Privacy Policy - elivance.eu
Last updated: 6 November 2026. Version: privacy-2026-11-v10.
In short: Elivance Tmi (Lidia Sorokina, Finland) uses your contact details and messages only to answer you and work with your business. Chat replies are written by an AI model (Anthropic, USA). Our calls are recorded by an AI note-taker. We keep enquiries 24 months and chats without an enquiry 90 days. We use statistics and advertising cookies only if you allow them, and we sell nothing. Your rights and all details are below.
1. Who we are
This website is run by Elivance Tmi, a Finnish sole trader business of Lidia Sorokina, business ID (Y-tunnus) 2503638-4, Lappeenranta, Finland. Elivance is the controller of the personal data described here. Contact for anything about your data: lidia@elivance.eu. We have not appointed a data protection officer, as we are not required to. Lidia Sorokina handles privacy questions personally.
2. What data we collect, why, and on what legal basis
Our customers are businesses. When we talk about "you" below, you may be a sole trader (then the contract is with you personally) or a person writing or working for a company (then the contract is with the company, and you are its representative). The legal basis differs:
- Sole trader, or a person acting for themselves: steps before a contract at your request and performing the contract - GDPR Art. 6(1)(b).
- Representative or employee of a company: our legitimate interest in communicating with and serving our business customer and prospect - Art. 6(1)(f). The company is the contracting party, not you.
Our legitimate interest: to answer business enquiries, run and protect this chat, and keep a short record of who asked what, so that we can reply and prepare offers. You can object at any time (section 7).
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| You send the enquiry form | name, email, company, your message, the version of the privacy notice you saw and the time you confirmed it, the page and campaign tags you came from (utm, referrer) | reply to you, prepare an offer | Art. 6(1)(b) or 6(1)(f), see above; channel statistics: Art. 6(1)(f) |
| You use the AI chat assistant without leaving an enquiry | your messages, the assistant's replies, time, a session id | answer your questions, improve the assistant's knowledge base, detect misuse | Art. 6(1)(f) |
| Your chat becomes an enquiry (you send the contact form under the chat with its box ticked) | as above plus your name, email, phone and company if you give them, the version of the checkbox text and the time you sent the form | as for the enquiry form | as for the enquiry form |
| Any use of the chat or form | a pseudonymised code made from your network address (not the address itself), request counts | stop spam and abuse, keep costs capped | Art. 6(1)(f) |
| You schedule a free call or a paid consultation (Cal.com, Stripe) | name, email, company, country, VAT ID, time slot, your answers, payment status (we do not see your card number) | arrange and hold the call, take payment, invoice | Art. 6(1)(b) or 6(1)(f), see above; invoices and accounting: Art. 6(1)(c) legal obligation |
| We hold a call with you | call recording and transcript made by an AI note-taker (see "Calls" below) | write your notes or plan, keep an accurate record of what was agreed | Art. 6(1)(f); where you are the contracting party, also Art. 6(1)(b) |
| We work together (consultation, project, support) | contact details, correspondence, call notes, quotes, invoices | deliver the service, invoicing, accounting | Art. 6(1)(b) or 6(1)(f), see above; Art. 6(1)(c) for accounting |
| You visit the site | technical server logs, including your IP address | keep the site secure and working | Art. 6(1)(f) |
| You allow statistics or marketing cookies in the cookie banner | pages viewed, device and browser data, cookie ids, events such as a sent form, a chat that became an enquiry or a booked call (never the content of your messages) | see which pages help visitors and measure our advertising | consent, Art. 6(1)(a); you can withdraw it at any time with "Cookie settings" in the footer or on the Cookies page |
The contact form under the chat. When a personal reply is needed, a short form opens under the chat for your name and email (phone and company are optional). Its box reads "Save my contact details and this chat so Lidia can reply to me" and is not ticked in advance. Sending the form with the box ticked is how you ask us to keep your details so that we can reply; the legal basis is the one in the table, not consent. The form goes straight to our server and our CRM, not to the AI model. Email addresses, phone numbers in common formats and Finnish personal identity codes typed into the chat messages themselves are always blanked out in what we store.
Calls. Every call we hold with you (the free call and the paid consultation) runs with an AI note-taking assistant (Fireflies) that records and transcribes it, so that Lidia can write your notes or plan. This is a condition of the call, and we say so before you choose a time or pay. It is not based on consent: the basis is our legitimate interest in an accurate record of the call and, where you are the contracting party, the contract. If you do not accept a recorded call, please do not schedule one and write to us instead. A call already scheduled can be cancelled under the normal cancellation rule of our consultation terms; there is no special refund for this reason. Recordings and transcripts are kept up to 12 months. Calls we host run on Google Meet, Zoom or Microsoft Teams; if you prefer, we join a call on your own link. Please tell colleagues who join that the call is recorded.
Preparing for a call. Before a call we look at public information about your company and your professional role: your company's website, public business registers (such as ytj.fi) and your public professional profiles (such as LinkedIn). We use it only to prepare the call and keep short notes with your enquiry, for the same period as the enquiry. Nothing is shared or sold. Legal basis: our legitimate interest in a useful call (Art. 6(1)(f)); you can object at any time.
Giving us your details is voluntary. Without an email address we cannot reply to you; the chat works without one. We do not sell your data.
2a. When we contact you first
We may email Finnish companies and the people in them whose role makes our services relevant to their work: owners or managers of companies with 10-100 staff, and owners and managers of Finnish web shops, including web shops run as a sole trader business (toiminimi). We write to a general company address where it reaches the right person; to a named work address only when the person's role is directly related to what we offer, and we record that check.
- Data: name, work email, job title, company, its business ID, the source and the date we collected the details, and our notes on the company's public website (see 2b).
- Sources: the company's own public website, public business registers (such as ytj.fi) and the business directory of Fonecta Oy (finder.fi). Our first email names the source of your address.
- Legal basis: our legitimate interest in offering our services to businesses (Art. 6(1)(f)). Email marketing follows the Finnish Act on Electronic Communications Services (917/2014), sections 200, 202 and 203: we write to a natural person, including a sole trader, only on the business address the business itself published, and only about the business it runs; every email shows who we are and lets you say no.
- When: our first email comes no later than one month after we collected your details.
- Saying no: reply "ei" (or "no"), or use the unsubscribe link where the email has one. We stop all emails to you at once and delete your other details. To make sure we never write again, we keep only the company's domain or a one-way code made from your email address (not the address itself), with the date and the reason, on a do-not-contact list. A company can ask us not to contact anyone there.
- How long: if you do not reply, your contact details are deleted within 12 months of our last email. A short sales history per company domain (stages, dates, outcome; no names, no email addresses) is kept 24 months from the last contact. Periods for findings, screenshots and report pages are in section 6.
- You can object at any time (section 7).
2b. Our notes on your web shop and the report page
Before we write, we look at the company's public website as a buyer would, and take screenshots of public pages. From them we write a few findings (what works, what could be better). The findings are about the website and the company, not about people; names that appear on public pages, for example in customer reviews, are not copied into our findings or our database.
Screenshots are analysed with an AI model: we send them to Google (Gemini, paid API) to help write the findings. Under Google's terms for paid services, prompts and responses are not used to train its models and are logged only for a limited period; Google processes them as our processor under its data processing addendum. We do not use Google's free tier.
The findings and screenshots are shown on a private report page, raportti.<our sending domain>/r/<code>, linked from our email. The page sets no cookies, loads nothing from other companies and is not indexed by search engines. When the page is opened, our server records that the report with this code was opened, the time and the type of device (for example "mobile"); it does not store your IP address. We use this to know whether the findings were useful and, if the report was opened, we may send one short follow-up email. We do not record scrolling, clicks or time spent on the page.
