PrivacyPolicy

Elevation Group AI LLC ("Elevation Group," "we," "us," or "our") is committed to protecting your privacy and the privacy of your clients' data. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at elevationgroup.ai, engage us for AI automation services, or otherwise interact with us. Because we serve businesses in sensitive regulated industries — including healthcare, dental, legal, financial services, and insurance — we take our data handling obligations seriously and hold ourselves to a high standard.

By using our website or services, you acknowledge that you have read and understand this Privacy Policy.

1. Information We Collect

1.1 Contact & Identity Information

When you contact us, request a demo, schedule a call, or sign up for our services, we may collect your name, email address, phone number, job title, and company name.

1.2 Business Information

To deliver our AI automation services, we collect information about your business, including industry, company size, existing software systems and integrations, key business workflows, and any other operational details you share with us during discovery, onboarding, or the course of service delivery.

1.3 Customer & End-User Data

As part of building and operating AI-powered workflows on your behalf, we may process data belonging to your customers or end users ("Customer Data"). This may include contact information, transaction records, support interactions, appointment data, and other business records. We process Customer Data solely as a data processor on your behalf, under your instructions and in accordance with our Master Services Agreement.

1.4 Voice & Audio Data

Where we build voice-enabled AI solutions for your business using our ElevenLabs integration, voice recordings and audio data may be processed. This data is used solely to power the voice features within your deployed solution and is subject to ElevenLabs' own data processing terms. We do not retain voice recordings beyond the scope of the active service session unless you have explicitly authorized us to do so in a Statement of Work.

1.5 Scheduling Data

When you schedule a meeting or demo through our Calendly integration, Calendly collects and processes your name, email, and appointment details. This data is governed by Calendly's Privacy Policy. We receive a record of the appointment and use it solely to prepare for and conduct our meeting with you.

1.6 Technical & Usage Data

We automatically collect certain information when you visit our website, including your IP address, browser type, operating system, device type, referring URLs, pages visited, time spent on pages, and general browsing behavior. This data is collected via Statcounter analytics and is used in aggregate form to understand how our website is used and improve the visitor experience.

2. How We Use Your Information

We use information we collect for the following purposes:

• Service Delivery: To scope, build, deploy, and support AI-powered workflows and automation solutions for your business.
• Client Communication: To respond to inquiries, send project updates, deliver reports, and maintain our working relationship.
• AI Workflow Operation: To train, configure, and operate AI models and automation workflows on your behalf. See Section 3 for full detail on AI data processing.
• Security: To detect, prevent, and address technical issues, unauthorized access, fraud, and security threats.
• Analytics: To analyze website usage in aggregate, improve our service offerings, and optimize content.
• Legal Compliance: To comply with applicable laws, respond to lawful requests, and enforce our agreements.
• Marketing (with consent): To send newsletters, case studies, and service updates where you have opted in. You may unsubscribe at any time.

3. AI & Automation Data Processing

3.1 Use of Third-Party AI Models

Our AI automation services are powered in part by large language models (LLMs) and AI APIs from providers including, but not limited to, OpenAI (ChatGPT/GPT-4), Anthropic (Claude), and other third-party AI platforms ("AI Providers"). When we build and operate AI workflows for your business, inputs to these models — which may include business context, customer queries, or operational data — are transmitted to AI Providers' servers for processing.

We configure AI Providers in accordance with their enterprise data agreements, which generally include provisions that your data is not used to train their general models. However, you should be aware that your data is processed on third-party infrastructure. We will disclose the specific AI Providers used in your engagement within the applicable Statement of Work.

3.2 Private AI Deployments

For clients who require maximum data privacy — particularly in healthcare, legal, and financial services — we offer Private ChatGPT and isolated AI deployment options where all AI processing occurs within a dedicated environment. In these configurations, your data does not leave a controlled environment accessible only to your organization.

3.3 Automated Decision-Making

Some of our automation solutions involve automated decision-making, such as routing customer inquiries, classifying support tickets, or generating draft responses. These automated systems are configured and supervised by Elevation Group in partnership with you. Where automated decisions have a significant effect on your customers, we will implement appropriate human review mechanisms as agreed in the applicable Statement of Work.

4. Industry-Specific Data Considerations

4.1 Healthcare & Dental

If you are a healthcare or dental practice and our services involve the processing of Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA), we will execute a Business Associate Agreement (BAA) with your organization prior to any such processing. We will implement HIPAA-compliant data handling procedures for all PHI within the scope of our engagement.

4.2 Legal Services

We recognize that law firms and legal service providers handle confidential attorney-client privileged information. Any data shared with us in connection with a legal services engagement is treated with heightened confidentiality obligations, consistent with the terms of our NDA and MSA.

4.3 Financial Services & Insurance

For clients in financial services, insurance, or related regulated industries, we apply appropriate security controls consistent with industry standards. Where applicable, we will cooperate with your compliance requirements under regulations such as the Gramm-Leach-Bliley Act (GLBA) or state insurance data security laws.

