PRIVACY POLICY

Effective date: June 16, 2026 · Last updated: June 16, 2026

This Privacy Policy explains how ELVTR US LLC (“ELVTR”, “we”, “us” or “our”) collects, uses, shares, and protects personal information when you use our website at https://us.elvtr.com  and the online courses and related services we provide (together, the “Services”). It applies whether you are a “Visitor” who browses the Website or a “Subscriber” who has enrolled in a course. In this Policy, “you” means any such user.

This Privacy Policy forms part of, and should be read together with, our Terms of Use at https://us.elvtr.com/terms  (the “Terms”). Capitalized terms we do not define here have the meaning given in the Terms. Our use of cookies and similar technologies is described in our Cookie Policy at https://us.elvtr.com/cookies .

We have written this Policy on a United States legal baseline and added sections that give additional rights to people in the United Kingdom and the European Economic Area (EEA) and to residents of US states with their own privacy laws. Nothing in this Policy limits any right you have under the mandatory data-protection law of your country or state of residence; where that law gives you a greater right, that right applies.

1. Who we are and how to contact us

ELVTR US LLC is the controller of your personal information. You can reach us at:

• Email (privacy): privacy@elvtr.com 
• Post: ELVTR US LLC, 2810 N Church Street, Suite 86079, Wilmington, DE 19802, USA
• Phone: +1 (949) 337-1360

EU representative (GDPR Article 27). For individuals in the EEA, our EU representative is DataRep, who can be contacted at the EEA address provided for your country at https://www.datarep.com/data-request  or by email at privacy@elvtr.com  marked “FAO: DataRep (EU Representative)”.

UK representative (UK GDPR Article 27). For individuals in the United Kingdom, our UK representative is DataRep, contactable at the UK address provided at https://www.datarep.com/data-request  or by email at privacy@elvtr.com  marked “FAO: DataRep (UK Representative)”.

2. The personal information we collect

We collect the following categories of personal information:

• Identifiers and contact details — name, email address, phone number, and the country/region you are in.
• Account information — login credentials, profile details, and your settings and preferences.
• Payment and transaction information — the courses you buy, amounts, dates, and billing details. Card and bank details are collected and processed by our payment providers; we do not store full card numbers.
• Course and usage information — your enrollment, attendance, progress, projects, assignments, and other work you submit, and how you interact with the Services.
• Class recordings — audio and video of live sessions in which you may appear or speak (see Section 4).
• Communications — messages, support requests, reviews, and other content you send us or post.
• Device and technical information — IP address, device type, operating system, browser type, and similar data, including information collected through cookies and similar technologies (see our Cookie Policy).
• Marketing and engagement information — your contact with our campaigns, emails, and ads, and your marketing preferences.
• Inferences — preferences and characteristics we reasonably infer from the above to improve and personalize the Services.

Sources. We collect this information directly from you (when you apply, enroll, communicate with us, or use the Services); automatically as you use the Website (cookies and similar technologies); and from service providers such as our analytics, advertising, and payment partners.

3. How and why we use your information, and our legal bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, we have balanced those interests against your rights and will provide details of that assessment on request. Where we rely on consent, you can withdraw it at any time (this does not affect processing already carried out).

4. Class recordings, your image and your voice

Our courses are delivered live and all class sessions are recorded. Recordings are made available to you and your fellow students in the same course for educational purposes; we rely on our contract with you for this.

Separately, you grant us permission under the Terms to use recordings, and your name, image, voice, submissions, reviews, or testimonials, in our marketing and promotional materials. This permission is revocable: you can decline or withdraw it at any time by emailing privacy@elvtr.com  or team@elvtr.com , and we will stop the relevant future use and, where reasonable, remove the material from materials within our control, although we may be unable to recall materials already published or shared with third parties. We do not use the image, voice, likeness, or contributions of anyone under 18 in marketing, promotion, or advertising. Where the law that applies to you requires your prior consent before we use your image, voice, or testimonial in marketing (for example, in the EEA and the UK), we will obtain that consent first.

