Back to Elevay

Terms of Service

Last updated: September 30, 2026

1. Introduction

These Terms of Service ("Terms") govern your access to and use of Elevay, a SaaS platform operated by Elevay ("Company", "we", "us", or "our"), a société par actions simplifiée à associé unique (SASU) with share capital of €1,024, registered in France under number 108 723 537 R.C.S. Lille Métropole, whose registered office is at 12 rue Volta, 59130 Lambersart, France, accessible at elevay.app and related domains (including elevay.dev). Full company details are on our Legal Notice page.

By creating an account or using Elevay, you agree to be bound by these Terms. If you do not agree, do not use the Service.

2. Service Description

Elevay is an AI-powered go-to-market (GTM) platform that provides:

  • Customer relationship management (CRM) for contacts, companies, and deals
  • Automated outbound email sequences and deliverability management
  • AI-assisted lead scoring, enrichment, and prioritization
  • Pipeline analytics, deal coaching, and business intelligence
  • Automatic capture and summarization of customer interactions
  • Natural language querying of your sales data

3. Account Registration

You must provide accurate, complete information when creating an account. You are responsible for safeguarding your credentials and for all activity that occurs under your account. You must notify us immediately of any unauthorized use.

You must be at least 18 years old and have the legal authority to bind the entity on whose behalf you are using the Service.

4. User Obligations

You agree to:

  • Use the Service only for lawful purposes and in compliance with all applicable laws
  • Maintain the accuracy of your account information
  • Have a valid legal basis for the personal data you process with the Service, and give the people concerned the information required by Article 14 GDPR: within one month of obtaining their data, and at the latest in your first message to them
  • Comply with all applicable anti-spam and data protection regulations (including GDPR, CAN-SPAM, and CASL) when sending outbound emails
  • Meet the obligations set out in Section 8 (Data processing terms) for the campaigns you send, the calls and meetings you record, and the visit pixel if you install it on your website
  • Not share your account credentials with unauthorized third parties
  • Comply with our Acceptable Use Policy

5. Acceptable Use

Your use of the Service is subject to our Acceptable Use Policy, which is incorporated into these Terms by reference. Violations may result in immediate suspension or termination of your account.

6. Payment Terms

Elevay offers subscription-based plans. Payments are processed through Stripe. By subscribing, you agree to:

  • Pay all fees associated with your selected plan
  • Subscriptions renew automatically at the end of each billing period unless cancelled
  • Price changes will be communicated at least 30 days in advance
  • Refunds are available within 14 days of initial purchase if you have not substantially used the Service
  • Failure to pay may result in suspension or termination of your account
  • All prices are exclusive of applicable taxes unless stated otherwise

Free trial periods, if offered, convert to paid subscriptions at the end of the trial unless cancelled before the trial expires.

7. Data Ownership

You own your data. "Customer Data" means the contacts, companies, deals, emails, messages, call and meeting recordings, notes, and other data that you upload or create within Elevay, or that the Service collects on your instructions from your connected accounts and from data providers. It remains your property. We do not claim any ownership rights over your Customer Data.

You grant us a limited license to process your Customer Data only to provide and maintain the Service for you, and to compute the anonymized cross-customer benchmarks described in our Privacy Policy, which contain no names, contact details or message content. We do not use Customer Data for any other purpose, unless EU or French law requires it. Until this version of these Terms, our code also copied some drafts and messages, with contact details replaced, into a dataset kept for training AI models, described in our Privacy Policy under AI processing. That copy has stopped. No feature of the Service reads the copies already made, we will delete them, and we will not use them to train a model. You can opt out of the benchmarks at any time by writing to contact@elevay.app. This license ends when your Customer Data is deleted.

Workspace admins can export contacts, companies, deals, activities, notes and tasks as a JSON file at any time from Settings → Privacy & data. For any other Customer Data, contact us at contact@elevay.app.

8. Data processing terms (Article 28 GDPR)

When you use the Service to process personal data, you are the controller and Elevay processes that data on your behalf as your processor, under Article 28 of the General Data Protection Regulation (GDPR). This section is the data processing agreement between you and Elevay. It applies to the personal data in your Customer Data. Where Elevay decides why and how personal data is processed, for example your account data and the anonymized benchmarks, our Privacy Policy applies instead.

8.1 Subject matter and duration

We process Customer Data to provide the Service to you. The processing lasts as long as your subscription, and then until your Customer Data is deleted under Section 8.12.

8.2 Nature and purpose

The Service collects data from the sources you connect or configure: your mailboxes and calendars, your LinkedIn account and, where enabled, WhatsApp, the calls you place through the Service and the meetings you record, your website if you install our visit pixel, and the data providers listed on our Sub-processors page. It stores, enriches, scores and analyzes that data, drafts messages with AI models, sends the emails and messages of the sequences and campaigns you launch, transcribes calls as they happen and transcribes recordings, and deletes data. The purpose is to run your CRM, prospecting and outreach.

