ELVOAQ Privacy Policy

Effective Date: July 1, 2026

Last Updated: July 1, 2026

Operator: Lukas Rajnic, trading as ELVOAQ

Legal Form: Sole trader, a natural person conducting business under the law of the Slovak Republic

Country of Establishment: Slovak Republic

VAT Number: Not registered for VAT (no VAT identification number exists)

Privacy Contact: privacy@elvoaq.com

Legal Contact: legal@elvoaq.com

Support Contact: support@elvoaq.com

Website: www.elvoaq.com

1. Introduction

This Privacy Policy explains how ELVOAQ collects, uses, stores, protects, discloses, transfers, and otherwise processes personal data in connection with the ELVOAQ website, platform, applications, accounts, subscriptions, digital vault features, asset management tools, document management tools, proof document features, controlled sharing tools, AI-assisted functions, customer support, communications, payment flows, and related products and services.

ELVOAQ is a brand operated by Lukas Rajnic, a natural person conducting business as a sole trader established in the Slovak Republic. The operator is not registered for value added tax and has no VAT identification number.

ELVOAQ is designed as a privacy-first platform for managing valuable assets, sensitive information, proof documents, ownership records, private notes, secure workflows, and controlled access.

Because ELVOAQ may be used to store and organize important personal, family, business, ownership, contractual, financial, insurance, warranty, certificate, and asset-related records, privacy is not treated as a secondary feature. It is part of the platform’s operating standard.

This Privacy Policy applies to:

1. visitors to the ELVOAQ website;

2. users who create an account;

3. personal account holders;

4. business account holders;

5. organizational account holders;

6. workspace administrators;

7. invited users;

8. customers and subscribers;

9. trial and demo users;

10. support contacts;

11. payment contacts;

12. marketing contacts;

13. business contacts;

14. recipients of shared ELVOAQ views or records;

15. any other person whose personal data may be processed through ELVOAQ.

By accessing or using ELVOAQ, you acknowledge that personal data may be processed as described in this Privacy Policy.

If you do not agree with this Privacy Policy, you must not use ELVOAQ.

2. Purpose of This Privacy Policy

This Privacy Policy is intended to explain clearly and transparently:

1. who is responsible for personal data;

2. what personal data ELVOAQ may process;

3. where personal data may come from;

4. why ELVOAQ processes personal data;

5. the legal grounds for processing;

6. how ELVOAQ uses personal data;

7. how ELVOAQ handles sensitive information;

8. how ELVOAQ handles asset records and proof documents;

9. how AI-assisted features may process data;

10. how payment and support providers may be involved;

11. how cookies and similar technologies may be used;

12. how long data may be retained;

13. where data may be hosted or transferred;

14. how data is protected;

15. what rights users may have;

16. how users can contact ELVOAQ;

17. how this Privacy Policy may be updated.

This Privacy Policy should be read together with the ELVOAQ Terms of Use, Cookie Policy, Refund Policy, subscription terms, Data Processing Agreement where applicable, and any additional legal notices made available by ELVOAQ.

3. Controller

For the purposes of applicable data protection laws, the controller responsible for personal data processed by ELVOAQ is:

Lukas Rajnic, trading as ELVOAQ

Sole trader established in the Slovak Republic

VAT: Not registered for VAT

Email: privacy@elvoaq.com

Website: www.elvoaq.com

Where ELVOAQ processes personal data for its own purposes, Lukas Rajnic acts as the controller.

Where a company, organization, family office, foundation, trust, partnership, association, public body, institution, or other legal entity uses ELVOAQ and determines what personal data is uploaded, stored, shared, or processed in its workspace, that entity may act as an independent controller. In such cases, ELVOAQ may act as a processor or service provider for certain workspace data, depending on the context and applicable agreement.

If you use ELVOAQ through a business or organizational workspace, your organization or workspace administrator may control certain data processing decisions. In that case, privacy requests concerning workspace content may need to be directed to the relevant organization or administrator.

4. Applicable Data Protection Laws

ELVOAQ is operated from the Slovak Republic. Slovak and European Union data protection law may apply, including the General Data Protection Regulation and Act No. 18/2018 Coll. on Personal Data Protection.

Depending on your location, the location of users in your workspace, the nature of the processing, and the services used, other data protection laws may also apply, including the General Data Protection Regulation of the European Union, the UK GDPR, or other applicable privacy and data protection laws.

Where the GDPR or UK GDPR applies, this Privacy Policy is intended to provide information about:

1. the identity and contact details of the controller;

2. purposes of processing;

3. legal bases for processing;

4. legitimate interests where applicable;

5. categories of personal data;

6. recipients or categories of recipients;

7. international transfers;

8. retention periods or retention criteria;

9. data subject rights;

10. right to withdraw consent;

11. right to lodge a complaint;

12. whether data provision is required;

13. automated decision-making, where applicable.

If there is a conflict between this Privacy Policy and mandatory applicable data protection law, mandatory applicable law prevails.

5. Key Definitions

For this Privacy Policy:

“ELVOAQ,” “we,” “us,” or “our” means Lukas Rajnic, a sole trader established in the Slovak Republic, trading as ELVOAQ.

“Platform” means the ELVOAQ website, applications, software, digital vault, asset management tools, document management tools, controlled sharing features, dashboards, user accounts, subscriptions, trial access, demo access, AI-assisted features, customer support, and related services.

