Privacy & Cookie Policy

This Privacy and Cookie Policy ("Policy") describes how Thompson and Thompson Ltd trading as Elaras AI ("Elaras," "Company," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal information in connection with our website located at elaras.ai (the "Site") and our software-as-a-service platform providing marketing tools for website optimisation (collectively, the "Services"). This Policy also explains your rights and choices regarding your personal information and how you can contact us about our privacy practices.

Note: Throughout this Policy, references to "Elaras" refer to Thompson and Thompson Ltd trading as Elaras AI.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with the terms of this Policy, please do not access or use our Services.

1. Scope and Application

This Policy applies to personal information collected through our Site and Services, including information collected online, through email, and through other interactions you may have with us. This Policy does not apply to third-party websites, products, or services, even if they link to our Services, and you should consider the privacy practices of those third parties carefully.

Thompson and Thompson Ltd trading as Elaras AI is the data controller responsible for your personal information for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For residents of the European Economic Area ("EEA") or Switzerland, Elaras is also the data controller under the EU General Data Protection Regulation (GDPR). For residents of California and other U.S. states with comprehensive privacy laws, this Policy also serves as our notice at collection.

2. Information We Collect

We collect personal information in several ways, including when you provide it directly to us, when third parties provide it to us, and when it is collected automatically through your use of our Services.

2.1 Information You Provide Directly

• Account and Registration Information: When you create an account or register for our Services, we may collect your name, email address, password, company name, job title, and other information you choose to provide.
• Contact and Communication Information: When you contact us, subscribe to our communications, or participate in surveys or promotions, we may collect your name, email address, phone number, and the contents of your message or submission.
• Payment and Transaction Information: If you make a purchase or engage in a transaction, we may collect billing information, payment card details (processed through secure third-party payment processors), billing address, and transaction history.
• User Content and Website Data: We collect information you submit through the Services, including website URLs, content, analytics data, and other materials you upload or transmit for optimisation purposes.

2.2 Information Collected Automatically

• Device and Browser Information: We automatically collect information about your device, including device type, operating system, unique device identifiers, browser type and version, language preferences, and mobile network information.
• Usage Information: We collect information about your interactions with our Services, including pages viewed, features used, links clicked, search queries, referring URLs, access times and dates, and other usage statistics.
• Location Information: We may collect approximate location information based on your IP address. We do not collect precise geolocation data without your explicit consent.
• Log Data: Our servers automatically record information when you access our Services, including your IP address, access times, pages viewed, and the page you visited before navigating to our Services.

2.3 Information from Third Parties

We may receive personal information from third-party sources, including business partners, marketing partners, social media platforms (when you interact with our content or link your account), publicly available sources, and service providers who assist us in providing the Services.

3. Cookies and Tracking Technologies

3.1 Types of Technologies Used

We use cookies, pixels, web beacons, local storage, and similar tracking technologies to collect information about your browsing activities and to distinguish you from other users of our Services. Cookies are small data files stored on your device that help us improve our Services and your experience, see which areas and features of our Services are popular, and count visits.

3.2 Categories of Cookies

• Strictly Necessary Cookies: These cookies are essential for the operation of our Services and cannot be disabled. They enable core functionality such as security, network management, and accessibility.
• Performance and Analytics Cookies: These cookies collect information about how you use our Services, including which pages you visit most often and if you receive error messages. We may use third-party analytics services, such as Google Analytics, to collect and process this data.
• Functional Cookies: These cookies allow our Services to remember choices you make (such as your language preference or the region you are in) and provide enhanced, more personalised features.
• Marketing and Advertising Cookies: These cookies are used to deliver advertisements more relevant to you and your interests and to help measure the effectiveness of advertising campaigns.

3.3 Your Cookie Choices

Most web browsers allow you to control cookies through their settings preferences. However, if you limit the ability of websites to set cookies, you may impact your overall user experience and some features of our Services may not function properly. We honour Global Privacy Control (GPC) signals and other recognised opt-out preference signals where required by applicable law.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To Provide and Maintain Services: We use your information to operate, maintain, and provide the features and functionality of our Services, process transactions, send related information, and provide customer support.
• To Improve and Develop Services: We use your information to understand how users interact with our Services, conduct research and analysis, and develop new products, services, and features.
• To Communicate with You: We use your information to send you updates, security alerts, support messages, and marketing communications (where permitted).
• To Personalise Your Experience: We use your information to personalise the Services and provide content, features, and recommendations tailored to your interests.
• For Security and Fraud Prevention: We use your information to detect, investigate, and prevent fraudulent transactions, abuse, and other illegal activities.
• For Legal Compliance: We use your information to comply with applicable laws, regulations, legal processes, and governmental requests.

5. Legal Bases for Processing

Under the UK GDPR, EU GDPR, and equivalent data protection laws, we process your personal information only when we have a valid legal basis to do so. Our legal bases include:

• Contractual Necessity: Processing necessary to perform our contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: Processing necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.
• Consent: Processing based on your consent, which you may withdraw at any time.
• Legal Obligation: Processing necessary to comply with legal obligations to which we are subject.
• Vital Interests: Processing necessary to protect the vital interests of you or another person.

6. Google Services & User Data

Elaras integrates with several Google services to provide our platform features. This section explains specifically what Google user data we collect, how we use it, and how we handle it — in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

6.1 What Google Data We Collect

When you connect a Google service to your Elaras account, we collect only the data required to provide that specific feature:

• Google Sign-In (OAuth): Your name and email address as provided by your Google account, used solely to authenticate you and create or access your Elaras account.
• Google Analytics 4 (GA4): Website analytics metrics for sites you connect, including sessions, users, pageviews, bounce rate, average session duration, device types, traffic sources, and top-performing pages. This data is fetched using read-only access on your behalf.
• Google Search Console: Search performance data for sites you connect, including clicks, impressions, click-through rates, average position, and search query data. This data is fetched using read-only access on your behalf.

We do not collect, store, or process any Google user data beyond what is listed above and what is strictly necessary to provide the features you have enabled.

6.2 How We Use Google Data

• Google Sign-In data (name and email) is used only to authenticate your identity and associate your account.
• GA4 data is used only to display your website analytics within your Elaras Traffic dashboard and to provide performance insights and recommendations.
• Google Search Console data is used only to display your search performance within your Elaras SEO dashboard and to provide ranking insights and recommendations.

We will not use Google user data for any purpose other than providing or improving the specific feature for which you connected the service. We do not use Google data to serve advertising, for user profiling, or for any purpose unrelated to operating the Elaras platform for your benefit.

6.3 How We Share, Transfer, or Disclose Google Data

We do not sell, rent, or trade your Google user data to any third party. We do not transfer or disclose Google user data to third parties for purposes other than those described in this section. Specifically:

• Google data is not shared with advertising networks, data brokers, or marketing platforms.
• Google data is not used to build advertising profiles or shared with third parties for advertising purposes.
• Google data may be processed by our infrastructure providers (such as cloud hosting services) solely to store and serve it back to you within the platform, under strict data processing agreements.
• Google data may be disclosed if required by law or valid legal process, as described in our general sharing policy (Section 8).

You can revoke Elaras's access to your Google data at any time by disconnecting the integration in your Elaras settings or by visiting your Google Account permissions page. Revoking access will stop any further data collection from that Google service.

7. Sharing with AI Service Providers

Our Services utilise artificial intelligence technologies to provide website optimisation and marketing analysis features. To deliver these Services, we share certain data with the following third-party AI service providers:

• Anthropic (Claude): We share data with Anthropic's Claude AI to provide content analysis, optimisation recommendations, and other AI-powered features.
• OpenAI: We share data with OpenAI to provide AI-powered analysis and content generation features.
• Google AI Services: We share data with Google's AI services to provide analysis, optimisation, and other AI-powered features.
• Perplexity AI: We share data with Perplexity AI to provide research, analysis, and other AI-powered features.

The data we share with these AI providers may include website content, URLs, analytics data, and other information you submit through our Services for optimisation purposes. We have appropriate contractual arrangements with these providers requiring them to process data only for the purposes of providing our Services and in accordance with applicable data protection laws.

8. How We Share Your Information

In addition to sharing with AI service providers as described above, we may share your personal information in the following circumstances:

• Service Providers: We share information with third-party vendors who perform services on our behalf, such as hosting, data analytics, payment processing, and customer service.
• Business Partners: We may share information with business partners with whom we jointly offer products or services.
• Legal Requirements: We may disclose information if required to do so by law or in response to valid requests by public authorities.
• Business Transfers: We may share or transfer information in connection with any merger, sale of company assets, or acquisition.
• With Your Consent: We may share information for any other purpose disclosed to you and with your consent.

We do not sell your personal information as defined under applicable privacy laws.

9. International Data Transfers

Your personal information may be transferred to, stored, and processed in countries other than the United Kingdom, including the United States. When we transfer personal information outside of the UK or EEA, we implement appropriate safeguards to ensure that your information remains protected in accordance with this Policy and applicable law.

10. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. When we no longer need your personal information, we will securely delete or anonymise it in accordance with applicable law and our data retention policies.

11. Your Privacy Rights

10.1 Rights for All Users

Regardless of your location, you may access your account settings and update your information, opt out of receiving promotional communications, manage your cookie preferences, and close your account, subject to applicable law.

10.2 Rights for UK, EEA, and Swiss Residents

If you are located in the UK, EEA, or Switzerland, you have the following additional rights:

• Right of Access: You have the right to request a copy of the personal information we hold about you.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal information.
• Right to Erasure: You have the right to request that we delete your personal information in certain circumstances.
• Right to Restriction: You have the right to request that we restrict the processing of your personal information in certain circumstances.
• Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to the processing of your personal information in certain circumstances.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK at ico.org.uk.

10.3 Rights for California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) including the right to know, delete, correct, opt-out of sale or sharing, and limit use of sensitive personal information. We do not sell your personal information.

10.4 Exercising Your Rights

To exercise any of these rights, please contact us using the information provided in the "Contact Us" section below. We will respond to your request within the timeframes required by applicable law.

12. Data Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is completely secure. You are responsible for maintaining the security of your account credentials.

13. Children's Privacy

Our Services are not directed to children under the age of 18, and we do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make material changes, we will notify you by posting the updated Policy on our Site with a new "Last Updated" date. Your continued use of our Services after any changes constitutes your acceptance of such changes.

15. Contact Us

If you have any questions, concerns, or requests regarding this Policy or our privacy practices, please contact us at: