Privacy policy

Who we are

Elcara Front Office is a service of Elcara L.L.C-FZ, a company registered in Dubai, United Arab Emirates. [Registered address, trade licence number and the entity that contracts with US customers: lawyer to confirm.]

Questions about this policy go to [privacy contact email]. General support: [support email].

What this policy covers

This policy covers this website and the Elcara Front Office service: the app, the email connection and the AI replies it drafts and sends for a business.

[Roles: confirm where Elcara is a controller (account owners, website visitors) and where it acts for the business as a processor or service provider (the business's customers and their emails).]

What we collect

Account details: [name, business name, email address, phone number, billing details].

Business profile: [services, service area, booking link, tone of voice and other details the owner gives us].

Connected mailbox: [which messages the service reads, which permissions (scopes) it asks Google and Microsoft for, and what it stores].

Conversations: [new customer emails, the AI drafts, the owner's approvals and edits, and the replies sent].

Website visitors: [confirm before launch. This site sets no cookies and loads no analytics or third-party trackers at the time of writing.]

How we use it

We use this information to run the service: to read new customer emails, draft replies, ask the owner for approval, send approved replies from the business's own address, and show every conversation on one page.

[Other uses: support, security, billing, product improvement. Lawyer to list each one and its legal basis.]

[We do not sell personal information. Lawyer to confirm the wording for each US state law that applies.]

Google and Microsoft account data

[Required before Google OAuth verification: a statement that the use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.]

[Matching statement for Microsoft accounts connected through Microsoft Graph.]

[How the owner disconnects a mailbox, and what happens to the stored data after that.]

AI and your data

[Which AI model providers process email content, whether any of that content is used to train models, and what the providers' terms say about it.]

Who we share it with

The service uses these providers: Cloudflare (hosting and storage), Composio (the connection to Gmail and Outlook), Anthropic (the AI model that reads new customer emails and writes the drafts) and Resend (the service emails we send to account owners). [Lawyer to add the location of each provider and the safeguards.]

[Disclosures required by law, and what happens in a sale or merger.]

How long we keep it

[Retention period for each type of data, and what happens when an account closes.]

How we protect it

[Security measures: encryption, access control, who at Elcara can see customer email and when.]

International transfers

[Data moves between the United States, the United Arab Emirates and the countries of our service providers. Lawyer to describe the safeguards.]

Your choices and rights

[Rights under US state privacy laws and the UAE Personal Data Protection Law: access, correction, deletion, opt-out. How to make a request, and how we verify it.]

[How a business's customer can ask about an email that the service handled.]

Children

[Statement that the service is for businesses and is not directed to children.]

Changes to this policy

[How we tell account owners about changes, and when changes take effect.]

Contact

[Privacy contact email]. Postal address: [registered address].