“Personal Data” means any information relating to an identified or identifiable natural person.

“Sensitive Personal Data” means personal data that receives special protection under applicable law. Depending on the legal regime, this may include data relating to health, biometric data, genetic data, religious views, political opinions, trade union membership, criminal or administrative proceedings, social security measures, intimate sphere, financial sensitivity, or other protected categories.

“Customer Data” means information, documents, images, files, asset records, descriptions, values, locations, proof documents, private notes, warranties, certificates, contracts, receipts, ownership records, metadata, and other content uploaded, submitted, stored, shared, or processed by users through ELVOAQ.

“Workspace” means a personal, business, family, organization, team, or entity-controlled environment within ELVOAQ.

“Processing” means any operation involving personal data, including collection, storage, use, organization, modification, disclosure, transmission, deletion, restriction, or destruction.

“User” means any person who accesses or uses ELVOAQ.

6. Privacy-First Platform Principle

ELVOAQ is built around privacy, control, discretion, and security.

The Platform may be used to manage valuable assets, ownership records, proof documents, warranties, certificates, contracts, private notes, insurance-related records, family records, business records, and other information that may be sensitive, confidential, commercially relevant, or personally important.

ELVOAQ follows these privacy principles:

1. personal data should be processed lawfully, fairly, and transparently;

2. personal data should be collected for clear and legitimate purposes;

3. personal data should be limited to what is necessary;

4. personal data should be protected by appropriate technical and organizational measures;

5. access should be controlled;

6. sharing should be intentional;

7. privacy should be designed into the platform;

8. users should remain in control of their uploaded records;

9. private vault content should not be treated as advertising inventory;

10. valuable asset records should be handled with discretion.

ELVOAQ does not sell personal data.

ELVOAQ does not use private vault records, uploaded documents, asset ownership records, certificates, warranties, receipts, contracts, or private notes for retargeting advertising.

7. Minimum Age and Minors

ELVOAQ is intended only for users who are at least 18 years old.

By creating an account, accepting an invitation, accessing a workspace, using the Platform, purchasing a subscription, using a trial, or using a demo, you confirm that you are at least 18 years old and have full legal capacity to use ELVOAQ.

ELVOAQ does not knowingly allow independent account registration by persons under 18.

If ELVOAQ becomes aware that personal data has been provided by a person under 18 without appropriate authorization, ELVOAQ may restrict or delete the related account and associated data, subject to applicable law, technical feasibility, legal retention obligations, and legitimate protection interests.

If you believe that a minor has provided personal data to ELVOAQ without appropriate authorization, contact us at privacy@elvoaq.com.

8. Categories of Personal Data We May Process

ELVOAQ may process different categories of personal data depending on how you interact with the Platform.

8.1 Account and Registration Data

When you create an account, register for ELVOAQ, subscribe to a plan, accept an invitation, or join a workspace, we may process:

1. full name;

2. email address;

3. username or account identifier;

4. password in protected form;

5. authentication credentials;

6. phone number, if provided;

7. company name;

8. organization name;

9. role or job title;

10. account type;

11. workspace membership;

12. user permissions;

13. account creation date;

14. subscription status;

15. account status;

16. login activity;

17. account settings.

8.2 Business and Organization Data

For business, company, organization, or team use, we may process:

1. company name;

2. organization name;

3. business address;

4. billing details;

5. VAT or tax details;

6. authorized representative details;

7. administrator details;

8. user roles;

9. invited user details;

10. team membership;

11. workspace settings;

12. internal access rights;

13. subscription information;

14. business contact details;

15. communication history.

8.3 Customer Data and Asset Records

When you use ELVOAQ to manage assets and records, you may upload or enter information including:

1. asset names;

2. asset descriptions;

3. asset photos;

4. asset values;

5. purchase dates;

6. purchase locations;

7. ownership notes;

8. asset locations;

9. serial numbers;

10. receipts;

11. invoices;

12. certificates;

13. warranties;

14. contracts;

15. provenance records;

16. insurance documents;

17. appraisal documents;

18. service records;

19. private notes;

20. family ownership information;

21. inheritance-related notes;

22. business partner information;

23. internal responsibility records;

24. user-created categories;

25. uploaded files;

26. metadata connected to records.

This data may contain personal data, sensitive personal data, confidential business information, financial information, or third-party information depending on what you upload.

You control what Customer Data you upload. You should not upload unnecessary sensitive information.

8.4 Uploaded Documents and Files

When you upload documents, images, PDFs, contracts, certificates, warranties, receipts, invoices, or other files, we may process:

1. file name;

2. file type;

3. file size;

4. file metadata;

5. upload date;

6. upload user;

7. linked asset record;

8. document content;

9. extracted text, if processing features are used;

10. thumbnails or previews;

11. storage path or technical identifier;

12. version information, if available;

13. deletion status;

14. sharing status;

15. access logs.

Files may contain personal data or third-party confidential data. You are responsible for ensuring that you have the right to upload, store, process, and share such files through ELVOAQ.

8.5 Payment and Billing Data

Because ELVOAQ may use multiple payment providers, payment-related data may be processed by ELVOAQ and/or third-party payment processors.

Payment and billing data may include:

1. billing name;

2. billing email;

3. billing address;

4. company details;

5. VAT / tax details;

6. subscription plan;

7. payment method type;

8. transaction identifiers;

9. invoice details;

10. payment status;

11. refund status;

12. renewal status;

13. fraud prevention signals;

14. payment provider reference numbers.