The report page is deleted 30 days after it was created; after that the link shows a short notice. Legal basis: Art. 6(1)(f), our legitimate interest in offering a relevant service and in learning which findings help; you can object at any time.
2c. Our research mailboxes
To check how a web shop answers buyers, we may use a separate research mailbox of ours: we may subscribe to the shop's newsletter, leave an item in the cart, or ask one question in the shop's chat, always under our real details, without an invented name, and without placing an order. We keep the shop's replies and emails 30 days after the check, then delete them. The name of a staff member who answered the chat is not stored in our findings or our database. Legal basis: Art. 6(1)(f).
2d. Your rights in our outreach
The rights in section 7 apply in full, including the right to object to direct marketing at any time, which we honour at once. The fastest way is to reply "ei" to any of our emails.
2e. AI seller demo for web shops
When a web shop replies yes to our offer of an AI seller test drive, we prepare a closed demo page for it (kokeilu.elivance.eu/m/<code>). The page is not indexed by search engines, sets no cookies and loads no third-party analytics. It shows screenshots of the product blocks of the shop's products we prepared for the demo, taken from the shop's public website (product name, photo, description; no reviews or reviewer names) and our AI seller, which answers questions about these products from the shop's own product pages; each shop has its own demo, and no shop sees another shop's data. The person who opens the page confirms that they represent the shop and allows us to process these pages; the shop can switch to a view without photos, and the screenshots are then deleted.
- Data: the questions typed into the demo and the AI seller's answers. We do not ask for names or contact details and do not store IP addresses. Please do not type personal or order details. Email addresses, phone numbers and long number sequences such as order numbers are replaced with placeholders before the text reaches the AI model and in what we store.
- Purpose and legal basis: to show the shop how the AI seller works on its own products and to send it a short summary of the questions; our legitimate interest in presenting a service the shop asked to try (Art. 6(1)(f)). You can object at any time by email to lidia@elivance.eu; we then delete the conversation.
- Recipients and transfers: Anthropic Ireland, Limited (processing also in the USA) generates the answers as our processor, under the European Commission's Standard Contractual Clauses. Anthropic deletes inputs and outputs within 30 days; content flagged under its usage policy may be kept up to 2 years and safety classification scores up to 7 years; it may not train its models on this content. The demo runs on our server in the EU (OVH).
- Forwarded link: anyone who has the link can ask questions and read the conversation on the page. The shop decides whom it forwards the link to.
- How long: a link that is not opened within 14 days expires with no data. The preview mode runs up to 14 days; the full test drive runs 7 days from the first question in full mode. Everything about the shop (pages, screenshots, product facts, questions and answers, the record of the confirmation, server logs, queues and temporary files) is deleted 30 days after the test drive or preview ends, and at the latest 58 days after we sent the link. There are no backups of demo data. On request we delete earlier, within 2 working days.
- No automated decisions are made about people.
- If the shop later orders the AI seller for its own website, the shop is responsible for its visitors' data, we act as its processor under a data processing agreement, and the shop's own privacy notice applies there.
3. Automatic replies and the AI assistant
After you send the form, our system sends you an automatic confirmation email. The chat assistant on this site, Elli, is an AI system: its first line in the chat says so, and each of its messages is marked as AI-generated. It answers only from our published information and price list, and passes anything unusual to Lidia, who decides and replies herself. No decision with legal or similarly significant effect is made about you automatically. More: About the AI assistant.
