Privacy Policy

What we process

Content its authors published openly on social networks, digital media, forums and news sites, about the topics each organization hires us to analyze. For each piece of content we process: the published text, its source link, the date, the outlet or platform where it appeared, the author’s public handle, its public metrics, its location when the source makes it public, and the analytical classifications assigned to it.

Where it comes from

Publicly available sources, specialized providers that collect them, and information supplied by the client organization itself. From these sources we never access private communications, private accounts or content that requires someone else’s credentials.

A client’s own accounts are a different case: we access them only with the client’s express authorization, under the terms of section 5. We never read direct messages on Instagram, Facebook, TikTok or LinkedIn.

Legal basis

The client organization’s legitimate interest in understanding and analyzing the public conversation that concerns it (GDPR art. 6(1)(f); art. 4 of Panama’s Law 81, for data from publicly accessible sources). That interest is weighed against the rights of the people involved, with these safeguards:

• we only process content its author made public, and only content about the contracted topic;
• the purpose is analytical and aggregate: measuring the volume, tone and reach of a conversation, not profiling specific people;
• we don’t enrich the information with data from other sources or match it against external databases;
• no automated decisions with legal effects are made about the people involved;
• access is limited to the organization that contracted the analysis.

Retention

For as long as the organization’s contract is in force, with the historical depth that contract sets. When the contract ends, the information is deleted within 90 days unless the law requires us to keep it.

How an account is connected

• The client authorizes the connection through each platform’s official login, and chooses which accounts, Pages or assets to share.
• We never see or store passwords. The platform gives us an access permission limited to what the client authorized.
• The client can revoke that access at any time, from the dashboard or from the platform itself.

What data we read

Audience statistics are always aggregated —counts and percentages, never data about a specific person. We never read direct messages on Instagram, Facebook, TikTok or LinkedIn.

WhatsApp Business

This is the only integration that isn’t read-only, and the only one that involves data about people other than the client. That’s why it has its own rules:

• We process recipients’ phone numbers, the content of messages sent and received through the integration, their delivery and read statuses, and message templates.
• For this data we act as the client’s processor. The client is the controller: it is responsible for having each recipient’s consent (opt-in) and for complying with the WhatsApp Business Messaging Policy and Meta’s Commerce Policies.
• We use this data only to provide the messaging service to that client. Never for any other purpose, and never for any other client.
• Retention: message content and recipients’ phone numbers are kept only as long as needed to provide the service, and no longer than 90 days after each message is sent, or less if the client instructs us to. Aggregated statistics that don’t identify anyone are kept while the contract is in force. Meta, which hosts the messaging platform, keeps messages for up to 30 days to deliver them, under its own terms.

What we never do

With data from connected accounts, we commit not to:

• sell, license or rent it;
• use it for advertising or to profile individuals;
• use it to train artificial intelligence models, whether ours or anyone else’s;
• share it with data brokers or with other clients;
• combine it with data from other sources to identify individuals;
• post or act on behalf of the account, except for sending the WhatsApp messages the client sets up.

Legal basis

Performance of the contract with the client organization, and its express authorization when it connects each account.

Retention

• Access tokens are stored encrypted and deleted as soon as the account is disconnected or access is revoked.
• Metrics, posts and comments are kept while the account stays connected and the contract is in force.
• When the account is disconnected, access is revoked from the platform, or the contract ends, that data is deleted promptly, and in any case within 10 days.
• If a platform notifies us of a revocation or a deletion request, or the account holder asks us directly, we delete the data within that same period.
• Some platforms cap how long certain data can be stored even while the account is connected —LinkedIn, for example, sets limits for posts, comments and reporting data. Wherever a platform’s terms are stricter than this policy, the platform’s rule applies.

How to revoke access

Full instructions, including how to ask us by email, are on the Data Deletion page.

Platform terms

Our use of this data is also subject to each platform’s terms:

• Meta: Platform Terms · Developer Policies · Meta Business Messaging Technology Provider Terms · WhatsApp Business Solution Terms · WhatsApp Business Messaging Policy · Commerce Policies
• TikTok: TikTok Developer Terms of Service · TikTok Developer Data Sharing Agreement · TikTok API for Business terms
• LinkedIn: API Terms of Use · Marketing Developer Terms

Each platform also processes this data under its own privacy policy: Meta · Instagram · Threads · WhatsApp · TikTok · LinkedIn.

What it holds

• facts about the organization (for example, how it is structured or what it works on), topics it asked us to keep an eye on, and notable episodes;
• the preferences of each user (for example, the format, language or tone they like).

Each item is a short piece of text. It is kept apart from the conversation it came from, so it is not deleted with that conversation after 30 days (see section 3).

Where it comes from

From the user’s conversations with the assistant and, in some cases, from public content analyzed for the organization (section 4). Items that come from public content are marked as such and are used as context, not as established facts. Elevate staff can also add items for an organization.

Who reviews it

What the assistant picks up from a conversation is only a proposal. Elevate staff review it, and the assistant does not use it until it is confirmed. Proposals that are rejected are deleted within 90 days.

What it is used for, and what it is not

• It is used only to tailor the assistant’s answers for that organization.
• It is never shared with other organizations.
• It is not used to train artificial intelligence models, ours or anyone else’s.

The legal basis is the performance of the contract with the organization, and our legitimate interest in the quality of the service. For the organization’s facts we act as its processor; for a user’s preferences we are the controller (section 2).

How long we keep it

Until Elevate closes its validity, until it is deleted at your request, or until the organization’s contract ends, in which case it is deleted within 90 days.

A request to correct or delete an item, including its text, is kept for one year after it is resolved, as a record that it was handled, even if the item itself has already been deleted.

How to see it and delete it

Every member can see what the assistant remembers in the dashboard, under Settings, then What your analyst knows. There, each user can erase their own preferences immediately, and an organization admin can ask us to correct or delete the organization’s facts. You can also write to info@elevatemedialabs.com and we will handle your request as described in Your rights.

How to exercise them

Write to info@elevatemedialabs.com saying which right you want to exercise. We may ask you to confirm your identity, only so we don’t hand your data to someone else. We reply within 30 calendar days; if the request is complex, we’ll tell you and the deadline may be extended by another 30 days.

To ask us to delete data from a connected account —or, if you aren’t a client, your comment or your messages— follow the steps on the Data Deletion page.

Complaints to a supervisory authority

You can file a complaint with Panama’s National Authority for Transparency and Access to Information (ANTAI). If you live in the European Union, you can go to your country’s supervisory authority —in Spain, the Agencia Española de Protección de Datos. You don’t need to contact us first, though we’d appreciate the chance to fix it.