ELVOAQ generally does not directly store full card numbers where payment processing is handled by third-party payment providers.

Payment providers may act as independent controllers or processors depending on their services, configuration, and applicable law.

8.6 Technical and Device Data

When you access ELVOAQ, we may process technical data such as:

1. IP address;

2. browser type;

3. browser version;

4. operating system;

5. device type;

6. device identifiers;

7. screen resolution;

8. language settings;

9. time zone;

10. referring URL;

11. pages visited;

12. session identifiers;

13. login timestamps;

14. access logs;

15. error logs;

16. security logs;

17. performance data;

18. cookie identifiers;

19. approximate location derived from IP address.

8.7 Usage Data

We may process data about how users interact with ELVOAQ, including:

1. features used;

2. records created;

3. files uploaded;

4. documents attached;

5. sharing actions;

6. workspace activity;

7. settings changes;

8. subscription events;

9. account events;

10. support events;

11. errors encountered;

12. security events;

13. feature preferences;

14. administrative actions;

15. usage frequency.

ELVOAQ currently does not use analytics tools for general tracking based on your provided configuration. However, basic technical logs, server logs, security logs, and operational records may still be processed where necessary to operate and secure the Platform.

8.8 Communications and Support Data

If you contact ELVOAQ, use customer support, submit a ticket, use chat support, send feedback, or communicate with us, we may process:

1. name;

2. email address;

3. phone number, if provided;

4. message content;

5. support ticket details;

6. screenshots;

7. attachments;

8. technical logs shared by you;

9. account information relevant to the issue;

10. chat history;

11. complaint details;

12. feedback;

13. communication metadata.

8.9 Marketing and Newsletter Data

ELVOAQ may send optional marketing communications, product updates, newsletters, or feature announcements where permitted.

Marketing data may include:

1. name;

2. email address;

3. company;

4. marketing preferences;

5. consent records;

6. unsubscribe status;

7. communication history;

8. campaign interaction data, if applicable.

You may unsubscribe from optional marketing communications at any time.

Service, billing, legal, security, and account communications may still be sent even if you unsubscribe from marketing.

8.10 Security and Fraud Prevention Data

To protect users, the Platform, and ELVOAQ, we may process:

1. login attempts;

2. failed authentication events;

3. IP addresses;

4. session data;

5. device information;

6. access logs;

7. suspicious activity signals;

8. account abuse indicators;

9. administrative actions;

10. sharing logs;

11. fraud prevention records;

12. blocked activity records;

13. rate-limit records;

14. audit trails.

8.11 AI-Assisted Feature Data

ELVOAQ may provide AI-assisted, automated, scanning, categorization, classification, recognition, summarization, suggestion, or workflow support features.

Depending on the feature, AI-related processing may involve:

1. asset descriptions;

2. document names;

3. user-entered text;

4. metadata;

5. categories;

6. document classifications;

7. extracted limited information;

8. user prompts;

9. generated suggestions;

10. correction history;

11. feedback on AI outputs.

When you use an AI-assisted feature, the content you submit to it - including uploaded documents and images - is transmitted to our AI provider xAI (Grok) for processing. Nothing is sent unless you use one of those features; the rest of your vault is never transmitted for AI processing.

**Your permission comes first.** Before ELVOAQ sends anything to xAI for the first time, the app shows you what will be sent and who receives it, and asks you to agree. Until you agree, every AI request is refused by ELVOAQ's own servers and no data leaves ELVOAQ. You can withdraw that permission at any time in Settings > AI; the AI features then stop working and nothing further is sent.

**What is sent to xAI:** the messages you write to the AI Assistant; photos you attach to a message or scan with Item Intelligence; when chat memory is switched on, the name, category, condition and price of your ten most recent items together with your category names; and the language you are using the app in.

**What is never sent to xAI:** your name, email address or account details; payment and billing information; items in locked folders; and any item you do not open an AI feature on.

**How it is used:** xAI, LLC (United States) processes this data through its Grok API at api.x.ai solely to generate the reply that ELVOAQ shows you - answering your questions about your collection, identifying an item from a photo, and estimating values or finding duplicates. xAI's handling of the data is governed by its own privacy policy at https://x.ai/legal/privacy-policy.

AI-assisted features are intended to support organization and workflow efficiency. They are not legal, financial, insurance, tax, appraisal, valuation, authenticity, or professional advice.

9. Sources of Personal Data

ELVOAQ may collect personal data from:

1. you directly;

2. account registration forms;

3. subscription and payment flows;

4. documents and files you upload;

5. asset records you create;

6. workspace administrators;

7. companies or organizations inviting you;

8. business account owners;

9. support communications;

10. payment providers;

11. authentication systems;

12. hosting and infrastructure systems;

13. security and server logs;

14. cookies and similar technologies;

15. customer support tools;

16. third parties you authorize.

If someone else uploaded your personal data to ELVOAQ, you should contact the user, organization, or workspace administrator responsible for that upload. ELVOAQ may not always be the controller of Customer Data uploaded by business or organizational users.

10. Purposes of Processing

ELVOAQ may process personal data for the purposes below.