We do not apply facial-recognition or voice-recognition technology to recordings, so recordings are not used to uniquely identify you and are not “special category” (biometric) data. If we ever introduce such technology, we will first obtain your explicit consent and carry out a data-protection impact assessment.

If you do not wish to appear in a recording, you can keep your camera and microphone off; you remain responsible for what you choose to share during a session, as described in the Terms.

5. Marketing communications

We send marketing only where we are permitted to: with your consent, or to existing customers about similar courses where the law allows. Every marketing message includes an easy way to unsubscribe, and you can opt out at any time by using that link or emailing privacy@elvtr.com . Even if you opt out of marketing, we will still send you service messages about your account and courses, which are part of the Services.

6. Cookies and similar technologies

We use cookies and similar technologies for essential site functions and, with your consent, for analytics and advertising. You control non-essential cookies through our consent banner and the “Privacy Choices” link on our Website, and we honor recognized opt-out preference signals. Full details, including the specific cookies we use, are in our Cookie Policy at https://us.elvtr.com/cookies .

7. Who we share your information with

We share personal information with:

• Service providers (processors) who help us run the Services, including: Zoom (live classes), Stripe (payments), HubSpot (CRM, email, and support), Webflow (website), Google (analytics and advertising — GA4, Google Ads, Google Tag Manager), Meta (advertising pixel), CookieYes (consent management), and our hosting providers (DigitalOcean, Amazon Web Services, Fastly), among others. These providers may process your information only on our instructions.
• Advertising partners — we disclose certain online identifiers and activity to Google and Meta for advertising and measurement; depending on your location this may be a “sale” or “sharing” of personal information, which you can opt out of (see Section 13).
• Professional advisers, authorities, and others where we reasonably believe disclosure is necessary to comply with law, enforce our Terms, protect our rights or the safety of others, or detect or prevent fraud or wrongdoing.
• In a business transaction — if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred subject to this Policy.

We do not sell your personal information for money. However, because we use advertising technologies, our disclosures to advertising partners may be a “sale” or “sharing” of personal information under certain US state privacy laws — see Section 13 (“Your US state privacy rights”), which explains how to opt out. We do not otherwise rent or sell your personal information except as described in this Policy.

8. International data transfers

We are based in the United States and our service providers operate in the United States and the EEA, so your personal information may be transferred to, and stored in, those locations.

For transfers of EEA and UK personal information to the United States, we rely on the EU-US Data Privacy Framework and its UK Extension where applicable. Where a recipient is not certified under that framework, or as an additional safeguard, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Agreement / Addendum, supported by a transfer risk assessment. You can ask us for more information about these safeguards using the contact details above.

9. How long we keep your information

We keep personal information only for as long as we need it for the purposes described in this Policy, and then delete or anonymize it. Our typical retention periods are:

We may keep information for longer where needed to establish, exercise, or defend legal claims, or where the law requires it.

10. How we protect your information

We use appropriate technical and organizational measures to protect your personal information against loss and unauthorized access, use, alteration, or disclosure, and we store information on secured servers. No transmission over the internet is completely secure, so we cannot guarantee absolute security; you are responsible for keeping your account credentials confidential.

11. Your privacy rights

Depending on where you live, you have some or all of the following rights over your personal information:

• to access a copy of it;
• to correct it if it is inaccurate or incomplete;
• to delete it;
• to restrict or object to our processing of it, including objecting to direct marketing at any time;
• to data portability — to receive it in a portable format or have it transferred;
• to withdraw consent where we rely on consent; and
• not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not currently make such decisions).

To exercise any right, email privacy@elvtr.com . We will respond within the time the applicable law requires — within one month under the GDPR/UK GDPR (extendable for complex requests, with notice) and within 45 days under US state laws (extendable as those laws allow). We will not discriminate against you for exercising your rights. We may need to verify your identity before acting, and an authorized agent may submit a request on your behalf where the law allows. If you are a resident of a US state with its own privacy law, you may have additional rights — including to opt out of targeted advertising and profiling, and to appeal a refusal of your request — as described in Section 13.

