Privacy Policy
How Elan8 processes personal data under Dutch and EU law.
Last updated: Fri Nov 06 2026 01:00:00 GMT+0100 (Midden-Europese standaardtijd)
1. Who we are
Elan8 is established in the Netherlands and is the controller for the personal data described here.
- Company name: Elan8
- Address: Waterwilg 22, Sint Oedenrode, The Netherlands
- KvK number: 81302967
- VAT number: NL002753247B82
2. Data we process
Website visitors
- Aggregate usage statistics from our self-hosted Liwan analytics, without cookies and without identifying you.
- What you send through the contact form: name, email address, subject and message.
Account holders
- Account and sign-in data: name, email address, verification status, password (stored only as a secure hash by our identity service) and second-factor enrolment.
- Account activity needed to run the service: sign-ins and sessions, trial start and end, subscription status and period, licenses issued to your account, and an audit trail of changes made by you or by our operators.
- Support correspondence.
Customers
- From Paddle, our reseller: the Paddle customer and subscription identifiers, the plan and price, billing period, payment status and your billing country. Paddle processes your payment details, address and invoices as an independent controller under Paddle's privacy notice; Elan8 never receives your card details.
We do not receive your models, documents or other files when you use Elan8 tools; licenses are checked on your own machine.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing your account, trial, subscription and licenses | Performance of a contract |
| Keeping the service and accounts secure, preventing trial abuse | Legitimate interest |
| Answering questions and support requests | Legitimate interest / pre-contractual steps |
| Aggregate website statistics | Legitimate interest |
| Accounting and tax records | Legal obligation |
4. Who receives data
We use service providers (processors) to run our services; they are listed on the Subprocessor List. Paddle receives data as our reseller and independent controller. We do not sell personal data or use it for advertising.
5. International transfers
Our services, databases and backups run in the EU. Some providers, such as Resend and Paddle, are companies outside the EEA; where data is transferred outside the EEA, we rely on appropriate safeguards such as an adequacy decision or Standard Contractual Clauses.
6. Retention
- Account data: while your account exists. When you close your account, sign-in is switched off and your data is kept for 90 days to handle refunds, disputes and accounts closed by mistake, then deleted.
- Trial history: kept with your account, so a trial cannot be restarted, and deleted with it.
- Subscription and billing records: 7 years, as Dutch tax and accounting law requires. Paddle keeps its own invoices and payment records.
- Sign-in and security logs: 12 months.
- Contact messages: 12 months after the conversation ends, unless they become part of a customer case.
- Website statistics: aggregate only.
- Backups: our databases are backed up every hour, encrypted, and kept for up to 12 months. Data deleted from the service disappears from backups as they expire; backups are not edited.
7. Your rights
Under the GDPR you may have rights to access, rectify, erase, restrict or object to processing, and to data portability. To use them, contact us via our contact page; we will verify that the request comes from the account holder. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Security
Accounts are protected by passwords and, for operators, a mandatory second factor. Data is transmitted over HTTPS. Our services and databases run in DigitalOcean's Amsterdam region, and backups are encrypted before they leave the server.
9. Changes
We may update this policy. Material changes are announced on this page and, for account holders, by email.
10. Contact
For privacy requests, email support@elan8.com or use our contact page.