Privacy Policy

1. Who we are

Elicivo ("we", "us", or "our") provides an AI-assisted performance review platform. Elicivo is currently a trading name. Legal entity details will be updated prior to first paying subscriber.

For privacy-related enquiries, contact us at privacy@elicivo.com.

2. Scope

This Privacy Policy applies to personal data collected through elicivo.com (our marketing site) and app.elicivo.com (our product application).

When a workspace admin uses Elicivo to run performance reviews for their organisation, the employer is typically the data controller for employee, reviewer, and reviewee data. Elicivo acts as a data processor on the employer's behalf. Those arrangements are described in our Data Processing Agreement.

3. Data we collect

We may collect and process the following categories of personal data:

• Account data: name, email address, and hashed password for registered users.
• Workspace data: workspace name, membership roles, invitations, and configuration settings.
• Employee records: name, email, department, and review cadence, entered manually by workspace admins. Future HR system integrations may import additional employee data.
• Reviewer and participant data: reviewer name, optional reviewer email, full conversation transcripts, per-criterion scores, score adjustments, and justifications.
• AI-generated assessments: agent scores, agent justifications, aggregation narratives, discrepancy flags, and overall scores relating to reviewees.
• Audit events: hash-chained logs of actions taken by agents, participants, workspace members, and system processes.
• Billing and credit data: subscription details, credit wallet balances, and transaction history. Payment card data is handled exclusively by our payment processor and is not stored by Elicivo.
• Cookies and analytics: on elicivo.com, we use cookies and similar technologies for essential site operation and, with your consent, analytics. Google Analytics collects IP address, device and browser information, and session data on our behalf.

4. Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Contract: to create and manage your account, provide the service, and process subscriptions.
• Legitimate interests: to secure and operate the platform, maintain audit logs, prevent abuse, and improve reliability. Our legitimate interests are balanced against your rights.
• Legitimate interests of the employer: for reviewer and participant data processed during review cycles on behalf of workspace admins.
• Legal obligation: to retain billing and accounting records as required by applicable law.
• Consent: for non-essential cookies and analytics on elicivo.com, where required.

5. How we use your data

• Provide, operate, and maintain the Elicivo platform.
• Authenticate users and manage workspace access.
• Conduct AI-assisted review interviews, scoring, and aggregation on instructions from workspace admins.
• Maintain audit trails and support dispute resolution.
• Process subscriptions, credits, and billing.
• Send service, security, and account-related communications.
• Analyse marketing site usage where consent has been given.
• Comply with legal obligations and enforce our terms.

6. Sub-processors

We use third-party service providers to operate Elicivo. The following sub-processors may process personal data on our behalf:

If our email provider or payment processor changes before or after launch, we will update this list. Workspace customers will be notified of material sub-processor changes in accordance with our Data Processing Agreement.

7. International data transfers

Personal data processed through the Elicivo platform is stored and processed in AWS eu-west-1 (Ireland), within the European Economic Area. We do not intentionally transfer platform data outside the EEA for processing.

Google Analytics on the marketing site may involve transfers outside the EEA where you have consented to analytics cookies.

8. Retention

We retain personal data for the following periods:

• Active account data: for the duration of your account, then deleted within 30 days of account closure.
• Chat transcripts and scores: for the duration of the workspace subscription plus 12 months.
• Audit logs: for the duration of the workspace subscription plus 12 months.
• Deleted workspace data: purged within 60 days of workspace deletion or termination.
• Billing records: up to 7 years, where required for accounting and tax purposes.

9. AI and automated decision-making

Elicivo uses artificial intelligence to conduct review interviews, map conversations to scoring criteria, and generate aggregated reports.

Elicivo is designed to inform human decisions, not replace them. AI-generated scores and narratives are not final or binding. A workspace admin must review and finalise every report before it is used. Elicivo is not intended to automate employment decisions.

Reviewers may adjust scores during the review process. Reports do not replace person-to-person discussions, negotiations, or explanations between employers and employees.

Where configured by the employer, participants may be informed that an alignment setting configured by the employer is in use. The specific alignment value may be disclosed at the employer's discretion.

If you believe an AI-generated assessment is inaccurate, contact your employer (the data controller) or email privacy@elicivo.com and we will assist as processor where appropriate.

10. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure in certain circumstances.
• Restrict processing in certain circumstances.
• Data portability, where applicable.
• Object to processing based on legitimate interests.
• Not be subject to solely automated decisions with legal or similarly significant effects, where applicable.
• Withdraw consent for consent-based processing.

To exercise these rights, contact privacy@elicivo.com. If your data was submitted by your employer as part of a review cycle, we may direct you to your employer as the data controller.

You also have the right to lodge a complaint with a supervisory authority, such as the Information Commissioner's Office (UK) or your local EU data protection authority.

11. Security

We implement appropriate technical and organisational measures, including:

• TLS encryption for data in transit.
• SSL enforced on all database connections.
• Database credentials stored in AWS Secrets Manager.
• Access controls limiting production access to named individuals.

If we become aware of a personal data breach likely to pose a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and affected individuals without undue delay where required by law.

12. Children

Elicivo is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. Use of the service by under-16s is outside intended functionality and may be grounds for account termination.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make changes, we will notify registered users by in-app notification and email. For existing users, material changes take effect 30 calendar days after notice. New users are bound by the updated policy immediately upon acceptance.

This notice period applies to changes in legal terms only. Product changes, new features, infrastructure updates, and provider changes do not require a notice period.

14. Contact

Privacy enquiries: privacy@elicivo.com