10.1 Providing the Platform

We process personal data to:

1. create and manage accounts;

2. authenticate users;

3. provide access to the Platform;

4. provide digital vault functionality;

5. allow users to create asset records;

6. allow users to upload files;

7. allow users to manage proof documents;

8. provide workspace functionality;

9. provide controlled sharing;

10. process subscriptions;

11. provide trials and demos;

12. maintain user settings;

13. deliver core platform features.

10.2 Managing Asset Records and Documents

We process personal data to allow users to:

1. create structured asset records;

2. upload photos and documents;

3. attach proof documents to assets;

4. organize warranties, certificates, receipts, contracts, and invoices;

5. record private notes;

6. record ownership information;

7. classify asset categories;

8. manage asset values and condition;

9. search and retrieve records;

10. export or share selected information;

11. preserve structured records over time.

10.3 Business and Organizational Workspaces

We process personal data to:

1. create business accounts;

2. create organizational workspaces;

3. invite multiple users;

4. assign roles and permissions;

5. manage administrators;

6. control access;

7. track workspace activity;

8. support internal collaboration;

9. secure business data;

10. support enterprise or organizational use cases.

10.4 Security and Fraud Prevention

We process personal data to:

1. protect accounts;

2. detect suspicious activity;

3. prevent unauthorized access;

4. enforce access controls;

5. investigate security incidents;

6. prevent fraud;

7. prevent abuse;

8. protect infrastructure;

9. protect users;

10. enforce the Terms of Use.

10.5 Controlled Sharing

We process personal data to:

1. generate shared views;

2. manage access links;

3. verify recipient access;

4. send invitations;

5. display selected records to authorized recipients;

6. track sharing status;

7. revoke or restrict access;

8. maintain sharing logs for security.

You are responsible for deciding what information to share and with whom.

10.6 Payments and Subscription Management

We process personal data to:

1. process payments;

2. manage yearly subscriptions;

3. issue invoices;

4. handle payment failures;

5. process refunds according to the Refund Policy;

6. manage taxes where applicable;

7. prevent payment fraud;

8. communicate about billing;

9. manage subscription changes.

10.7 Customer Support

We process personal data to:

1. respond to support requests;

2. troubleshoot technical issues;

3. investigate account problems;

4. assist with billing questions;

5. manage complaints;

6. process feedback;

7. improve support quality;

8. maintain support history.

10.8 Platform Operation and Improvement

We process limited technical and usage data to:

1. operate the Platform;

2. maintain performance;

3. detect errors;

4. improve reliability;

5. improve user experience;

6. fix bugs;

7. develop features;

8. monitor infrastructure;

9. maintain platform security.

ELVOAQ currently does not use analytics tracking tools according to your provided configuration. If analytics are introduced later, this Privacy Policy and the Cookie Policy should be updated.

10.9 Marketing Communications

Where permitted by law, ELVOAQ may process personal data to:

1. send optional newsletters;

2. send product updates;

3. send feature announcements;

4. communicate company updates;

5. manage opt-outs;

6. maintain marketing preference records.

You may unsubscribe from optional marketing communications at any time.

10.10 Legal and Compliance Purposes

We process personal data to:

1. comply with legal obligations;

2. respond to lawful requests;

3. enforce contracts;

4. enforce the Terms of Use;

5. protect legal claims;

6. prevent misuse;

7. prevent unauthorized copying;

8. prevent fraud;

9. protect ELVOAQ’s intellectual property;

10. comply with tax and accounting obligations;

11. resolve disputes;

12. protect users, ELVOAQ, and third parties.

11. Legal Bases for Processing

Depending on applicable law, ELVOAQ may rely on different legal grounds for processing personal data.

Where GDPR or UK GDPR applies, the legal bases may include the following.

11.1 Performance of a Contract

We process personal data where necessary to provide ELVOAQ, manage accounts, deliver subscriptions, provide support, process payments, maintain workspaces, and perform our contractual obligations.

11.2 Legitimate Interests

We may process personal data where necessary for legitimate interests, including:

1. operating ELVOAQ;

2. securing the Platform;

3. preventing fraud;

4. enforcing the Terms of Use;

5. protecting intellectual property;

6. preventing copying, scraping, misuse, and abuse;

7. improving services;

8. maintaining logs;

9. supporting users;

10. managing business operations;

11. handling legal claims;

12. protecting ELVOAQ, users, and third parties.

We rely on legitimate interests only where such interests are not overridden by applicable rights and freedoms.

11.3 Consent

We may rely on consent for:

1. optional marketing communications;

2. optional cookies where required;

3. optional AI-assisted processing where required;

4. certain sensitive personal data processing where required;

5. optional features or integrations.

You may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

11.4 Legal Obligation

We process personal data where necessary to comply with legal obligations, including tax, accounting, corporate, data protection, legal request, regulatory, and recordkeeping obligations.

11.5 Legal Claims

We may process personal data where necessary to establish, exercise, or defend legal claims.

12. Sensitive Personal Data

ELVOAQ is not designed to require sensitive personal data as a condition of basic account registration.

However, users may choose to upload files, documents, images, notes, or records that contain sensitive personal data.

Examples may include:

1. inheritance documents;

2. family records;

3. insurance documents;

4. legal documents;

5. financial records;

6. health-related documents, if uploaded by users;

7. identity documents;

8. court-related records;

9. documents concerning minors;

10. documents containing biometric or identifiable images;

11. documents containing confidential employment or business information.

