Privacy Policy

1. Information we collect

• Account information. Your name, email, organization name, and authentication identifiers used to sign in.
• Integration credentials. OAuth access and refresh tokens for the services you connect (GitHub, Notion, Slack, Vercel, Google Workspace). These are stored encrypted and used only to perform the work you assign.
• Project content. Source code, repository metadata, task descriptions, board cards, messages, and documents that Elisha reads or writes while completing a task you assign.
• Your own application secrets. Environment variables you add through the .env manager, stored encrypted and injected only into the isolated sandbox that runs your task.
• Usage and operational data. Task history, agent run traces, token and cost accounting, logs, and error diagnostics used to operate and improve the service.

2. How we use it

• To perform the coding, review, and communication tasks you assign to Elisha.
• To open pull requests, run tests, and report status back on the surface you used.
• To authenticate you and keep your organization's data isolated from others.
• To meter usage, bill accurately, and enforce spending limits.
• To secure, debug, and improve the service.

We do not sell your data, and we do not use your private source code or project content to train foundation models.

3. Multi-tenant isolation

Each organization's data is scoped and isolated. Credentials, repositories, tasks, and traces are partitioned per organization, and every inbound webhook is cross-checked against the workspace and installation that owns it so one customer can never read or act on another customer's data.

4. Subprocessors

Elisha relies on trusted infrastructure and AI providers to deliver the service. These may include:

• Google Cloud Platform — hosting, database, task queue, and key management.
• Anthropic (Claude) — the models that power Elisha's reasoning and code generation.
• Daytona — isolated sandboxes where your code is cloned and tests are run.
• Daily, Deepgram, and ElevenLabs — real-time voice transport, speech-to-text, and text-to-speech.
• Recall.ai — meeting attendance for 1:1 sessions you initiate.

Providers process data only to deliver their part of the service and under their own confidentiality and security commitments.

5. Security

Integration tokens and application secrets are encrypted using envelope encryption backed by a cloud key management service. Access to production systems is restricted, and code is executed only inside ephemeral, per-task sandboxes that are destroyed when the task ends.

6. Data retention

We keep your data for as long as your account is active or as needed to provide the service. You can disconnect any integration at any time, which revokes Elisha's access to that service. On account deletion we remove your stored credentials and project content, subject to legal and operational retention requirements.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at the address below.

8. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you through the service.

9. Contact

Questions about this policy or your data? Email privacy@elisha.dev.