Privacy Policy

This policy lays out what we collect and why, how it's handled, and what rights you have over it.

This policy applies to Blue Whale Software, LLC ("we", "our", "us") and to the hosted Elmo service, our websites and other online properties, and our APIs (together, the "Services").

If you self-host Elmo, we don't see the data inside your instance — not your brands, prompts, or results. Unless you turn telemetry off, your instance and the CLI do send us usage telemetry, and that is covered by this policy. It is things like a random deployment identifier, version and platform details, which commands and features get used and how often, usually as counts rather than content, and the IP address the event arrives from. If you gave us an email address when you set it up, we hold that too — separately from the telemetry switch, since typing your email is its own deliberate act. Telemetry describes what we send today and how to turn it off.

This policy covers our handling of information about site visitors, prospective customers, and customers and their authorized users. We refer to all of you as "you" throughout.

It does not cover information about a customer's own end users that we process on that customer's behalf. For that data the customer is the controller and we are the processor; our obligations are set out in the Terms of Service and any data processing addendum we've signed with them.

When you sign up we collect what we need to create and run your account — things like your name, email address, and a password, or the profile details your identity provider hands us if you sign in with Google or a similar service. That's so you can have an account, so we can reach you, so your teammates can tell who's who, and so we can run, secure, and improve the Services.

We use your email address for the service email your account depends on — verification, password resets, teammate invitations, billing and account notices — and, if you opt in, for product news and other marketing. Marketing email carries a way to unsubscribe. Service email doesn't, because your account depends on it.

If you subscribe to a paid plan you'll provide payment and billing details. Card details go to our payment processor rather than to us. We keep the billing records that go with your account — transactions, invoices, and billing details — so we can charge you correctly, calculate tax, support you when something looks wrong, detect fraud, and meet our accounting and legal obligations.

We store the content you create in Elmo — the brands you track, the competitors and prompts you configure, the answers Elmo collects from answer engines on your behalf, the reports built from them, and anything else you put into the product. This is what the product is. We generally keep it while the account is open; see Data retention for how to have it deleted.

We log IP addresses when an account is created and when people sign in, and use them for things like security, fraud prevention, abuse mitigation, analytics, and approximate location. We keep them for as long as they're useful for those purposes.

We collect information about browsing activity on our websites and in the product for analytics, product development, and marketing measurement — things like which pages were visited, how long they took to load, what referred you, which features got used, and general browser and device information.

We use more than one analytics tool and they behave differently. Some are cookieless. Others set cookies or store an identifier in your browser, and those only load where we're allowed to load them — see Advertising and cookies below. Whichever we're using at a given time is listed at Subprocessors; today that includes Plausible for cookieless web analytics and PostHog for product analytics. We proxy some of them through our own domain so they aren't blocked by ad blockers.

Some analytics tools record how a page was used, including session replay — a reconstruction of a visit showing clicks, scrolling, and the content that was on screen. Where we run it, it counts as analytics and follows your analytics choice.

We advertise Elmo on third-party platforms, and where permissible under law we may load advertising and conversion-measurement tags from those platforms — such as Google Ads, Meta (Facebook and Instagram), LinkedIn, X, and Reddit. Tags like these set third-party cookies and report back which ad you clicked and whether you did something afterwards, such as starting a signup. They are how we tell whether our advertising works at all.

We have not sold personal information. Some U.S. state privacy laws treat advertising tags like these as "sharing" for cross-context behavioral advertising; where that applies, your cookie choices and the Global Privacy Control signal are how you turn it off.

We also use first-party cookies to keep you signed in, to remember preferences, and to remember your cookie choices.

Where consent is required — currently the EEA, the UK, and Switzerland — no analytics or advertising cookie is set until you accept one. You'll see a banner on your first visit and you can change your answer at any time from the cookie preferences control on our site. Strictly necessary cookies, such as your session and your consent record itself, are always set; without them the site cannot work.

The full list of what we set and why is in our Cookie Policy.

You can also adjust cookie retention and block individual cookies in your browser settings, though parts of the product will not work if you turn cookies off entirely.

When you email us, or start a chat with us on our website, we keep that correspondence — including your email address — so we have a history to reference if you get in touch again. Chat is provided by a third party listed in our Subprocessors page.

We also store information you volunteer, like responses to a survey or a research call. If we want to record a conversation, we'll ask first.