You should not upload sensitive personal data unless:

1. it is necessary for your use of ELVOAQ;

2. you have the legal right to upload it;

3. you have obtained required consent or authorization;

4. you understand the privacy risks;

5. you have considered whether less sensitive information would be sufficient.

ELVOAQ may process sensitive personal data only as necessary to provide the Platform, comply with law, protect rights, enforce terms, or support features requested by the user, and only to the extent permitted by applicable law.

13. Third-Party Personal Data Uploaded by Users

You may upload or enter personal data about other people, including:

1. family members;

2. employees;

3. contractors;

4. advisors;

5. business partners;

6. buyers;

7. sellers;

8. insurers;

9. legal representatives;

10. recipients of shared records;

11. asset co-owners;

12. beneficiaries;

13. administrators;

14. invited users.

If you upload personal data about third parties, you are responsible for ensuring that:

1. you have a lawful basis or permission;

2. the data is accurate where necessary;

3. the data is not excessive;

4. required notices are provided where applicable;

5. confidentiality obligations are respected;

6. data protection obligations are respected;

7. sharing settings are properly controlled;

8. access is limited to authorized persons.

ELVOAQ is not responsible for your decision to upload, store, disclose, or share third-party personal data, except to the extent required by applicable law.

14. AI-Assisted and Automated Features

ELVOAQ may include AI-assisted or automated features to help users organize records, classify documents, suggest categories, structure information, or improve workflow efficiency.

AI-assisted features may process limited data necessary to provide the requested functionality.

Based on the current platform configuration provided by you:

1. ELVOAQ may include AI-assisted features;

2. content you submit to an AI-assisted feature, including uploaded documents and images, is transmitted to our AI provider xAI (Grok) for processing;

3. AI outputs are for organizational support only;

4. AI outputs are not professional advice;

5. users remain responsible for verifying AI outputs.

AI-assisted features may be inaccurate, incomplete, unsuitable, or outdated. ELVOAQ does not guarantee correctness of AI-generated outputs.

ELVOAQ does not use AI-assisted features to provide legal, financial, insurance, tax, valuation, appraisal, authenticity, compliance, inheritance, or professional advice.

ELVOAQ uses one external AI provider, xAI (Grok). Section 8.11 states exactly what is transmitted to it, what is never transmitted, and what it is used for. ELVOAQ asks for your permission in the app before the first transmission and refuses every AI request until you give it; you can withdraw that permission at any time in Settings > AI.

15. Cookies and Similar Technologies

ELVOAQ uses cookies and similar technologies as described in the ELVOAQ Cookie Policy.

You confirmed that ELVOAQ currently has a cookie banner with options such as Accept All and Customize.

ELVOAQ may use cookies or similar technologies for:

1. core website operation;

2. account login;

3. session security;

4. fraud prevention;

5. user preferences;

6. cookie consent storage;

7. payment flows;

8. support tools;

9. platform functionality.

ELVOAQ currently does not use analytics tracking according to the provided configuration.

ELVOAQ does not use retargeting advertising according to the provided configuration.

Where optional cookies are used, ELVOAQ should provide clear information and consent controls where required by applicable law.

The Cookie Policy provides more detailed information about cookie categories, user choices, and browser controls.

16. No Analytics Tracking

Based on the current ELVOAQ configuration provided by you, ELVOAQ does not use analytics tracking tools.

This means ELVOAQ does not currently use third-party analytics tools such as Google Analytics, Plausible, PostHog, or similar analytics providers for general behavioral tracking.

However, ELVOAQ may still process technical data, server logs, security logs, error logs, and operational records where necessary to:

1. operate the Platform;

2. secure accounts;

3. prevent fraud;

4. detect errors;

5. maintain service reliability;

6. troubleshoot support issues;

7. enforce the Terms of Use;

8. comply with legal obligations.

If ELVOAQ later introduces analytics tools, this Privacy Policy and the Cookie Policy should be updated before or at the time such tools are deployed.

17. No Retargeting Advertising

Based on the current ELVOAQ configuration provided by you, ELVOAQ does not use retargeting advertising.

ELVOAQ does not use private vault content, asset records, proof documents, warranties, certificates, receipts, contracts, private notes, ownership data, or uploaded files to create advertising profiles or retarget users with ads.

If ELVOAQ later introduces advertising or retargeting technologies, this Privacy Policy and the Cookie Policy should be updated, and appropriate consent controls should be implemented where required.

18. Payment Providers

ELVOAQ may use multiple payment providers to process subscriptions, yearly plans, invoices, refunds, and billing-related transactions.

Payment providers may process personal data such as:

1. billing name;

2. billing email;

3. billing address;

4. company name;

5. VAT or tax information;

6. payment method type;

7. transaction identifiers;

8. subscription plan;

9. invoice number;

10. payment status;

11. refund status;

12. fraud prevention data.

Payment providers may act as independent controllers or processors depending on their role and applicable law.

ELVOAQ generally does not directly store full payment card data where payment processing is handled by third-party payment providers.

Users should review the privacy policies of the relevant payment provider used during checkout.

19. Hosting, Infrastructure, and Data Location

ELVOAQ is intended to use a European Union hosting and data management approach.

Based on the current technical configuration provided by you, ELVOAQ may use:

1. European Union hosting or infrastructure;

2. Render, for application hosting in Frankfurt, Germany;

3. Supabase, for database and file storage;

4. Cloudflare, for content delivery and static site hosting;

5. Resend, for transactional email delivery;

6. xAI (Grok), for AI-assisted features only;

7. Apple Push Notification service and Google Firebase Cloud Messaging, for push notifications;

8. backup systems;

9. security and monitoring tools;

10. technical service providers necessary to operate the Platform.

