Privacy Policy — ELK Ads Engine
Version 1.1 — effective 14 October 2026
1. Data controller
The ELK Ads Engine service, available at https://ads.elkconsultingltd.com (the "Service"), is operated by ELK Consulting LTD, a company incorporated in the Republic of Mauritius under business registration number C24212728, with its registered office at Royal Road, Bain Boeuf, Republic of Mauritius ("ELK", "we", "us").
In Cameroon, ELK Consulting LTD is represented by ITCWEB SARL.
ELK acts as the controller of the personal data described below within the meaning of the Mauritius Data Protection Act 2017 and, where applicable, Regulation (EU) 2016/679 (the "GDPR").
For any question about your data or to exercise your rights: contact@elkconsultingltd.com — +230 5843 6113.
2. Data processed, purposes and legal bases
| Category of data | Purpose | Legal basis |
|---|---|---|
| Identity and account data: name, email address, password (stored only as a non-reversible hash), language, time zone | Creating, managing and securing the account; communicating in the user’s language | Performance of the contract |
| Strong authentication data: authenticator secret and backup codes (stored encrypted) | Securing access to the account | Performance of the contract; legitimate interest (security) |
| Connection data: IP address, browser type, timestamps | Maintaining the session, preventing fraud and abuse, limiting attacks | Legitimate interest (security of the Service) |
| Organization, workspace and project data: name, country, currency, website and app addresses, target countries and languages | Providing the Service | Performance of the contract |
| Invited members’ data: email address, role | Team collaboration within an organization | Performance of the contract; legitimate interest of the customer |
| Payment data: plan, amount, currency, status, reference and payment method reported by the payment provider | Activating the plan, issuing receipts, keeping accounting records | Performance of the contract; legal obligation |
| Activity log: operations carried out in an organization, with date and author | Security, traceability and evidence | Legitimate interest |
| Website analysis: public content of the website address you enter for a project (text of a few pages), and the resulting business profile (description, offerings, short quotes from the site, contact details published on the site) | Describing your business so that you can confirm it and ELK can prepare your advertising | Performance of the contract (feature you start) |
| Notification preferences and data requests | Respecting individuals’ choices and rights | Legal obligation; performance of the contract |
ELK does not collect mobile money numbers or card details: they are entered directly on the payment provider’s page.
ELK does not sell personal data and does not use it for advertising.
Website analysis by artificial intelligence
When you start a website analysis, ELK's robot (ELKAdsEngineBot) reads a few public pages of the
website address entered for the project (home page and pages such as about, services, prices,
contact), respecting the site's robots.txt rules, and sends their text to an artificial-intelligence
provider (section 4) to describe the business. Only pages publicly available on the internet are
read; nothing behind a login is accessed.
The text of the pages is not stored: ELK keeps only the resulting profile, the short quotes that support each fact, the addresses of the pages used and the contact details published on the site, for as long as the project exists. You can remove any fact, correct the profile or analyse the site again at any time. Each analysis is metered in AI credits (amount of text processed, provider and model used, cost).
ELK uses its AI providers' business (API) services, under terms that exclude using the submitted content to train their models. The result is produced automatically and may contain errors: it is used only after you have confirmed it, and no decision producing legal effects concerning you is taken on this basis alone.
Before the corresponding feature is made available, this policy will be supplemented to describe the data read from advertising accounts you connect (Meta, Google Ads).
3. Cookies and trackers
The Service sets a single strictly necessary cookie (elk.session_token), which keeps the
authenticated user signed in. It is created at sign-in and deleted at sign-out or account deletion.
The browser also keeps, in its local storage, the identifier of the last organization selected.
No analytics, advertising or third-party tracking cookies are used; strictly necessary trackers do not require consent. Any non-essential tracker introduced later will only be set after your consent has been obtained.
4. Recipients and processors
Data is accessible to:
- authorised members of your organization, for that organization’s data;
- ELK’s processors, strictly to the extent necessary for their services and on ELK’s documented instructions: hosting (Railway Corporation), transactional email delivery (Resend), mobile money payment collection (Fapshi), artificial-intelligence processing for website analysis (Anthropic, PBC; OpenAI, L.L.C. where configured as an alternative provider);
- administrative or judicial authorities, where required by law.
The current list of processors is available on request at contact@elkconsultingltd.com.
5. Transfers outside the Republic of Mauritius
Some processors process data outside the Republic of Mauritius, including in the United States. ELK ensures that such transfers are subject to appropriate safeguards, in particular contractual clauses meeting the requirements of the Data Protection Act 2017 and, for data subject to the GDPR, the standard contractual clauses adopted by the European Commission.
6. Retention periods
- Account and organization data: for as long as the account exists.
- Account deletion: personal data is erased without delay; the user record is replaced by an anonymous identifier so that payment records and the activity log remain consistent. Organizations in which the user was the only member are closed.
- Accounting records (payments, receipts, invoices): for the retention period required by applicable tax and accounting law.
- Website analysis: the business profile and its quotes, for as long as the project exists; the pages' full text is not kept.
- Connection data: sessions are kept until they expire (14 days at most) or until sign-out; server logs are kept by the host for no more than 30 days.
7. Your rights
Under applicable law, you have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time where processing is based on consent.
The Service lets you exercise most of these rights directly from the Settings page: download of your data in a structured format, notification choices and account deletion. Any other request may be sent to contact@elkconsultingltd.com; ELK responds within one month.
You also have the right to lodge a complaint with the competent supervisory authority: in Mauritius, the Data Protection Office; in the European Union, the data protection authority of your country of residence.
8. Security
ELK implements appropriate technical and organisational measures: non-reversible password hashes, two-factor authentication (mandatory for sensitive operations), isolation of each organization’s data at database level, encrypted communications (HTTPS) and restricted access to production systems.
9. Minors
The Service is intended for professionals and is not open to persons under 18 years of age.
10. Changes to this policy
Any material change to this policy will be notified on this page and by email before it takes effect.