Privacy Policy

About this policy

Effective date: July 30, 2026

Last updated: July 30, 2026

Elyvator is a web design and development studio based in Toronto, Ontario, Canada, and is a brand of Elleithium Inc. In this policy, “Elyvator”, “we”, “us” and “our” refer to Elleithium Inc. operating as Elyvator.

This policy explains what personal information we collect through elyvator.com, why we collect it, how we use and protect it, and the choices you have. It applies to visitors to our website and to people who contact us or book a call with us. It does not cover the websites we build for our clients, which are governed by those clients’ own privacy policies.

We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy law. If you are in the European Economic Area or the United Kingdom, see the section on EU and UK rights below.

What we collect

We keep data collection to a minimum. We collect the following:

• Enquiry information. If you email us, we receive your name, email address, and whatever you choose to put in your message. You may also tell us your company name, budget range, or project details. There is no contact form on this site; enquiries reach us by email or through the booking tool below.
• Booking information. If you schedule a call with us, our third-party scheduling tool (Calendly) collects your name, email address, time zone, the meeting time you select, and any answers you give to the booking questions. That information is passed to us and added to our calendar.
• Website usage data. We do not currently run a third-party analytics service on this site, and we do not track you across other websites. If we add analytics later we will update this policy and, where the law requires it, ask for your consent first.
• Technical and server data. Our website host records standard server logs, including IP address, request time, and browser user agent, for security, troubleshooting, and abuse prevention.
• Client project information. If you become a client, we hold the contact and business information needed to run the project, along with any credentials, content, or files you give us to build and maintain your site.

We do not collect payment card numbers on this website, and we do not ask for sensitive information such as government identifiers or health information. Please do not send us sensitive information by email or in a booking note.

Why we collect it

We use personal information only for the purposes it was given, which are:

• To respond to your enquiry, answer questions, and prepare a proposal or quote.
• To schedule, hold, and follow up on calls.
• To deliver and support the services we have agreed to provide, including builds, hosting setup, and care plans.
• To send administrative messages about a project, an invoice, or a service we already provide to you.
• To keep the website secure, diagnose problems, and improve its content and performance.
• To meet legal, tax, accounting, and record-keeping obligations.

We do not sell your personal information, rent it, or trade it. We do not use it for automated decision-making or profiling.

Consent and legal basis

In most cases we collect personal information because you give it to us directly and knowingly, for example by filling in a form or booking a call. Submitting that information is your consent to us using it for the purpose described at the time.

In some cases consent is implied by the context, for example where the use is obvious and you would reasonably expect it, such as replying to an email you sent us or keeping our server logs secure.

You can withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide a service to you. To withdraw consent, email info@elyvator.com.

If you are in the EEA or the UK, our lawful bases are set out in the EU and UK section below.

Cookies and similar technologies

Our site uses very few cookies. Those it does use are:

• Strictly necessary cookies, which are required for the site to load correctly and to keep it secure.
• Preference cookies, which remember choices such as your consent selections.
• Third-party cookies set by our scheduling tool when a booking widget or page is loaded.

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the site from working. Where required by law, we ask for your consent before setting non-essential cookies, and you can change that choice at any time.

We do not respond to browser Do Not Track signals in a standardized way, because no common standard for them exists.

Service providers and sharing

We share personal information only with the service providers we need in order to run the business, and only to the extent required. They are bound to use the information solely to provide their service to us.

• Website hosting and infrastructure. Our host stores the website and its server logs.
• Calendly. Used for scheduling calls. It processes your name, email address, time zone, and booking answers under its own privacy policy.
• Email, file storage, and business tools. Used to receive and reply to messages, store project files, and issue invoices.

We may also disclose personal information where we are required or permitted to do so by law, for example in response to a valid legal demand, or where necessary to investigate suspected fraud or a security incident, to enforce our agreements, or to protect our rights or the safety of others.

If our business or a part of it is sold, merged, or reorganized, personal information may be transferred as part of that transaction. We would require the recipient to protect it under terms consistent with this policy.

International transfers

Some of our service providers store or process information on servers outside Canada, including in the United States. When that happens, your personal information is subject to the laws of the country where it is held, and it may be accessible to courts, law enforcement, and national security authorities in that country.

We use contractual and technical safeguards intended to give personal information a comparable level of protection while it is being processed on our behalf. If you would like to know more about where your information is held, email info@elyvator.com.