User data is intended to be hosted in the European Union (Frankfurt, Germany) where applicable according to the current platform configuration.

However, some technical providers, payment providers, support providers, communication providers, security providers, infrastructure providers, or subprocessors may process limited data in other countries where legally permitted and subject to appropriate safeguards.

Where personal data is transferred internationally, ELVOAQ uses appropriate safeguards where required by applicable law. These may include:

1. adequacy decisions;

2. standard contractual clauses;

3. data processing agreements;

4. contractual confidentiality obligations;

5. technical and organizational security measures;

6. transfer impact assessments where required;

7. supplementary measures where appropriate.

20. Service Providers and Subprocessors

ELVOAQ may share personal data with trusted service providers and subprocessors where necessary to operate, secure, maintain, support, and improve the Platform.

Categories of providers may include:

1. hosting providers;

2. cloud infrastructure providers;

3. database providers;

4. file storage providers;

5. backup providers;

6. payment providers;

7. email providers;

8. customer support tools;

9. security monitoring providers;

10. error monitoring providers;

11. authentication providers;

12. legal advisors;

13. tax advisors;

14. accounting providers;

15. technical contractors;

16. communication tools.

Service providers are expected to process personal data only as instructed or as otherwise permitted by law.

Where required, ELVOAQ uses contractual safeguards with service providers and subprocessors.

For business and organizational customers, ELVOAQ may provide a subprocessor list or Data Processing Agreement where required or commercially appropriate.

21. Business and Organizational Workspaces

If you use ELVOAQ through a business, company, organization, family office, trust, foundation, partnership, association, or other workspace, your use may be subject to administrator controls.

Workspace administrators may be able to:

1. add users;

2. remove users;

3. assign roles;

4. change permissions;

5. access asset records;

6. access uploaded documents;

7. manage sharing;

8. view activity logs;

9. export data;

10. delete data;

11. modify workspace settings;

12. manage subscriptions.

Your organization may control certain personal data processed in the workspace.

If you have questions about personal data inside a business or organizational workspace, you may need to contact the workspace administrator or organization responsible for that workspace.

22. Controlled Sharing and Recipients

ELVOAQ may allow users to share selected records, files, asset profiles, documents, reports, or views with third parties.

When you share information, personal data may become visible to the selected recipient.

You are responsible for:

1. selecting the correct recipient;

2. verifying recipient identity;

3. deciding what information to share;

4. ensuring sharing is lawful;

5. limiting disclosure to what is necessary;

6. managing access rights;

7. revoking access where necessary;

8. respecting privacy, confidentiality, employment, business, family, inheritance, insurance, and contractual obligations.

ELVOAQ cannot control how recipients use, copy, screenshot, download, forward, store, disclose, or rely on information after they receive access, except where technical controls are available and enforceable.

23. Marketing Communications

ELVOAQ may send optional marketing communications, newsletters, company updates, product updates, or feature announcements where permitted by law.

You may opt out of marketing communications by using the unsubscribe link where available or by contacting privacy@elvoaq.com.

Even if you opt out of marketing communications, ELVOAQ may still send non-marketing communications, including:

1. security notices;

2. account notices;

3. billing notices;

4. subscription notices;

5. support messages;

6. legal notices;

7. privacy notices;

8. service updates;

9. administrative communications.

24. Support Tools and Communications

ELVOAQ may use customer support tools, email support, chat support, ticketing systems, or contact forms to respond to user requests.

Support-related processing may include:

1. reviewing account information relevant to the support request;

2. reviewing user messages;

3. reviewing screenshots or attachments provided by the user;

4. reviewing logs necessary to troubleshoot;

5. documenting support history;

6. responding to user questions;

7. escalating issues internally;

8. resolving billing, account, technical, or platform problems.

Support communications may be retained for service continuity, legal protection, quality control, dispute resolution, security, and operational purposes.

25. Legal and Regulatory Disclosures

ELVOAQ may disclose personal data where necessary to:

1. comply with applicable law;

2. respond to lawful requests;

3. comply with court orders;

4. cooperate with regulators;

5. respond to authorities;

6. enforce the Terms of Use;

7. protect legal claims;

8. prevent fraud;

9. prevent misuse;

10. protect intellectual property;

11. protect platform security;

12. protect ELVOAQ, users, and third parties.

Where legally permitted and appropriate, ELVOAQ may notify affected users of legal requests. However, notification may not be possible or permitted in all cases.

26. Business Transfers

If ELVOAQ is involved in a merger, acquisition, restructuring, financing, investment, sale of assets, corporate transaction, insolvency, or similar event, personal data may be disclosed or transferred as part of that transaction.

In such cases, ELVOAQ will take appropriate steps to protect personal data and ensure that the receiving party handles personal data in accordance with applicable law.

27. Data Retention

ELVOAQ retains personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

1. account status;

2. subscription status;

3. workspace status;

4. user instructions;

5. legal obligations;

6. tax and accounting requirements;

7. dispute resolution needs;

8. security needs;

9. backup cycles;

10. fraud prevention needs;

11. contractual obligations;

12. limitation periods;

13. technical requirements.

