Privacy Policy

This policy explains how J-Craft Boats AB (“we”) handles personal data in Elsa OS (the “Service”), available at app.elsa-os.com, and on this website.

Our role

Elsa OS is used by businesses (our “customers”) to run their marketing and sales operations. For data that customers bring into the Service, such as their leads, CRM records and social media comments, the customer is the controller and we process it on their behalf and on their instructions. For the accounts of people who sign in to the Service, we are the controller.

What we collect

• Account data. Name, email address and organization membership of people who sign in, managed through our authentication provider, Clerk.
• Lead and CRM data. Contact details and activity that a customer syncs from their CRM (HubSpot), such as name, email, phone, company, job title, location, email engagement and website visits, plus website activity from the customer’s own analytics (PostHog).
• Lead research. To qualify a lead, the Service searches publicly available web sources about the person and their company and stores the resulting report, its sources and estimates such as a likely net worth range.
• Social media data. When a customer connects a Facebook Page or Instagram professional account, we receive comments on that account’s posts, including the commenter’s public account ID, username, comment text and attachments, and the account’s post and engagement insights.
• Marketing data. Aggregated website, search and social performance data from tools the customer connects, such as Google Analytics, Google Search Console, Meta, Semrush and Contentful.
• Content and activity. Drafts, reviews, approvals, tasks and an audit trail of who did what in the Service, and messages sent to the Service’s assistant in Slack.

The Service itself does not use advertising or analytics trackers. It sets only the cookies needed to keep you signed in.

How we use it

• To provide the Service: qualify and score leads, prepare suggested next steps, draft replies to social comments and compile marketing reports.
• To send the notifications a customer has set up, such as qualification alerts and a daily brief by email or Slack.
• To secure the Service, prevent abuse and fix problems.

We do not sell personal data, and we do not use customer data to train AI models.

AI processing and automated decisions

The Service uses AI models from OpenAI to research and summarize leads, score them, draft messages and replies, and translate text. Lead and comment data is sent to OpenAI for this purpose.

On a customer’s instruction, lead qualification can run automatically and update the lead’s record in the customer’s CRM, for example its lifecycle stage and email subscription status. Replies to social media comments are never posted without a person at the customer explicitly approving them, and drafted sales messages are never sent by the Service.

Service providers

We share personal data only with providers that help us run the Service:

• Vercel for hosting
• Neon for the database
• Trigger.dev for background jobs
• Clerk for sign-in and organizations
• OpenAI for AI processing
• Parallel and Perplexity for web research
• Resend for email notifications
• Slack for notifications and the assistant

We also exchange data with the tools a customer chooses to connect, such as HubSpot, Meta (Facebook and Instagram), Google, PostHog, Notion and Contentful. Some providers process data outside the EU/EEA; where they do, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Security

Access to the Service requires sign-in and is limited to members of the customer’s organization. Each customer’s data is kept separate. Access tokens for connected accounts, such as Facebook Page tokens, are encrypted at rest.

Retention

We keep customer data for as long as the customer uses the Service, and delete it when the customer asks us to or when their agreement ends. Raw notifications received from Meta are deleted after 30 days. Disconnecting a Facebook or Instagram account stops all collection and removes its access token; comments already collected are kept until deleted on request.

Your rights and data deletion

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. If your data is in the Service because of one of our customers, for example as a lead or a social media commenter, you can contact that business directly or email us at sales@j-craftboats.com and we will work with them on your request.

To request deletion of data we hold about you, including data received through Facebook or Instagram, email sales@j-craftboats.com with the subject “Data deletion request” and include your email address or social media username. We will confirm when the deletion is complete.

You also have the right to complain to a data protection authority.

Contact

J-Craft Boats AB (org. no. 556743-4567), c/o Klara Consulting, Mailbox 375, 111 73 Stockholm, Sweden. Email: sales@j-craftboats.com.

We may update this policy. Material changes will be announced in the Service or by email.