How your chat messages reach the AI model: our server sends them directly to Anthropic (USA), the provider of the Claude model that writes the replies, through its API under Anthropic's Commercial Terms and Data Processing Addendum. No other AI provider or routing service receives them. What you type in the chat is sent to Anthropic to write the reply. Before any text is sent, our system replaces email addresses, phone numbers in common international and Finnish formats, Finnish personal identity codes, recognisable card numbers, IBAN account numbers, passwords marked as such and access keys with placeholders such as [email]; they are not restored afterwards. Names, street addresses and everything else you write are not replaced and do reach Anthropic. Contact details you give in the contact form under the chat are not sent to Anthropic at all. Anthropic's commercial data retention policy says inputs and outputs are deleted automatically on its backend within 30 days of receipt or generation, and kept longer only where needed to enforce its Usage Policy or to comply with the law, and under its Commercial Terms it may not train models on this content. Our contracting party is Anthropic Ireland, Limited. (Checked 21 October 2026.) If Anthropic is not available, the assistant does not call any AI model and offers the enquiry form or a free call instead.
4. Who receives your data
| Recipient | Role | Purpose | Data | Location |
|---|---|---|---|---|
| Hetzner Online GmbH | processor | hosting our website, enquiry form and chat | all data in section 2 except call recordings | Germany (EU) |
| OVH SAS | processor | hosting our customer records and invoicing | contact details, enquiries, client records, invoices | France (EU) |
| Anthropic Ireland, Limited (Ireland) | processor | generating chat replies and AI seller demo answers with the Claude model (API); inputs and outputs deleted within 30 days at the latest (content flagged under its usage policy up to 2 years, safety classification scores up to 7 years), no training on them | chat messages, AI seller demo questions | Ireland / USA |
| Spaceship, Inc. (Spacemail), Phoenix, Arizona, USA | processor | our email lidia@elivance.eu and automatic confirmation emails | name, email, message | USA |
| Fireflies.ai Corp. | processor | AI note-taker on our calls (a condition of every call) | call recording and transcript | USA |
| Google Ireland Limited (Ireland); its parent Google LLC (USA) is certified under the EU-US Data Privacy Framework | provider under its own terms (we use a free account for now) | video calls and calendar invitations for calls we host | name, email, meeting time; call audio and video in transit | EU and USA |
| Zoom Communications, Inc. (USA) and Microsoft Corporation (USA, Microsoft Teams), both certified under the EU-US Data Privacy Framework | providers under their own terms (free accounts for now) | video calls we host on these tools | name, email; call audio and video in transit | EU and USA |
| Cal.com, Inc. | processor | scheduling the free call and the paid consultation | name, email, company, time, answers | USA |
| Stripe Payments Europe, Ltd. | processor, and independent controller for its own legal duties (fraud prevention, anti-money-laundering) | card payments (the consultation; invoices of customers outside the EU) | name, email, company, VAT ID, payment data | Ireland, with transfers to Stripe, Inc. (USA) |
| Holvi Payment Services Oy | bank, independent controller under banking law | our business bank account: receiving transfers you make to pay our invoices | name, account details and reference of your payment | Finland (EU) |
| Google Ireland Limited | processor (Gemini API, paid services, under Google's data processing addendum) | analysing screenshots of public web shop pages to write findings (section 2b) | screenshots of public pages | EU and USA |
| OVH SAS | processor | hosting our outreach records and report pages (sections 2a-2b) | as in sections 2a-2c | France (EU) |
| Hetzner Online GmbH | processor | hosting the sending of our outreach emails (section 2a) | name, email, message | Germany (EU) |
| Hostinger International Ltd. (Cyprus), Spaceship, Inc. (Spacemail, USA) and IONOS Cloud S.L.U. (ionos.es, Spain) | processors | our outreach mailboxes: sending our emails and receiving your replies (section 2a) | name, email, message | EU and USA |
| [to be confirmed] | processor | research mailboxes (section 2c) | shop replies and emails | [to be confirmed] |