How long we keep information

We keep personal information only as long as we need it for the purpose it was collected, or as long as the law requires.

• Enquiries that do not become projects: normally up to twenty-four months, so we can pick up a conversation if you come back to us.
• Booking records: normally up to twenty-four months after the meeting.
• Client project and account records: for the length of the engagement and then for the period required by tax and business record-keeping rules, currently at least six years.
• Server logs: normally between twelve and twenty-six months, and in aggregate form after that.

When information is no longer needed, we delete it or render it anonymous.

How we protect information

We use safeguards appropriate to the sensitivity of the information, including encryption in transit (HTTPS) on our site, access controls and strong authentication on the accounts and tools we use, limits on who inside the studio can see client information, and regular updates to the software we run.

We are a small studio, and access to personal information is limited to the people who need it to do their work.

No website, transmission method, or storage system is completely secure. We cannot guarantee absolute security, but if a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Your rights and how to use them

Under PIPEDA you have the right to:

• Ask whether we hold personal information about you, and to be given access to it.
• Be told how it has been used and who it has been disclosed to.
• Ask us to correct information that is inaccurate or incomplete.
• Withdraw consent to a use, subject to legal or contractual limits.
• Ask us to delete information we no longer need.
• Make a complaint about how we have handled your information.

To make a request, email info@elyvator.com with the subject line “Privacy Request” and tell us what you would like. We may need to confirm your identity before we act, so that we do not disclose your information to someone else.

We respond within thirty days. If we need more time, we will tell you why and when to expect an answer. Access is normally free; if a request requires substantial work we will tell you the estimated cost before proceeding, and you can withdraw or narrow the request.

In limited cases the law allows or requires us to refuse access, for example where doing so would reveal personal information about someone else or breach solicitor-client privilege. If we refuse, we will explain why and tell you how to challenge the decision.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

If you are in the EU or the UK

If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR may apply to our handling of your information. Our lawful bases are:

• Consent, for non-essential cookies and for marketing email.
• Performance of a contract, or steps taken at your request before entering one, for enquiries, proposals, bookings, and delivering our services.
• Legitimate interests, for keeping the site secure, preventing abuse, and running the business day to day.
• Legal obligation, for tax, accounting, and record-keeping.

In addition to the rights listed above, you have the right to erasure, to restrict processing, to object to processing based on legitimate interests, and to data portability for information you provided to us. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Use the same contact route: info@elyvator.com. You also have the right to complain to your local supervisory authority, or to the UK Information Commissioner’s Office at ico.org.uk.

We are established in Canada and do not have an EU or UK representative. Transfers of personal information to Canada and to our service providers are made on the basis of an adequacy decision or standard contractual clauses, as applicable.

Email and CASL

Canada’s Anti-Spam Legislation (CASL) governs commercial electronic messages. We only send commercial email where we have your express consent, or where consent is implied, for example because you enquired about our services or because we have an existing business relationship with you.

Every commercial message we send identifies Elyvator and Elleithium Inc., gives a valid mailing address and contact details, and includes a clear way to unsubscribe. We act on unsubscribe requests promptly and in any case within ten business days.

Unsubscribing from marketing email does not stop transactional or service messages, such as invoices, project updates, or security notices about a site we maintain for you.

Children’s privacy

Our website and services are directed at businesses and are not intended for children. We do not knowingly collect personal information from anyone under the age of sixteen.

If you believe a child has given us personal information, email info@elyvator.com and we will delete it.

Links to other websites

Our site links to other websites, including our clients’ sites, our social media profiles, and our scheduling tool. Those sites are not under our control and are governed by their own privacy policies.

We encourage you to read the privacy policy of any site you visit through a link from ours.

Changes to this policy

We may update this policy as our business, our tools, or the law changes. When we do, we will revise the “Last updated” date at the top of this page.

If a change materially affects how we handle personal information we already hold, we will take reasonable steps to notify you, which may include an email or a notice on the site. Continuing to use the site after a change means you accept the updated policy.

Contact us

Questions, requests, or complaints about privacy can be sent to the person responsible for privacy at Elyvator:

Email: info@elyvator.com

Elyvator, a brand of Elleithium Inc.

Toronto, Ontario, Canada

We will acknowledge your message and respond within thirty days.