5. Third-Party Integrations & Partners

Our website and services use the following third-party tools that may process your information:

Each third party is governed by their own privacy policies. We select partners who maintain appropriate data protection standards and, where required, execute data processing agreements with them.

6. Information Sharing & Disclosure

We do not sell your personal information. We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your information only in the following circumstances:

• Service Delivery: With vendors and subcontractors who assist us in delivering your AI automation project, subject to confidentiality obligations no less protective than those in this policy.
• AI Providers: With AI API providers as necessary to operate your automation workflows, per your engagement terms.
• Legal Requirements: When required by law, subpoena, court order, or regulatory authority, or when we believe disclosure is necessary to protect our rights or the safety of any person.
• Business Transactions: In the event of a merger, acquisition, or sale of substantially all assets, your information may be transferred as part of that transaction under the same privacy protections described herein.
• With Your Consent: For any other purpose with your explicit prior consent.

7. Data Security

We implement and maintain appropriate technical and organizational measures to protect your information against unauthorized access, disclosure, alteration, and destruction:

• Encryption in Transit: All data exchanged between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Sensitive data stored on our systems is encrypted using AES-256 encryption.
• Access Controls: Access to client data is restricted to authorized personnel on a need-to-know basis, with role-based permissions and multi-factor authentication enforced.
• Security Reviews: We conduct periodic security assessments and keep our tools and dependencies updated.
• Incident Response: We maintain procedures to detect, respond to, and notify affected parties of data security incidents in compliance with applicable law.

We are actively working toward SOC 2 Type II compliance to further formalize and demonstrate our commitment to security, availability, and confidentiality controls.

8. Texas Data Privacy and Security Act (TDPSA)

Elevation Group AI LLC is a Texas-based company subject to the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024. If you are a Texas resident, you have the following rights with respect to your personal data:

• Right to Access: Confirm whether we are processing your personal data and obtain a copy of it.
• Right to Correction: Correct inaccuracies in your personal data.
• Right to Deletion: Request deletion of personal data we hold about you.
• Right to Portability: Obtain your personal data in a portable, machine-readable format.
• Right to Opt-Out: Opt out of the processing of your personal data for purposes of targeted advertising or the sale of personal data. We do not sell personal data or conduct targeted advertising.
• Right to Appeal: If we decline to act on your request, you may appeal that decision by contacting us at the address below. We will respond to appeals within sixty (60) days.

To exercise any of these rights, please contact us at hello@elevationgroup.ai. We will respond within forty-five (45) days as required by the TDPSA, with the option to extend by an additional forty-five (45) days when reasonably necessary.

9. Your Privacy Rights (General)

Regardless of your location, you may contact us at any time to:

• Access the personal information we hold about you.
• Correct or update inaccurate information.
• Request deletion of your personal information (subject to legal retention requirements).
• Opt out of marketing communications at any time using the unsubscribe link in any email or by contacting us directly.
• Object to or restrict specific processing activities.

10. Cookies & Tracking Technologies

10.1 Essential Cookies

We use essential cookies required for basic website functionality, including security, session management, and accessibility features.

10.2 Analytics Cookies

We use Statcounter to collect anonymous usage data about how visitors interact with our website. This data is used in aggregate to understand visitor behavior and improve our site. Statcounter may use cookies and similar tracking technologies. You may opt out by adjusting your browser settings or using a browser extension designed for that purpose.

10.3 Third-Party Embeds

Our website embeds content from Calendly for scheduling purposes. These embeds may set their own cookies subject to their respective privacy policies. We do not control these third-party cookies.

11. Data Retention

We retain personal information only for as long as necessary to fulfill the purpose for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. General retention guidelines:

• Contact & inquiry data: Retained for 3 years from last interaction, or longer if an active client relationship exists.
• Client project data: Retained for the duration of the engagement plus 3 years, unless a longer period is required by law or agreed in the SOW.
• Website analytics: Aggregate data retained per Statcounter's standard retention schedule.
• Voice data: Deleted after the active service session unless otherwise authorized.

Upon expiration of the applicable retention period, we securely delete or anonymize personal information. Clients may request early deletion of their data subject to our contractual and legal obligations.

12. International Data Transfers

Our services are based in and operated from the United States. If you are located outside the United States, your information will be transferred to and processed in the United States. Our AI provider partners may also process data on servers in other countries. By engaging us for services, you consent to this transfer and processing. We ensure that any such transfers are made in compliance with applicable data protection laws.

13. Children's Privacy

Our services are directed to businesses and professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately at hello@elevationgroup.ai and we will promptly delete such information.

14. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this policy. For significant changes affecting active clients, we will provide notice via email or through our client communications. We encourage you to review this policy periodically. Continued use of our website or services following any update constitutes your acceptance of the revised policy.

15. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us: