Privacy Policy

• This Privacy Policy is issued by Boolean Array Canada ("Boolean Array Canada", "we", "our", or "us"), a company incorporated and operating under the laws of the Province of Ontario, Canada, and the owner and operator of the ElseLane service ("ElseLane").
• By creating an account or otherwise accessing ElseLane, you acknowledge that you have read, understood, and agree to the data practices described in this policy.

• Account credentials. Your email address, display name, and authentication credentials. Passwords are stored only as secure one-way hashes. If you sign in with Google, we receive basic profile information (such as email, name, and avatar URL) from Google under their OAuth consent screen.
• API and usage metadata. API key identifiers and hashes (not plaintext keys after creation), request status, task type, provider and model selected, failover attempts summary, token/credit estimates, latency, and related operational fields. Prompt and answer bodies are not stored after a request completes.
• Billing records. Payment processing is handled by Stripe, Inc. We do not store raw card numbers or CVV data. We retain Stripe customer/session references, credit pack purchases, and credit ledger balances needed to operate prepaid billing.
• Communications. Messages you send via the contact form (name, email, subject, message) and support correspondence.
• Technical logs. IP addresses, user-agent strings, and server logs generated in the ordinary course of operating a secure web service, used for security, abuse prevention, and reliability.
• Preferences. Optional email preferences (e.g. receipts, low-balance alerts) and related thresholds you configure.

• To create and maintain your account, authenticate you, and provide the dashboard.
• To route prompts to AI providers, apply classification and failover logic, enforce credit balances, and return answers to your applications.
• To process prepaid credit purchases and maintain your credit ledger.
• To send transactional email (verification, magic links, optional receipts and low-balance alerts) and respond to support requests.
• To detect abuse, enforce rate limits and acceptable use, and secure the service.
• To improve reliability and product features using aggregate, non-identifying analytics where configured. We do not sell personal information.

• When you call the ElseLane API, the prompt (and optional system message) is transmitted to one or more third-party AI providers as needed to fulfill the request and any failover attempts.
• Those providers process content under their own terms and privacy policies. Do not submit content you are not authorised to process through third-party AI services.
• ElseLane applies high-risk PII guardrails before provider calls (block or redact, depending on configuration). Guardrails reduce risk but are not a guarantee that all sensitive data is detected.
• ElseLane does not use your prompts or answers to train our own foundation models. We do not retain prompt/answer bodies for training.

• Data in transit between your clients and our production service is encrypted with TLS.
• Data at rest is encrypted by our infrastructure providers using industry-standard controls.
• API keys are shown in plaintext only once at creation; we store cryptographic hashes for verification.
• No security measure is absolute. If a breach affecting your personal information occurs, we will notify affected users in accordance with applicable Canadian breach notification obligations, typically within 72 hours of becoming aware where required.

• Account data and usage metadata are retained for the life of your account, and for a limited period afterward as needed for fraud prevention, accounting, or legal obligations.
• On account deletion (from the dashboard or by request to privacy@elselane.com), we permanently delete personal account data and associated operational records from production systems, typically within 30 days, except where retention is required by law (for example certain billing records).
• Stripe may retain payment records independently under its policies and financial regulations.
• Anonymised aggregate statistics with no personal identifiers may be retained indefinitely.

• Neon / PostgreSQL hosting — application database.
• Vercel (or our then-current application host) — application hosting and edge delivery.
• Stripe, Inc. — payment processing (PCI DSS Level 1).
• Resend, Inc. — transactional and support-related email delivery.
• Google LLC — Google OAuth sign-in (when used) and Google AI APIs when selected in a routing chain.
• OpenAI, Anthropic, and other configured AI providers — model inference for requests routed to them.
• Upstash (when configured) — rate limiting / Redis.
• Plausible (when configured) — privacy-friendly website analytics; loaded only if enabled by us via environment configuration.

We do not sell, rent, or license your personal information to third parties for their independent marketing purposes.

• ElseLane uses strictly necessary cookies/session storage to maintain authenticated sessions after sign-in.
• If privacy-friendly analytics (e.g. Plausible) is enabled, it is configured to avoid advertising cookies. We do not deploy advertising pixels by default.

• Access / correction. Update profile details in the dashboard, or contact privacy@elselane.com.
• Deletion. Delete your account in the dashboard, or request deletion via privacy@elselane.com.
• Portability. Export usage metadata as CSV from the account area.
• Email preferences. Opt out of optional product emails in account settings; transactional auth messages remain required.
• We will respond to privacy requests within 30 days and may verify your identity.

• ElseLane is operated from Ontario, Canada. Sub-processors may process data in the United States and other countries. By using the service you acknowledge such transfers.
• We rely on contractual protections and vendor terms appropriate to the transfer where applicable.

ElseLane is a B2B / developer service not directed at individuals under 16. We do not knowingly collect personal information from minors. Contact privacy@elselane.com if you believe a minor has provided data and we will delete it promptly.

We may update this Privacy Policy to reflect changes in practices, technology, or law. Material changes will be communicated by email to your registered address and/or a prominent notice at least 14 days before they take effect where practicable. The effective date above will reflect the latest revision.

• Privacy: privacy@elselane.com
• General: contact@elselane.com
• Boolean Array Canada — Ontario, Canada
• You may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.