12. Additional information for EEA and UK individuals

If you are in the EEA or the UK, ELVTR is the controller of your personal information, our legal bases are set out in Section 3, and you may contact our EU or UK representative (Section 1). You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office). We would, however, welcome the chance to address your concerns first.

13. Your US state privacy rights

This section applies to residents of US states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others). It supplements the rest of this Policy.

Categories we collect, “sell,” and “share.” In the past 12 months we have collected the categories described in Section 2 (identifiers, account information, commercial/payment information, internet and other usage activity, audio/visual information from recordings, and inferences). Because we use advertising technologies such as the Meta Pixel and Google Ads, we “share” (and, under some state laws, “sell”) online identifiers and internet-activity information with advertising partners for cross-context behavioral advertising. We do not exchange your information for money, and we do not “sell” or “share” the personal information of anyone we know to be under 16.

Your rights. Subject to your state’s law, you may: know about and access the personal information we have collected; delete it; correct it; opt out of the “sale” or “sharing” of personal information and of targeted advertising and certain profiling; and limit the use of sensitive personal information. You also have the right to non-discrimination for exercising these rights. In states that provide it, you also have the right to appeal a refusal of your request.

How to opt out of sale/sharing and targeted advertising. Use the “Do Not Sell or Share My Personal Information” / “Privacy Choices” link on our Website, or email privacy@elvtr.com . We also recognize and honor the Global Privacy Control (GPC) opt-out preference signal nationwide; where your browser sends a GPC signal, we treat it as a valid opt-out for that browser and device and will display confirmation where required.

Sensitive information and financial incentives. We do not intentionally collect sensitive personal information in order to infer characteristics about you; where a state requires consent to process sensitive data, we will obtain it. We do not offer financial incentives in exchange for your personal information.

Notice at collection. At or before the point we collect personal information (for example, on our application and sign-up forms), we describe the categories we collect, the purposes, whether we “sell” or “share,” and our retention, with a link to this Policy.

Your state-specific rights at a glance:

If you have unequal access to, or pricing for, our Services because of a privacy choice, that will only ever be a permitted, disclosed difference reasonably related to the value of the data — and we do not currently operate any such program.

14. Children

The Services are intended for people aged 16 and over. For users who are 16 or 17, enrollment requires the involvement and verifiable consent of a parent or legal guardian, as described in the Terms. The Services are not directed to children, and we do not knowingly collect personal information from anyone under 16 without the required parental consent. In particular, in line with the US Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. We do not knowingly “sell” or “share” the personal information of anyone we know to be under 16. If we learn that we have collected personal information from someone under the applicable age without the required consent, we will delete it; you can also contact privacy@elvtr.com . The age of digital consent varies across the EEA (13–16, depending on the country) and is 13 in the UK; we apply parental-consent requirements accordingly. Regardless of the local digital-consent age, the Services have a minimum age of 16 (with verifiable parental consent for 16- and 17-year-olds), as set out in the Terms.

15. Third-party websites and services

The Services may link to, or interoperate with, third-party sites and services (such as payment providers, social platforms, and app stores). Their privacy practices are governed by their own policies, and we are not responsible for them. Please review the privacy policy of any third party before providing your information.

16. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will take reasonable steps to notify you (for example, by email or a notice on the Website) before they take effect, and we will update the “Last updated” date above. Your continued use of the Services after a change takes effect means the updated Policy applies to you, subject to your rights under applicable law.

17. How to contact us and complaints

For any question, request, or complaint about this Policy or your personal information, contact us at privacy@elvtr.com  or by post at ELVTR US LLC, 2810 N Church Street, Suite 86079, Wilmington, DE 19802, USA. EEA and UK individuals may also contact our representative (Section 1) and have the right to complain to a supervisory authority (Section 12).

This Privacy Policy was written in US English. To the extent any translated version conflicts with the English version, the English version controls.