on our behalf, including but not limited to:

• Authentication providers;
• Payment processors;
• Infrastructure providers;
• Analytics providers;
• Customer support providers; and
• Other vendors reasonably necessary for operating the Services.

Such providers are authorized to process Personal Information only to the extent necessary to perform the services requested by Eldri.

Legal Compliance

We may disclose Personal Information where disclosure is reasonably necessary to:

• Comply with applicable laws or regulations;
• Respond to lawful governmental requests;
• Comply with court orders, subpoenas, or other legal process;
• Protect the rights, property, or safety of Eldri, our users, or the public;
• Investigate fraud, abuse, or security incidents; or
• Enforce our agreements, policies, or contractual rights.

Business Transactions

If Eldri undergoes a merger, acquisition, corporate restructuring, financing, sale of assets, bankruptcy, or similar transaction, Personal Information may be transferred as part of that transaction, subject to applicable legal obligations.

Where required by applicable law, affected users will be notified of material changes relating to such transfer.

25Data Security Responsibilities

While Eldri implements security measures designed to protect Personal Information, users also play an important role in protecting their own information.

Users are responsible for:

• Maintaining the security of their devices;
• Protecting authentication credentials;
• Protecting API keys supplied under the Bring Your Own Key (BYOK) model;
• Keeping software updated;
• Preventing unauthorized access to their systems; and
• Following reasonable cybersecurity practices.

While Eldri implements reasonable safeguards to protect Personal Information under its control, users remain responsible for maintaining the security of their own devices, authentication credentials, API keys, and local computing environments.

26Changes to this Privacy Policy

Eldri may revise, amend, or otherwise update this Privacy Policy from time to time to reflect:

• Changes in applicable law;
• Changes in regulatory guidance;
• Modifications to the Services;
• Changes in technical architecture;
• Introduction of new functionality;
• Changes in business operations; or
• Other legitimate operational or legal requirements.

When material changes are made, the "Last Updated" date appearing at the beginning of this Privacy Policy will be revised accordingly.

Where required by applicable law, Eldri may provide additional notice regarding material changes through the website, desktop application, electronic communication, or other reasonable means.

Where required by applicable law, Eldri will provide notice of material changes to this Privacy Policy and obtain any consent required before such changes become effective.

27Contact Us

Questions, requests, complaints, or inquiries relating to this Privacy Policy or Eldri's privacy practices may be submitted through the Contact Us page available on the official Eldri website.

Where applicable, privacy-related requests may include:

• Requests for access to Personal Information;
• Requests for deletion of Personal Information;
• Questions regarding this Privacy Policy;
• Requests relating to applicable privacy rights; or
• Other privacy-related inquiries.

Eldri will make reasonable efforts to review and respond to legitimate privacy requests within the timeframes required by applicable law.

28Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India, without regard to its conflict of law principles.

Nothing in this Privacy Policy shall limit or restrict any mandatory rights afforded to individuals under applicable data protection or consumer protection legislation that cannot lawfully be excluded.

29Entire Privacy Policy

This Privacy Policy constitutes the entire privacy statement governing the collection, use, disclosure, processing, retention, and protection of Personal Information by Eldri in connection with the Services.

If any provision of this Privacy Policy is determined by a court or competent authority to be unlawful, invalid, or unenforceable, such provision shall be enforced to the maximum extent permitted by applicable law, and the remaining provisions shall remain in full force and effect.

The failure of Eldri to enforce any provision of this Privacy Policy shall not constitute a waiver of that provision or of any other provision contained herein.

This Privacy Policy should be read together with the Eldri Terms of Service, Cookie Policy (where applicable), and any additional legal notices published by Eldri.