Privacy policy

We take the greatest care in the handling of personal data and ensure that all processing complies with applicable data protection law and the General Data Protection Regulation.

Here you can learn how we handle your personal data and the rights you have over it. If you do not find an answer to your question, you can contact us at privacy@elvo.is

What is Elvo?

Elvo is a customer support desk. Businesses use it to receive and answer messages from their own customers across email, website chat, Facebook and Instagram, WhatsApp and phone. Everything arrives in one shared inbox, where the business's staff read it, assign it and reply. Elvo also drafts suggested replies with AI, which a member of staff reviews before anything is sent.

Elvo is sold to businesses, not to consumers. If you have contacted a company that uses Elvo, that company decides what happens to your data and Elvo processes it on their behalf.

Who is responsible for the data?

This depends on which data is meant, and the distinction matters for your rights.

The business is responsible for the conversations its customers send it, and for everything in them. Elvo processes that data only on documented instructions from the business, under a data processing agreement. If you want your messages to a company deleted, that request goes to the company, not to Elvo.

Elvo is responsible for the accounts of the staff who use the product, for billing details, and for the data collected on elvo.is itself. Requests about those go to Elvo directly, and the section on deleting your account below explains how.

Where does Elvo get personal data from?

From three places. Customers of a business send messages to that business through one of the connected channels, and those messages arrive in Elvo. Staff at the business create accounts in order to use the product. Visitors to elvo.is fill in forms, for example to book a demo or start a trial.

What kind of personal data is processed?

Elvo processes personal data such as:

• Identification of individuals, for example name and email address
• Contact details, for example phone number, email address and social media handle
• Communication data, including email, chat and social messages, subject lines, message content, attachments, and call recordings and transcripts where the phone agent is in use
• Account data for staff who use the product, including name, work email, role, and organisation
• Usage information, for example when a message was received, opened, assigned or answered
• Technical data needed to deliver the service, including IP address, browser or app version, and notification tokens

How does AI process this data?

Elvo uses AI to draft replies, to summarise conversations and to find relevant earlier material. To do that, the content of a conversation is sent to our AI provider for processing.

Three things are worth stating plainly. AI inference and embeddings run inside the EEA. Nothing in a customer's data is used to train the AI provider's models. And a drafted reply is only a draft: it is shown to a member of staff, who decides whether to send it, edit it or discard it.

The mobile apps

The Elvo apps for iPhone and Android show the same support desk as the website, and they process the same data for the same purposes. Two things differ.

The apps register a notification token with Apple or Google so that a notification can reach the device when the app is closed. The token identifies the installation, not the person, and it is deleted when notifications are turned off or the app is removed.

The apps contain no analytics, advertising or crash reporting components. Nothing is collected for measurement, profiling or advertising, and no data is shared with any third party for those purposes. Elvo does not track you across other companies' apps or websites.

Deleting your account

If you have an Elvo account as a member of staff at a business, you can ask for it to be deleted. The account deletion page explains what is removed, what has to be kept and why, and how long it takes.

If you are a customer of a business that uses Elvo and you want your messages deleted, that request goes to the business you contacted. They control that data, and Elvo acts on their instruction.

Who has access to personal data?

Elvo staff only handle personal data when it is necessary for a task they are authorised to carry out, and every member of staff is bound by confidentiality that continues after they leave.

At the business, access is controlled by the business itself. Its administrators decide which of their staff can see which conversations, using the permission and team settings in the product.

Who does Elvo share personal data with?

Elvo does not sell personal data and does not share it with anyone for marketing or advertising.

Elvo does rely on a limited set of subprocessors that are necessary to run the service, covering hosting, databases, caching, real-time messaging, AI inference, email delivery and telephony. Some become subprocessors only when a business chooses to connect them, for example Gmail, Microsoft 365, Meta or an e-commerce platform. The current list, with what each one does and where it operates, is in the data processing agreement.

Where is personal data stored?

Elvo stores and processes personal data within the EEA. Where a subprocessor outside the EEA is required, the transfer relies either on a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or on appropriate safeguards under the General Data Protection Regulation.

How is the security of personal data ensured?

Data is encrypted in transit and at rest, access is restricted to those who need it, and administrative actions are logged. You can read about these measures on our data security page.

How long is personal data kept?

Personal data is kept as long as it is needed for the purpose it was collected for, and in accordance with law. Conversation data belonging to a business is deleted when the service and processing agreement with that business ends. Account data is deleted as described on the account deletion page. Some records, such as issued invoices, are kept for as long as accounting law requires.

What rights do you have?

Under data protection law you have the right to know what personal data is processed about you, to obtain a copy of it, to have it corrected if it is wrong, and in certain circumstances to have it erased or its processing restricted or objected to.

Where the business is the responsible party, address the request to the business, and Elvo will support them in answering it. Where Elvo is the responsible party, write to privacy@elvo.is. We answer within one month.

You also have the right to complain to the Data Protection Authority (Persónuvernd) if you believe your data has been handled unlawfully.

Who to contact

Elvo lausnir ehf., kt. 590925-0630 Tryggvagata 11, 101 Reykjavík, Iceland privacy@elvo.is