Privacy Policy

1. Controller and contact

The controller for the processing of personal data within the meaning of the GDPR is Flowprimo LLC, a Limited Liability Company under the law of the State of Delaware, USA.

Address: Flowprimo LLC, c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA (service via the Registered Agent).

Managing director: Christian Saur.

Representative in the European Union (Art. 27 GDPR): Christian Saur, Portugal. Reachable at privacy@elyvite.com.

Email: privacy@elyvite.com

2. Overview

Elyvite is a research platform for health professionals. This statement describes what personal data we process, for what purposes, on what legal basis, to whom we disclose it and what rights you have. It applies to the website (elyvite.com) and the application (app.elyvite.com).

3. What data we process

• Account data: name, email address, login credentials, language preference.
• Payment and invoicing data: processed through our payment service provider Lemon Squeezy (Merchant of Record). We do not see complete payment details (e.g. card number), but invoice and transaction data.
• Research content: your entries and the results generated (categories, projects, chats).
• Usage and log data: e.g. pages visited, timestamps, browser and device type, IP address, server logs.
• Cookies and similar technologies: see section 11.

Important: Please do not enter personal data of your clients or health data relating to identifiable individuals. Elyvite is intended for general research.

4. Purposes and legal bases

We process personal data for the following purposes on the following legal bases (Art. 6 GDPR):

• Provision of the account, the service and the research features — contract (Art. 6(1)(b)).
• Payment processing, invoices, taxes — contract (point (b)) and legal obligation (point (c)).
• Security, protection against misuse and spam, improvement of the service — legitimate interest (point (f)).
• Optional analytics and cookies — consent (point (a)).
• Communication regarding the contract and the service — contract (point (b)); marketing only with consent (point (a)).

5. Recipients and processors

We use carefully selected service providers who process data on our behalf (Art. 28 GDPR) or act as controllers in their own right:

• Supabase: database and storage (EU region).
• OpenRouter: routing service for the AI requests (USA).
• Anthropic (Claude) and OpenAI: AI processing of the research queries, via OpenRouter (USA).
• Lemon Squeezy (Sold through Link, LLC): payment processing as Merchant of Record (USA/global).
• Vercel: website hosting.
• Sanity: content management for the website content.
• Cloudflare (Turnstile): bot and spam protection.

We do not sell or rent personal data for marketing purposes.

6. Transfers to third countries (USA)

Part of the processing takes place outside the European Union, in particular the AI processing (OpenRouter and the model providers in the USA) and the payment processing (Lemon Squeezy). Personal data is transferred to the USA in this context.

For these transfers we rely on appropriate safeguards under Art. 46 GDPR, in particular the EU standard contractual clauses (SCCs), or on providers' certification under the EU-US Data Privacy Framework. A copy of the safeguards can be requested at privacy@elyvite.com.

7. AI processing and what data you may enter

Your research queries are transmitted, for the purpose of answering them, to external AI model providers (via OpenRouter) and processed there; these may be located outside the European Union. As matters currently stand, queries are by default not used for training at these providers and are stored only briefly or not at all. More on this on our AI transparency page.

Please do not enter personal data of your clients or health data relating to identifiable individuals. Research topics and questions in general terms, without names or details that make individuals identifiable. This keeps special categories of personal data (Art. 9 GDPR) out of scope.

8. Payment processing through Lemon Squeezy

Purchases are processed through Lemon Squeezy as Merchant of Record. Lemon Squeezy is the seller in the legal sense, handles payment, VAT and refunds and processes your payment and invoicing data for this purpose under its own privacy policy.

9. Retention period

We store personal data only for as long as is necessary for the stated purposes or as statutory retention periods require:

• Account and research data: for the duration of the contractual relationship, thereafter deletion or anonymisation.
• Invoicing data: in accordance with tax and commercial law retention periods.

10. Your rights

You have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent given (Art. 7(3)) with effect for the future.

To exercise them: privacy@elyvite.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in your country of residence.

11. Cookies and consent

We use essential cookies for the operation of the website. We set optional analytics cookies only with your consent via our cookie banner; you can withdraw your consent at any time via /cookies.

12. Bot and spam protection

To protect forms we use Cloudflare Turnstile. This processes technical challenge and browser signals, not advertising trackers. Legal basis: legitimate interest (Art. 6(1)(f)).

13. AI chat on the website (sales & service assistant)

On our website we offer an AI-supported chat assistant that answers questions about Elyvite and receives enquiries, feature requests and error reports. Use is voluntary, the assistant is labelled as AI, and its answers may contain errors.

• Processing of your entries: Your chat messages are transmitted, for the purpose of answering them, to our processors: Vercel Inc. (hosting, AI Gateway, bot protection “BotID”) and Anthropic PBC (AI model “Claude”). Processing may take place in the USA; it is safeguarded by EU standard contractual clauses or the EU-US Data Privacy Framework (see the section “Transfers to third countries”).
• Chat histories: We store histories pseudonymously under a random session ID — with no reference to an account or a name, unless you provide such details in the chat yourself. The purpose is improvement of the assistant and detection of misuse (Art. 6(1)(f) GDPR). We delete chat histories after 90 days at the latest.
• Enquiry card: If you send an enquiry, a feature request or an error report through the chat, we process the data you provide (e.g. name, email, request, optionally profession and website) in order to handle your request — exclusively on the basis of your express consent given via the confirmation checkbox (Art. 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future.

Please do not enter sensitive data in the website chat, in particular no health data and no data relating to your clients. The assistant does not provide medical advice.

14. No automated individual decision-making

Elyvite does not take automated decisions producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR. Content is prepared with the help of AI and presented with its sources; the assessment and the decision are yours.

15. Data security

We take appropriate technical and organisational measures to protect your data (including encryption in transit and access controls).

16. Children's data

Elyvite is not directed at children under the age of 16. We do not knowingly collect data from children.

17. Changes to this statement

We may amend this statement. The version currently in force is available on this page with an updated date.

18. Contact

Flowprimo LLC, c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Email: privacy@elyvite.com