| Google Ireland Limited (Ireland); its parent Google LLC (USA) is certified under the EU-US Data Privacy Framework | processor (Google Tag Manager and Google Analytics 4, under Google's data processing terms) | statistics on how the site is used, only after you allow statistics cookies | pages viewed, device and browser data, cookie ids, events; IP addresses are not stored by Google Analytics 4 in the EU | EU and USA |
| Meta Platforms Ireland Ltd. (Ireland); its parent Meta Platforms, Inc. (USA) is certified under the EU-US Data Privacy Framework | joint controller with us for collecting and sending the data (Meta's controller addendum), then independent controller | measuring our advertising on Facebook and Instagram (Meta Pixel), only after you allow marketing cookies; the Meta tag then also loads Meta's helper script from the public code hosts cdn.jsdelivr.net or unpkg.com, which receive your IP address | pages viewed, events, cookie ids, device and browser data, IP address | Ireland and USA |
| LinkedIn Ireland Unlimited Company (Ireland); its parent LinkedIn Corporation (USA) is certified under the EU-US Data Privacy Framework | independent controller (LinkedIn's controller addendum) | measuring our advertising on LinkedIn (Insight Tag), only after you allow marketing cookies | pages viewed, events, cookie ids, device and browser data, IP address | Ireland and USA |
| Asana, Inc. | processor | internal follow-up task | request number and a link to our own admin system only | USA |
| An accounting firm, if we use one | own controller under professional duties | accounting and tax | invoices and payment records | Finland |
| Authorities | own controllers | only where the law requires | as required | Finland |
Telegram receives only an internal request number, a fixed topic category and a link to our own system; no personal data.
5. Transfers outside the EU/EEA
Recipients in the USA in section 4 receive data under the EU-US Data Privacy Framework where they are certified, and otherwise under the European Commission's Standard Contractual Clauses. Cal.com, Asana, Stripe, Fireflies.ai, Google, Zoom, Microsoft, Meta and LinkedIn are certified under the Data Privacy Framework (checked on the official list on 21 October 2026, Meta and LinkedIn on 5 November 2026). Anthropic and Spaceship are not on the list; their data processing addenda use the Standard Contractual Clauses. You can ask us for a copy of the safeguards.
6. How long we keep data
| Category | Period | When it changes |
|---|---|---|
| Enquiry (form, or a chat that became an enquiry) that does not lead to work | 24 months from the date of the enquiry | becomes a client record when a quote is accepted or a consultation is paid |
| Client record in our CRM: contact details, correspondence, quotes, call notes | duration of the work and 3 years after it ends (general limitation period) | starts at acceptance of a quote or payment of a consultation |
| Chat without an enquiry | 90 days, then deleted | if it becomes an enquiry, it follows the enquiry periods above |
| AI seller demo for a web shop (pages, screenshots, questions and answers, logs) | 30 days after the test drive or preview ends, at the latest 58 days after we sent the link; no backups | see section 2e |
| Chat ended for threats or repeated harassment | 12 months as evidence (if linked to an enquiry, it follows the enquiry period), visible only to Lidia, then deleted; new chats from the same pseudonymised network address are refused for 24 hours (Art. 6(1)(f), protecting people and the service) | exported only if Lidia decides to report it to the police |
| Pseudonymised network code | kept with the chat and deleted with it; request counters 3 days | - |
| Call recordings and transcripts | up to 12 months | - |
| People we contacted first (section 2a) | 12 months after our last email | ends at once if you say no; then only the do-not-contact entry stays |
| Candidate companies and website snapshots before any email | 30 days | - |
| Do-not-contact list (company domain or a one-way code of an email address, date, reason; nothing else) | kept without end date, so that we can honour the "no" (GDPR Art. 21(3)) | - |
| Sales history per company domain (stages, dates, outcome; no names or email addresses) | 24 months from the last contact | a "no" stays on the do-not-contact list |
| Findings on a web shop and their screenshots | 90 days; 180 days for a company that has not replied, so that a later check can compare | - |
| Report page | 30 days, then a short notice | - |
| Full review page sent after a positive reply | until the conversation ends and 30 days after (it ends with an outcome or after 30 days without emails) | - |
| Report page open records | 90 days | not recorded if page counting is switched off |
| Research mailboxes: chat answers and shop emails (section 2c) | 30 days after the check | - |
