Privacy policy

We work with clients in the United States and around the world, so this policy is written to cover the main privacy laws that may apply to you, wherever you are.

1. Who we are

"Elyon", "we", "us" and "our" mean El Elyon Labs LLC, a Wyoming limited liability company, with its principal place of business at 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA.

For personal information collected through this website and our own business communications, we are the business (or "controller") responsible for it.

2. What this policy covers

This policy covers personal information we handle when you:

visit www.elelyonlabs.com;
send us a message through the contact form, email us, or otherwise get in touch;
are a client, prospective client, supplier or partner, or work for one.

Data we process for our clients. We build and run AI systems for businesses, for example a messaging assistant that a hotel uses to reply to its guests. When we process personal information inside those systems, we do so on our client's behalf and under our written agreement with them, as their service provider (or "processor"). The client decides how that information is used, and their own privacy notice applies. If you are, for example, a guest of one of our clients and have a question about your information, please contact that business directly. We will help them respond.

3. Information we collect

Information you give us

When you use our contact form, we receive your name, work email, your phone number if you give it, and a description of your workflow, plus your company, industry and the hours range you choose if you fill them in. The form sends your message by email to our team mailbox, which runs on Microsoft 365; the website itself does not keep a copy. When you email us or talk to us, we receive what you choose to share: typically your name, email address, company, job title, and the content of your message, including details about your business and its workflows.

Information collected automatically

Hosting. Our website is hosted on Microsoft Azure. Like any web server, it receives technical information when your browser requests a page, such as your IP address, browser type, the page requested and the time of the request, which may be recorded in the hosting provider's standard logs.
Analytics. We measure how the website is used with Microsoft Azure Application Insights, as described in section 4.
Spam protection. The contact form uses a hidden field and a timing check to filter out automated submissions. To limit repeated submissions, it counts messages per connection using a keyed one-way code derived from your IP address. Your IP address itself is not stored, is not added to your message, and these counters are deleted after 48 hours.

Cookies. The only cookies on this website are set by Google Analytics to measure visits (see section 4). We do not use advertising tools or advertising cookies, and we do not track you across other sites. Our fonts are served from our own website, not from a third party. If we add other cookies or tools, we will update this policy first and ask for consent where the law requires it.

Information from other sources

We may receive business contact details from people who introduce us, or from public professional sources such as company websites, when we are exploring working together.

4. Website analytics

We use Microsoft Azure Application Insights to understand which pages are read and which links are used, so we can improve the website. It is set up to collect as little as possible:

No cookies and no identifiers. Application Insights sets no cookies and assigns no user or session ID, so visits cannot be linked to you or to each other.
IP address not stored. Azure uses your IP address only to estimate an approximate location (such as country and region) and then discards it. The stored address is replaced with 0.0.0.0.
What we record. The page you viewed (without any query string), the domain of the website that referred you, how long the page took to load, which of our buttons and links you clicked, whether the contact form was sent (never what you wrote in it), and script error messages.
Campaign tags, this tab only. If you arrive from a link with campaign tags (utm_source, utm_medium, utm_campaign or utm_content), we keep those tags in your browser's session storage so later clicks in the same visit are credited to that campaign. They stay in that browser tab, are cleared when you close it, and are sent only with the analytics events above.
Global Privacy Control respected. If your browser sends a Global Privacy Control signal, the analytics script does not load at all and nothing is recorded.
Retention. Analytics data is kept for 90 days and then deleted.

Google Analytics. We also use Google Analytics 4, provided by Google LLC, to count visits and see how pages are used. It sets first-party cookies (named _ga and _ga_ followed by an ID) that let it recognise a returning browser, and it records the pages you view, the website that referred you, your approximate location, and your device and browser type. Google says Google Analytics 4 does not log or store IP addresses. We use it only for measurement, not for advertising, and the data is kept for no longer than the retention period set in our Google Analytics account, which is at most 14 months. You can block these cookies in your browser settings or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout. For how Google handles this data, see policies.google.com/privacy.

5. How we use it

to reply to you and discuss whether and how we can help;
to scope, deliver, support and bill for our services;
to run, secure and improve the website and our systems, and to prevent misuse;
to keep business records and meet our legal, tax and accounting obligations;
to establish, exercise or defend legal claims.

Legal bases (European Economic Area, United Kingdom and similar laws). We rely on our legitimate interests in running our business, measuring our website and responding to enquiries; performance of a contract with you or your organization, or steps you ask us to take before entering one; legal obligations; and your consent where the law requires it, which you can withdraw at any time.

We do not sell personal information, do not "share" it for cross-context behavioral advertising, and do not use it for automated decisions that have legal or similarly significant effects on you.

We share personal information only as needed, with:

Service providers who work on our behalf under contract. For this website and our own communications, that is Microsoft: Azure for hosting, the contact form and Application Insights, and Microsoft 365 for email.
Google, for Google Analytics, as described in section 4.
Providers used in client work. Client systems we build run on Microsoft Azure, including Azure OpenAI and other Azure services. Any client-specific service providers are set out in each client's agreement.
Professional advisers such as lawyers, accountants and insurers, under confidentiality obligations.
Authorities when the law requires it, or to protect our rights, our clients or others.
A successor business, if we are involved in a merger, acquisition or sale of assets, subject to this policy.

7. International transfers

We are based in the United States, and our team and service providers may process information in the United States and other countries, which may have different data protection laws from yours. Our website and its analytics run in Microsoft's East US 2 region. Where the law requires it, for example for transfers from the European Economic Area, the United Kingdom or Switzerland, we use recognized safeguards such as the European Commission's Standard Contractual Clauses, and our providers' equivalent commitments.

8. How long we keep it

We keep personal information only as long as we need it for the purposes above: typically for the length of our relationship with you or your organization, plus any period required for legal, tax or accounting reasons or to resolve disputes. Enquiries are handled only within our team mailbox, and enquiries that do not lead to working together are deleted 24 months after we receive them. Website analytics are kept for 90 days, and the contact form's anti-spam counters for 48 hours. Hosting logs are kept according to our hosting provider's standard retention.

9. Security

We use administrative, technical and organizational measures designed to protect personal information, including encrypted connections (HTTPS), access controls and limiting access to people who need it. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and will notify you and the relevant authorities of a breach where the law requires.

10. Your rights

Depending on where you live, you may have the right to:

know what personal information we hold about you and get a copy;
correct information that is inaccurate;
have your information deleted;
receive your information in a portable format;
object to, or ask us to restrict, certain processing;
withdraw consent where we rely on it;
not be treated differently for exercising these rights.

California and other US states. Residents of California and other states with comprehensive privacy laws have the rights above as those laws provide, including the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, and we treat a Global Privacy Control signal as a request to opt out. You may use an authorized agent to make a request, and we may need to verify your identity and the agent's authority.

Europe, the UK and elsewhere. You also have the right to complain to your local data protection authority, for example your EU supervisory authority, the UK Information Commissioner's Office, the Office of the Australian Information Commissioner or the Office of the Privacy Commissioner of Canada. We would appreciate the chance to address your concern first.

To exercise any right, email connect@elelyonlabs.com with "Privacy request" in the subject. We will respond within the time the applicable law requires. If your request concerns data we process for one of our clients, we will pass it to that client and help them respond.

11. Children

Our website and services are intended for businesses and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "last updated" date and, if the changes are significant, give you more prominent notice where appropriate.

13. Contact us

Questions or requests: connect@elelyonlabs.com
Post: El Elyon Labs LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA