Privacy Policy

This Privacy Policy applies to the software platform, websites, APIs, and AI voice services operated by Elamora (“Elamora”, “we”, “us”, or “our”). Under data privacy laws such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA), our role depends on the context of the data being processed:

Depending on how you interact with the Elamora platform, we process the following categories of information:

• Account & Workspace Data: Name, work email address, company name, workspace configuration, billing contact, and encrypted authentication credentials.
• CRM & Contact Records: Lead names, phone numbers, email addresses, custom CRM properties, and appointment booking details entered or synced by workspace users.
• Voice Audio & Transcripts: Audio streams transmitted during inbound and outbound phone calls, synthesized text-to-speech audio files, and automated speech-to-text transcripts generated during AI interactions.
• Knowledgebase Materials (RAG): Textual documents (PDF, DOCX, TXT) and website URLs ingested by your administrators to generate vector embeddings that ground agent responses.
• Telephony Telemetry: Session Initiation Protocol (SIP) response codes, call duration, latency benchmarks, packet loss telemetry, and carrier routing codes.
• Technical & Log Data: IP addresses, browser user-agent strings, access timestamps, and API call logs utilized for security monitoring and audit trails.

If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following lawful bases established by Article 6 of the GDPR:

• Performance of a Contract (Art. 6(1)(b)): To provision your tenant instance, route voice conversations, execute AI dialogue flows, reserve calendar slots, and provide customer support.
• Legitimate Interests (Art. 6(1)(f)): To secure our infrastructure against malicious attacks, investigate fraudulent telephony traffic, prevent bot abuse, and optimize platform latency.
• Legal & Regulatory Compliance (Art. 6(1)(c)): To satisfy telecommunications regulations (e.g., STIR/SHAKEN identity validation, FCC robocall mitigation rules), tax records, and lawful government requests.
• Consent (Art. 6(1)(a)): Where explicitly solicited for optional marketing communications or non-essential cookies.

Elamora integrates advanced large language models (LLMs), real-time speech processing, and retrieval-augmented generation (RAG) to deliver autonomous voice and chat capabilities. We adhere to clear data governance principles:

Vector embeddings created from your knowledgebase documents are stored within isolated vector partitions in our managed database and are accessed strictly within your tenant's authenticated scope during search queries.

Because Elamora facilitates public switched telephone network (PSTN) calls, specific telecommunications legal frameworks apply:

• Recording Consent Responsibility: Numerous jurisdictions enforce all-party or two-party consent laws governing the recording of telephone conversations (e.g., California Penal Code § 632, German Criminal Code § 201). As the data controller initiating or receiving calls, the Customer is solely responsible for ensuring that all legally mandated recording disclosures are audibly communicated to call participants.
• Automated Disclosures: Elamora provides configurable greeting announcements and audible beeps within agent settings to assist customers in fulfilling call recording disclosure requirements.
• Carrier Telephony Trunks: Telephony traffic is transported via licensed telecommunications carrier networks (including Telnyx LLC) in compliance with STIR/SHAKEN caller identification standards.

Elamora engages vetted third-party vendors (“Sub-processors”) to deliver critical components of our architecture. Each sub-processor is subject to contractual obligations guaranteeing confidentiality and data protection standards no less stringent than those outlined in this policy:

Elamora operates servers and cloud infrastructure primarily in the United States and the European Union. When data is transferred across international borders, we ensure adequate data transfer mechanisms are implemented in compliance with GDPR Chapter V:

• Execution of Standard Contractual Clauses (SCCs) approved by the European Commission.
• Implementation of the UK International Data Transfer Addendum (IDTA).
• Supplemental technical safeguards, including end-to-end transport encryption (TLS 1.3) and AES-256 data at rest encryption.

We implement robust technical and organizational measures (TOMs) designed to prevent accidental loss, unauthorized access, alteration, or disclosure of Customer Data:

• Multi-Tenant Isolation: Relational records and pgvector embeddings are logically partitioned by tenant ID to guarantee cross-tenant isolation.
• Encryption: Data in transit is encrypted using TLS 1.3; data at rest is encrypted using AES-256 standards.
• Retention Periods: Workspace operational data is maintained for the duration of the customer's active subscription. Workspace administrators may configure automated retention rules to purge call transcripts and audio recordings on customizable schedules.
• Post-Termination Purge: Following account cancellation or termination, workspace data is preserved for a 30-day grace window before being permanently and irreversibly purged from our active databases.

Depending on your geographic location, you possess statutory rights regarding your personal information:

To exercise any of these rights, contact our privacy compliance team at privacy@elamora.cloud. If you are an end-user customer of an organization using Elamora, please direct your request directly to that organization (the Data Controller).

Elamora is an enterprise business-to-business (B2B) communications platform and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 16 years of age. If we discover that a minor has provided us with personal information, we will take immediate steps to delete such data from our records.