| Correspondence with people who replied to our outreach | 12 months after the last email | becomes an enquiry or client record if work starts |
| Server logs of the report pages | 14 days, without IP addresses | - |
| Screen recordings of our walk-throughs of a web shop | 30 days | - |
| Accounting records (invoices, payments) | as the Finnish Accounting Act (1336/1997) requires: 6 years for vouchers (receipts, invoices) and 10 years for financial statements and accounting books, from the end of the financial year (Accounting Act, chapter 2, section 10) | - |
| Scheduling records (Cal.com) | 24 months | - |
| Web server logs | 14 days (daily rotation) | - |
| Statistics and advertising data (Google Analytics 4, Meta, LinkedIn), only with your consent | Google Analytics 4: 14 months; Meta and LinkedIn: as set by them for advertising measurement (see their policies) | stops when you withdraw consent; data already sent stays with the provider for its period |
| Your cookie choice | 6 months in a cookie on your device, then we ask again | you can change it at any time |
| Record of your cookie choices on our server (time, banner text version, choice, page language, a random id from the cookie; no IP address) | 24 months from each choice | a new choice adds a new record |
| Database backups | 14 days, rotating, on our own server | - |
| Record of the notice version you saw and when you confirmed it (form and chat) | as long as the related record | - |
How deletion works. When a period ends, our system deletes the record in our own database automatically. Copies in our CRM, mailbox, task list (Asana) and scheduler (Cal.com) are deleted by hand, on the same request. Stripe, our bank and our accounting records keep payment records as the law requires. Backups expire within 14 days; if we ever restore one, we re-apply the deletions made since then, using a log that holds only internal record numbers, not your data.
7. Your rights
You can ask us to: give you a copy of your data; correct it; delete it; restrict its use; give it to you in a portable format; and you can object to processing based on legitimate interest. You can object at any time to direct marketing; we then stop at once. If you agreed to emails, you can withdraw at any time, without affecting earlier processing. Write to lidia@elivance.eu. We reply within one month. We may ask you to confirm your identity. You can complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (tietosuoja.fi), or to the authority in your country. In the UK: the Information Commissioner's Office (ico.org.uk). UK visitors: we process your data under the UK GDPR as well. US visitors: we are a small Finnish business and do not meet the thresholds of US state privacy laws such as the CCPA; we still honour the rights above for everyone.
8. Cookies and storage on your device
Statistics and marketing tags (Google Tag Manager, Google Analytics 4, Meta Pixel, LinkedIn Insight Tag) load only after you allow them in the cookie banner; Reject is as easy as Accept. We use Google Consent Mode v2 with everything set to "denied" until you choose, and before your choice nothing is loaded from these companies. Your choice is kept in one cookie of our own for 6 months; you can change it at any time with "Cookie settings" in the footer. To be able to show that we asked (GDPR Art. 7(1); Art. 6(1)(c)), our server also records each choice: the time, the version of the banner text, what you chose, the page language and a random id kept in that cookie, without your IP address or browser details; we keep it 24 months. Apart from that, nothing is loaded from other companies until you ask for it. When you start the chat, your browser keeps a chat session id until you close the tab (session storage, not a cookie). The calendar (Cal.com) and payment (Stripe) load only when you click "Show calendar" and may then set their own cookies. Fonts and images come from our own server. Our report pages (section 2b) set no cookies and run no tracking script. Details: Cookies.
9. Children
This site and our services are meant for businesses. We do not knowingly collect data from children.
10. Security and where data is stored
Our own systems - website, form and chat service, database and CRM - run on servers in the EU (Germany and France), with encrypted connections and access limited to Lidia Sorokina. Backups stay on our own server. Some service providers in section 4 are outside the EU; section 5 explains the safeguards. If a breach puts your rights at risk, we notify the authority within 72 hours and inform you where required.
11. Changes
We update this policy when our tools or practices change. The date and version at the top show the current text.