When something breaks we collect diagnostic information so we can fix it — the error and the context around it, which typically includes stack traces, request and browser details, IP address, the account involved, and whatever state the error touched. Some of that goes to our error-monitoring provider, and it can include fragments of the content involved.

To provide the Services. We use third-party subprocessors for hosting, storage, email, payments, error monitoring, analytics, and the AI and search providers Elmo queries on your behalf. The current list, what each one does, and where it operates, is published at Subprocessors.

With your direction. If you connect a third-party service to Elmo, or ask us to send data somewhere, we may do that.

To operate the Services. We may access your account to provide, support, maintain, secure, and improve the Services.

To investigate or act on prohibited use. See our Acceptable Use policy.

To protect rights and safety. We may access or disclose information where we believe it's necessary to protect the rights, property, or safety of Blue Whale Software, our customers, or others.

Aggregated and de-identified data. We may aggregate or de-identify information collected through the Services and use it for any purpose, including improving Elmo and publishing industry research. De-identified data does not identify you or your organization.

When required by law. We may preserve or disclose information where we believe in good faith that it's required by law, legal process, or a government request, including tax and accounting obligations.

If we're acquired. We don't plan on it, but if Blue Whale Software is acquired by or merges with another company, your information may be part of what transfers and may become subject to a different privacy policy.

Depending on where you are, you may have some or all of the following rights:

To exercise any of them, email privacy@elmohq.com, or write to Blue Whale Software, LLC, 2108 N St Ste 4414, Sacramento, CA 95816, USA. We may need to verify your identity before responding — usually by confirming your name and the email address on the account. If an authorized agent contacts us on your behalf, we'll need written consent from the account holder first.

If we deny a request and applicable law gives you a right to appeal, we'll explain how in our response.

We use reasonable administrative, technical, and physical safeguards to protect personal information. No system is perfectly secure, and we can't guarantee the security of information you send us.

If you believe you've found a security vulnerability, please email security@elmohq.com rather than filing a public issue. Our full disclosure policy is in the repository.

Content you delete in the product stops being available there. Our backups roll over on a schedule, so a copy can survive in a backup until that backup expires.

Cancelling a subscription is not a deletion request, and it is not a guarantee of storage. It stops Elmo collecting anything new and closes off the paid features. It does not on its own erase what is already in the account, and it does not commit us to keeping it: a dormant account may be closed under the Terms, and closing an account may delete what is in it. If there's anything you want, ask us for a copy before you cancel.

To actually have it deleted, ask us at privacy@elmohq.com. We will delete your account and its contents from our active systems within the time applicable law allows, and remaining copies drop out of our backups as those backups expire. Once that is done we cannot recover any of it, so ask us for a copy first if you want one.

We keep information for as long as we need it for the purpose we collected it, and then we delete or aggregate it.

Account content has no fixed retention period in either direction. We generally keep it while the account is open, because that is the product; we delete it when you ask us to, and may delete it when an account is closed under the Terms. We neither purge it on a schedule nor undertake to preserve it indefinitely.

Billing records are the other exception. We have to keep invoices and transaction records to meet tax and accounting obligations, so those survive an account deletion.

We may also keep information longer where we have to: to comply with a legal obligation, resolve a dispute, or enforce our agreements.

The Services are operated from the United States, and some of the providers behind them operate in other countries — see Subprocessors for which. If you are located in the European Economic Area, the United Kingdom, Switzerland, or anywhere else outside the United States, assume any information you provide will be transferred to and stored in the United States.

Personal data transferred out of the EEA, the UK, or Switzerland must be given equivalent protection. Where we act as a processor for a customer subject to those laws, we will put an appropriate transfer mechanism in place — normally a data processing addendum incorporating the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where relevant. Email privacy@elmohq.com to request one.

Occasional transfers that aren't covered by a customer agreement — someone signing up for our newsletter, or filling in a contact form — rely on the Article 49 derogations, such as 49(1)(b).

The Services are not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email privacy@elmohq.com and we'll delete it.

We may update this policy to reflect new practices or new legal requirements. These policies live in our public repository, so every change is visible there, and we refresh the date at the top of this page whenever we make one.

Questions, comments, or concerns about this policy, your data, or your rights? Email privacy@elmohq.com and we'll do our best to answer. Our mailing address is Blue Whale Software, LLC, 2108 N St Ste 4414, Sacramento, CA 95816, USA.

Adapted from the Basecamp open-source policies / CC BY 4.0, with modifications.