Authentication
Multi-factor authentication (email or authenticator app) required after signup
- Privileged platform roles (super admin, agency admin) must use MFA
- Password reset and session management via Supabase Auth
Trust Centre
Security and privacy you can verify
Elevale is committed to GDPR, UK GDPR, and global privacy standards. This section explains how we protect your data and where to find our legal documents.
GDPR, data retention, privacy rights, security, audit logging, and legal document links.
What you can expect from Elevale
Plain-language outcomes from our platform documentation: encryption, access control, audit logging, data rights, and retention, without implementation jargon.
Encryption
In transit: TLS 1.2+ for all connections
- At rest: Supabase encrypted storage; OAuth tokens encrypted server-side
- Secrets: API keys stored as hashes; no client-side token encryption
Access control
Row Level Security (RLS) on all tenant data
- Role-based access: system, organisation, and workspace levels
- Custom workspace roles with granular permissions
Your data rights
Under GDPR, UK GDPR, and many US state laws you have rights over your personal data.
- Access: Know what data we hold about you
- Portability: Download your data (JSON export)
- Rectification: Correct inaccurate data in Profile settings
- Erasure: Delete your account or request erasure
Audit logging
Elevale maintains an immutable audit trail for compliance and security accountability.
- Workspace data changes (OKRs, KPIs, tasks, wiki, business brief, process map)
- User and role changes
- Permission and custom role modifications
- Admin actions (user deletion, workspace management)
Retention and deletion
Retention timelines are consistent across billing, automated jobs, and this documentation.
- Grace period: Until end of current billing period; full access continues
- Access ends: At grace period end; account closed; deletion schedule begins
- 60 days after access ends: Personal data anonymised (soft delete)
- 90 days after access ends: Permanent deletion (hard delete)
Clear deletion timelines
Retention periods are consistent across billing, automated jobs, and platform documentation.
View retention policy →Cancelled workspaces
- 1 Grace period
Until end of current billing period; full access continues
- 2 Access ends
At grace period end; account closed; deletion schedule begins
- 3 60 days after access ends
Personal data anonymised (soft delete)
- 4 90 days after access ends
Permanent deletion (hard delete)
Other data categories
- Audit logs Retained 2 years, then purged automatically
- Cookie consent records 1 year
- Privacy requests 3 years after completion (compliance evidence)
- Billing records Retained as required by tax law (typically 6–7 years)
- Backups Supabase encrypted PITR; rolling schedule independent of application lifecycle
- Marketing contact data Until you unsubscribe or request deletion, plus a short suppression record
- Backups Supabase encrypted point-in-time recovery; rolling schedule independent of application lifecycle
Reviews
Help other directors find Elevale
If Elevale is working for your leadership team, a review on G2 or Capterra helps other business directors discover strategic execution software that fits SMEs and growing teams.
Trusted partners behind the platform
Elevale uses trusted subprocessors to deliver the platform. The authoritative list is published at elevale.app/legal/subprocessors. We provide 30 days notice before adding subprocessors that process personal data.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, storage (EU/US regions) |
| Fly.io | Application hosting |
| Stripe | Payment processing |
| OpenAI / Google Gemini | AI chat and embeddings (when enabled) |
| ElevenLabs | Voice mode (when enabled) |
| AWS SES | Transactional email |
Legal and compliance library
All content is published from Elevale platform documentation in Supabase.
Legal documents
Legal
Privacy Policy
agreed at signup
Open document → LegalTerms of Service
agreed at signup
Open document → LegalCookie Policy
branded for Elevale; explains essential and analytics cookies
Open document → LegalAcceptable Use Policy
View the acceptable use policy.
Open document → LegalData Processing Agreement (DPA)
View the data processing agreement (dpa).
Open document → LegalSubprocessor list
View the subprocessor list.
Open document →Compliance guides
Data Processing Agreement
Last updated: 6 August 2026.
Read guide →Privacy Policy
This Privacy Policy explains how Elevale ("we", "us", "our") collects, uses, stores, shares, and protects personal data when you use our platform, marketing website, and related services. It also describes your privacy rights and how to contact us.
Read guide →Acceptable Use Policy
This Acceptable Use Policy ("AUP") applies to all users of Elevale . It is incorporated into our Terms of Service . Violations may result in suspension, account disabling, or termination.
Read guide →Cookie Policy
Last updated: 6 August 2026
Read guide →Data retention and deletion
Retention timelines are consistent across billing, automated deletion jobs, backups, and this documentation. This page explains what we keep, for how long, and how you can delete data yourself.
Read guide →Terms of Service
These Terms of Service ("Terms") govern your access to and use of Elevale . By creating an account, clicking to accept these Terms at signup, or using Elevale, you agree to these Terms, our Privacy Policy , our Cookie Policy , our Acceptable Use Policy , and our Data Processing Agreement (each incorporated by reference). The DPA applies automatically as the processing terms where we (or our infrastructure providers under our instructions) process personal data as processor or sub-processor for your organisation; no separate wet-ink signature is required for the standard online DPA. If you do not agree, do not use the service.
Read guide →Subprocessors and integrations
Last updated: 6 August 2026.
Read guide →Security and data protection
Elevale protects your data with layered authentication, encryption, access controls, and operational safeguards. This page summarises the technical and organisational measures we apply across the platform.
Read guide →Audit logging
Elevale maintains an immutable audit trail for compliance, accountability, and security investigations. This page describes what we log, who can see it, and how long records are kept.
Read guide →Agency and partner data responsibilities
Partners and agencies using Elevale white-label branding have specific data protection responsibilities.
Read guide →Accessibility commitment
Last updated: 20 July 2026. Saint Financial Group Limited is committed to making Elevale accessible to people with disabilities. This page explains our approach, the standards we meet, and how to report barriers you encounter.
Read guide →Incident response and data breaches
Elevale maintains an incident response process to contain threats, protect users, and meet regulatory notification obligations. This page describes our commitments and your role.
Read guide →Referral Agreement
Last updated: 6 August 2026. This Referral Agreement (the "Agreement") governs your participation in the Elevale Referral programme (the "Programme"). Elevale is a trading name of Saint Financial Group Limited. In this Agreement, "Elevale", "we", "us", and "our" mean that registered company trading as Elevale. By enrolling in the Programme and accepting this Agreement (acceptance is recorded with a termsAcceptedAt timestamp and a terms_version ), you agree to be bound by it. If you do not agree, do not enrol or continue in the Programme.
Read guide → Need help?
Questions about security or privacy?
Reach our privacy and security teams directly. Data rights requests are handled within our documented 30-day SLA.