27.1 Account Data

Account data may be retained while your account is active and for a reasonable period after closure where necessary for legal, security, billing, operational, or dispute-resolution purposes.

27.2 Customer Data

Customer Data may be retained while your account or workspace remains active, unless deleted by you or an authorized administrator.

After deletion, Customer Data may remain in backups, logs, or archival systems for a limited period before being deleted or overwritten according to technical backup cycles.

27.3 Billing Records

Billing, invoice, tax, accounting, and payment records may be retained for the period required by applicable law.

27.4 Security Logs

Security logs may be retained as necessary to protect the Platform, investigate incidents, prevent fraud, enforce the Terms of Use, and defend legal claims.

27.5 Support Communications

Support records may be retained as necessary to provide service continuity, resolve disputes, improve support, protect legal rights, and maintain operational history.

27.6 Marketing Data

Marketing preference data may be retained until you unsubscribe or object, and suppression records may be retained to ensure that opt-out choices are respected.

28. Deletion of Data

Users may be able to delete certain Customer Data through the Platform.

Deletion may not immediately remove all copies from:

1. backup systems;

2. logs;

3. cached systems;

4. archival systems;

5. payment systems;

6. support systems;

7. legal hold systems.

ELVOAQ may retain certain data where necessary to:

1. comply with legal obligations;

2. resolve disputes;

3. enforce agreements;

4. prevent fraud;

5. protect security;

6. maintain audit records;

7. comply with tax or accounting requirements;

8. establish, exercise, or defend legal claims;

9. respect backup cycles.

Where a business or organizational customer controls a workspace, deletion requests may need to be directed to the relevant workspace administrator.

29. Security Measures

ELVOAQ uses technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

Such measures may include, depending on the system and context:

1. access controls;

2. authentication systems;

3. encrypted transmission;

4. secure infrastructure;

5. restricted administrative access;

6. role-based permissions;

7. logging and monitoring;

8. backup systems;

9. security reviews;

10. vulnerability management;

11. confidentiality obligations;

12. least-privilege access;

13. incident response processes;

14. secure development practices;

15. data separation controls;

16. account security controls.

No digital system is completely secure. ELVOAQ cannot guarantee absolute security.

Users are responsible for:

1. protecting passwords;

2. protecting email accounts;

3. protecting devices;

4. using secure networks;

5. managing workspace access;

6. verifying sharing recipients;

7. protecting exported files;

8. promptly reporting suspicious activity.

30. Security Incidents

If ELVOAQ becomes aware of a personal data breach or security incident affecting personal data, ELVOAQ will assess the incident and take appropriate steps in accordance with applicable law.

Depending on the circumstances, this may include:

1. investigating the incident;

2. containing the issue;

3. securing affected systems;

4. assessing risk to individuals;

5. notifying affected users where required;

6. notifying authorities where required;

7. preserving evidence;

8. improving safeguards.

Not every security event is legally reportable. Notifications will be made where required by applicable law or where ELVOAQ considers notification appropriate.

31. Your Privacy Rights

Depending on your location and applicable law, you may have rights regarding your personal data.

These may include:

1. right to be informed;

2. right of access;

3. right to receive a copy of personal data;

4. right to rectification;

5. right to deletion or erasure;

6. right to restriction of processing;

7. right to object to processing;

8. right to data portability;

9. right to withdraw consent;

10. right to object to direct marketing;

11. right not to be subject to certain automated decisions;

12. right to lodge a complaint with a supervisory authority.

These rights may be subject to limitations, exceptions, identity verification, legal obligations, third-party rights, business customer control, security requirements, and technical feasibility.

32. How to Exercise Your Rights

To exercise privacy rights, contact:

privacy@elvoaq.com

Your request should include:

1. your full name;

2. your ELVOAQ account email address;

3. the right you wish to exercise;

4. enough information for us to identify the relevant data;

5. any relevant context.

ELVOAQ may request additional information to verify your identity before responding.

If the data is controlled by a business customer, organization, employer, family office, administrator, or workspace owner, ELVOAQ may direct you to that controller or coordinate with them as required by applicable law.

ELVOAQ will respond to valid requests within the time required by applicable law.

33. Complaints

If you believe ELVOAQ has processed your personal data unlawfully or improperly, contact:

privacy@elvoaq.com

You may also have the right to contact a competent data protection authority.

For the Slovak Republic, the relevant supervisory authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky).

If GDPR or UK GDPR applies, you may also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or place of alleged infringement.

34. Automated Decision-Making and Profiling

ELVOAQ does not intend to make decisions with legal or similarly significant effects based solely on automated processing unless expressly disclosed and permitted by applicable law.

ELVOAQ may include automated or AI-assisted features that help with:

1. classification;

2. categorization;

3. document organization;

4. asset record suggestions;

5. summaries;

6. search support;

7. workflow support.

Such features support organization and productivity. They do not replace human judgment.

Users remain responsible for reviewing and verifying outputs.

35. Data Accuracy

You are responsible for ensuring that Customer Data you enter or upload is accurate, current, complete, and lawful.

ELVOAQ does not independently verify the accuracy of:

1. asset records;

2. ownership details;

3. asset values;

4. serial numbers;

5. certificates;

6. receipts;

7. warranties;

8. contracts;

9. uploaded documents;

10. private notes;

11. AI-assisted suggestions;

12. user-entered information.

You may update or correct certain data directly through the Platform.

36. Backups and Exports

ELVOAQ may maintain backups for security, continuity, and disaster recovery purposes.

Backups may contain personal data for a limited period before being overwritten or deleted according to backup cycles.

Users may be able to export certain data from the Platform depending on available features and plan type.

Once exported, you are responsible for protecting exported files, reports, records, or documents.

ELVOAQ is not responsible for your external storage, sharing, loss, disclosure, or handling of exported data.

37. Links to Third-Party Websites

The ELVOAQ website or Platform may contain links to third-party websites, services, tools, payment pages, support systems, or external resources.

ELVOAQ is not responsible for the privacy practices, security, content, or policies of third-party websites or services.

You should review the privacy policies of third-party services before using them.

38. Social Media and Public Communications

If you interact with ELVOAQ through social media, public posts, comments, direct messages, or public channels, your personal data may be processed by both ELVOAQ and the relevant platform.

You should not publicly post:

1. account credentials;

2. private asset details;

3. sensitive ownership information;

4. uploaded documents;

5. certificates;

6. warranties;

7. receipts;

8. contracts;

9. private vault information;

10. confidential business records.

Social media platforms process personal data according to their own privacy policies.

39. Job Applicants

If you apply for a role, opportunity, collaboration, internship, contractor position, or future opening at ELVOAQ, we may process:

1. name;

2. contact details;

3. CV;

4. cover letter;

5. portfolio;

6. employment history;

7. education history;

8. references;

9. interview notes;

10. assessment results;

11. salary expectations;

12. work authorization information;

13. communication history.

Applicant data may be used to evaluate candidates, communicate during the recruitment process, manage hiring decisions, and comply with legal obligations.

If you are not selected, ELVOAQ may retain your details for future opportunities in accordance with this Privacy Policy, unless you object or request deletion where applicable.

40. No Sale of Personal Data

ELVOAQ does not sell personal data.

ELVOAQ does not sell private vault content, asset records, proof documents, ownership notes, certificates, warranties, contracts, receipts, private notes, or sensitive customer-uploaded files.

If this position changes in the future, this Privacy Policy will be updated and required choices or consents will be provided where applicable.

41. Privacy by Design and Data Minimization

ELVOAQ aims to design its Platform with privacy in mind.

Where appropriate, ELVOAQ may apply:

1. access controls;

2. role-based permissions;

3. data minimization;

4. purpose limitation;

5. secure defaults;

6. restricted administrative access;

7. audit logging;

8. pseudonymization or aggregation where appropriate;

9. retention controls;

10. controlled sharing mechanisms;

11. security monitoring;

12. account protection.

Users also play a critical role in privacy. You should carefully decide what information to upload, who to invite, what to share, and what to retain.

42. User Responsibilities

When using ELVOAQ, you are responsible for:

1. using the Platform lawfully;

2. uploading only data you are entitled to upload;

3. respecting third-party privacy rights;

4. obtaining required permissions;

5. keeping account credentials secure;

6. managing workspace access;

7. using strong passwords;

8. avoiding unnecessary sensitive uploads;

9. verifying sharing recipients;

10. keeping backups of important data;

11. complying with internal company policies;

12. complying with applicable laws.

You must not use ELVOAQ to unlawfully collect, store, disclose, transfer, conceal, or misuse personal data.

43. Changes to This Privacy Policy

ELVOAQ may update this Privacy Policy from time to time.

Updates may reflect:

1. legal developments;

2. regulatory guidance;

3. product changes;

4. new features;

5. new service providers;

6. new data practices;

7. security updates;

8. operational changes;

9. business changes;

10. changes to hosting, payment, support, or cookie tools.

The updated Privacy Policy will be posted on the ELVOAQ website or made available through the Platform.

If changes are material, ELVOAQ may provide additional notice where required or appropriate.

Your continued use of ELVOAQ after an updated Privacy Policy becomes effective means that you acknowledge the updated Privacy Policy.

44. Contact Details

For privacy questions, requests, complaints, or concerns, contact:

Lukas Rajnic, trading as ELVOAQ

Sole trader established in the Slovak Republic

VAT: Not registered for VAT

Email: privacy@elvoaq.com

Legal: legal@elvoaq.com

Support: support@elvoaq.com

Website: www.elvoaq.com

If you contact ELVOAQ, we may process your contact details and request information to respond, verify identity, manage your request, and comply with legal obligations.

45. Final Privacy Statement

ELVOAQ is built around the belief that valuable assets, proof documents, ownership records, and sensitive information deserve privacy, structure, discretion, and control.

ELVOAQ processes personal data to provide a secure, professional, privacy-first platform for asset records, proof documents, private information, controlled sharing, subscriptions, support, and digital workflows.

ELVOAQ does not sell personal data.

ELVOAQ does not use private vault records as advertising inventory.

ELVOAQ does not use retargeting advertising according to the current platform configuration.

ELVOAQ does not currently use analytics tracking according to the current platform configuration.

ELVOAQ provides AI-assisted features. Content you submit to them, including uploaded documents and images, is transmitted to our AI provider xAI (Grok) for processing. Nothing is sent unless you use one of those features.

Users should upload only what is necessary, protect what matters, share only with intention, and maintain control over sensitive information.

This Privacy Policy is intended to provide transparency about how ELVOAQ handles personal data and to support a trusted privacy-first relationship between ELVOAQ and its users.