8.3 Categories of data subjects

  • Your prospects, customers, partners and other business contacts
  • People who exchange emails, messages, calendar invitations or calls with your users
  • Participants in the calls and meetings you record
  • Visitors to your website, if you install our visit pixel
  • Your team members, as they appear in Customer Data

8.4 Categories of personal data

  • Identification and professional details: name, job title, seniority and department, company, email addresses, phone numbers, professional profile links and photos, location and time zone, career history, and the details of a LinkedIn profile (headline, summary, open-to-work status, shared connections)
  • Reactions to and comments on LinkedIn posts, where this option is on, with the text of each comment
  • The content and metadata of emails, messages and calendar events
  • Call and meeting audio, transcripts and summaries
  • Notes, tasks, deals and other CRM records
  • Engagement data: email opens and link clicks, replies, and website visits
  • The scores, signals and summaries the Service derives from this data

The Service is not designed for special categories of personal data (Article 9 GDPR). Do not upload them on purpose.

8.5 Your documented instructions

We process Customer Data only on your documented instructions. These Terms, your settings in the Service (such as your ideal customer profile, sequences and connected accounts) and the actions you take in it are those instructions. They include the sourcing and enrichment that the Service runs on a schedule from the ideal customer profile and settings you configure, the transfers to the sub-processors listed on our Sub-processors page, and the requests your users' browsers make to the public services named on that page when they use the Service, for example to Gravatar with a hash of a contact's email address. They also include the operating alerts that our team receives in its Slack channel, which give only your workspace's identifier or, when the sync of one of your connected mailboxes pauses, that mailbox's address. If EU or French law requires us to process Customer Data in another way, we will tell you before we do so, unless that law forbids it. We will tell you immediately if we believe an instruction infringes data protection law.

8.6 Confidentiality

Everyone we authorize to process Customer Data is bound by a duty of confidentiality, by contract or by law.

8.7 Security

We apply the technical and organizational measures described on our Security page, as required by Article 32 GDPR.

8.8 Sub-processors

You give us a general written authorization to use the sub-processors listed on our Sub-processors page. That page shows what each one does, where it processes data, and the status of its data processing agreement, with a legend of what each status means. We inform every customer in the app, with a notice at the top of the Elevay workspace, at least 30 days before a new sub-processor starts processing Customer Data; we do not send it by email. A notice is given on the date it is posted, dated, on the Sub-processors page and shown in the app, and the notice period and your time to object run from that date. You may object to a new sub-processor on reasonable data protection grounds by writing to contact@elevay.app during that notice period. If we cannot resolve your objection, you may end your subscription under Section 13 before the change takes effect. We remain responsible to you for how our sub-processors process Customer Data.

Article 28(4) GDPR requires us to bind each sub-processor, by a written contract, to the same data protection obligations as this Section 8. Where the Sub-processors page shows a sub-processor's agreement as "to confirm", "to sign", "on request" or "none published", that contract is not in place yet.

8.9 Requests from data subjects

In the Service, you can find, correct and delete a person's contact record. Deleting a contact keeps the related activities and notes, and a deleted contact can be restored. To erase every record of a person, or for any other request under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection), write to contact@elevay.app and we will help you answer it. If a person contacts us directly about Customer Data, we forward the request to you and do not answer it ourselves unless you ask us to.

8.10 Assistance with your obligations

Taking into account the nature of the processing and the information available to us, we help you meet your obligations on the security of processing, personal data breaches, data protection impact assessments and prior consultation of a supervisory authority (Articles 32 to 36 GDPR).

8.11 Personal data breaches

If we become aware of a personal data breach affecting Customer Data, we notify you without undue delay. We give you the information you need to meet your own obligations: what happened, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed.

8.12 Deletion at the end of the Service

When your subscription ends, you may request an export of your Customer Data for 30 days. Your account is then closed, and we delete your Customer Data within 30 days of the closure. A daily job is set to delete it: first, in steps it resumes the next night when one fails, the data kept beside the main records, such as copies of synced mailbox messages, meeting captures, LinkedIn data, visit records and your suppression and do-not-call lists; then, in one step that deletes nothing if it fails, the main records. It does not yet cover every kind of Customer Data: it keeps contacts and companies as rows emptied of the person and the account, the records our system keeps of its own writes and of meetings, the list of accounts and people you removed, contact photo files other workspaces may share, and the opt-outs and spam complaints on your suppression list, which our database protects against any deletion, so we complete the deletion ourselves and confirm it to you in writing. We keep only the workspace record needed to reconcile billing, part of the workspace audit log, and what the law requires us to keep, such as invoices, which French law requires us to keep for 10 years. The audit log records who did what and when, including sign-ins, invitations and the old and new values of the fields changed in a record. At closure we delete those old and new values with the rest of your Customer Data; our daily job does not do this yet, so we do it ourselves. We keep the rest of the audit log, who did what and when, as evidence of how the account was used; our code sets its retention period at 7 years, and no law imposes that period. Copies in our database provider's backups expire on that provider's backup schedule.

8.13 Information and audits

We make available to you the information needed to demonstrate that we meet this section. We allow for and contribute to audits, including inspections, by you or by an auditor you mandate, on reasonable notice and under a duty of confidentiality. Write to contact@elevay.app.

8.14 Your responsibilities as controller

  • Legal basis and information: you need a valid legal basis for each processing you run with the Service, and you must give the people concerned the information required by Articles 13 and 14 GDPR.
  • Email tracking: the emails that Elevay's main sending job sends for your sequences and campaigns contain an open-tracking pixel, and their links pass through Elevay to record clicks. Two sending jobs share the same queue. The main job adds the pixel and tracked links, including when it sends through a mailbox's own SMTP server. The job that sends directly through a mailbox's own SMTP server adds neither. For a mailbox connected with its own SMTP server, you cannot tell in advance which job will send a given email, so treat every campaign email as tracked. For each tracked recipient, the Service records when the email is opened and which links are clicked, with the time and the user agent of the request. No setting turns this tracking off at present. You are the controller of this processing for your campaigns, and you must tell your recipients about it. For recipients in the EU, the open pixel and the tracked links need the recipient's prior consent under Article 5(3) of the ePrivacy Directive (Article 82 of the French Data Protection Act), even for business-to-business prospecting. The Service does not collect this consent.
  • Visit pixel: if you install Elevay's visit pixel (Settings → Signal sources) on your website, it sets a first-party cookie (_eve_v, 90 days) and sends each page view (page address, referrer and campaign parameters) with the visitor's IP address to Elevay, for visit tracking and company identification. The pixel does not ask for consent itself. You must load it only after your visitors have consented through your own consent tool, and describe it in your privacy notice.
  • Calls and recordings: every call placed through the Service is transcribed live, on both sides, by Twilio's real-time transcription with Deepgram, and the transcript is stored with the call whether or not the call is recorded. No announcement is played unless the call is recorded and the number called is on our list of consent regions. You must tell the people you call that the call is transcribed and, if you record calls or meetings, obtain their consent where the law requires it.

9. AI Usage Disclaimer

Elevay uses artificial intelligence and large language models (LLMs) to provide features such as lead scoring, email generation, deal coaching, data enrichment, and natural language querying.

  • AI-generated content (including email drafts, summaries, and scores) is provided as suggestions and should be reviewed before use
  • We do not guarantee the accuracy, completeness, or suitability of any AI-generated output
  • Your Customer Data is sent to third-party AI providers for processing. Microsoft Azure OpenAI Service is our primary provider. Anthropic and OpenAI are used as fallback providers and by a few features that call them directly. Our Security page, Sub-processors page and Privacy Policy give the details
  • You are solely responsible for reviewing and approving any AI-generated content before it is sent to third parties (e.g., outbound emails)
  • AI models may produce inaccurate or biased results; use professional judgment when acting on AI recommendations

10. Intellectual Property

The Service, including its software, design, logos, and documentation, is the intellectual property of Elevay and is protected by applicable intellectual property laws. You may not copy, modify, distribute, reverse-engineer, or create derivative works of the Service.

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

  • THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED
  • WE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, OR BUSINESS OPPORTUNITIES
  • OUR TOTAL LIABILITY SHALL NOT EXCEED THE AMOUNT YOU PAID TO US IN THE 12 MONTHS PRECEDING THE CLAIM
  • WE ARE NOT LIABLE FOR DAMAGES ARISING FROM YOUR USE OF AI-GENERATED CONTENT, FROM SERVICES YOU CONNECT THAT ARE NOT OUR SUB-PROCESSORS, OR FROM EMAIL DELIVERABILITY ISSUES. NOTHING IN THIS SECTION LIMITS OUR RESPONSIBILITY FOR OUR SUB-PROCESSORS UNDER SECTION 8.8

12. Indemnification

You agree to indemnify and hold harmless Elevay and its officers, directors, employees, and agents from any claims, losses, or damages (including legal fees) arising from your use of the Service, your violation of these Terms, or your violation of any third-party rights (including anti-spam laws and data protection regulations).

13. Termination

Either party may terminate this agreement at any time:

  • By you: Cancel your subscription and close your account at any time by writing to contact@elevay.app
  • By us: We may suspend or terminate your account if you breach these Terms, the Acceptable Use Policy, or fail to pay subscription fees

Upon termination, you may request an export of your Customer Data within 30 days. We then close your account and delete all your Customer Data within 30 days of the closure, as described in Section 8.12.

14. Changes to Terms

We may update these Terms from time to time. We will notify you of material changes at least 30 days in advance with a notice in the app, at the top of the Elevay workspace, which stays until you close it. We do not send it by email. The date at the top of this page shows the current version. Continued use of the Service after the effective date constitutes acceptance of the updated Terms.

15. Governing Law & Dispute Resolution

These Terms are governed by and construed in accordance with the laws of France. Any disputes arising from these Terms or your use of the Service shall be subject to the exclusive jurisdiction of the competent courts of Lille, France.

Before initiating legal proceedings, both parties agree to attempt to resolve disputes through good-faith negotiation for a period of at least 30 days.

16. Contact

For questions about these Terms, contact us at:

  • Email: contact@elevay.app
  • Company: Elevay (SASU), 108 723 537 R.C.S. Lille Métropole
  • Registered office: 12 rue Volta, 59130 Lambersart, France