Privacy and legal
Privacy and GDPR
What Elyv stores about you, for how long, who processes it, and how to use your rights.
In short
What is stored about you
| Data | Why | How long |
|---|---|---|
| Username and hashed password | To sign you in | Until the account is deleted |
| IP address of the latest sign in | Security and abuse prevention | Replaced at each sign in |
| Sessions, stored as a hash | To keep you signed in | 30 days of inactivity, 90 days at most |
| Law enforcement request, only if you send one: sector, organisation, role, country, work email, purpose | To verify the agency | While the account exists |
| Plan, quota usage and payment orders | To provide what you paid for | For accounting, while the account exists |
| Search history with its results | So you can reopen a search | 30 or 90 days by plan, never for Incognito |
| Link analysis cases | Your own boards | Until you delete them |
| Profile photo | Shown in your dashboard | Until you remove it |
Why Elyv may process it
Account, payment and history data are needed to provide the service you signed up for. Sign in IPs, sessions and failed sign in counters are kept to protect accounts against abuse. Elyv does not use your data for advertising and does not sell it.
Who else processes data
| Service | Role |
|---|---|
| Cloudflare | Network, security and the sign up check in front of the site. |
| The breach index provider | Receives the identifier of a search to check it against breach data. |
| LeakOsint | Receives the identifier of an Advanced Search. |
| Public sources of each module | Receive the identifier you look up, as any lookup requires. |
| Mapbox | Draws maps and locates addresses shown in results. |
Your rights and how to use them
Under the GDPR you can ask to access, correct, delete, export or restrict your data, and object to its processing.
- Delete searches yourself in History, one by one or all at once.
- Download a JSON copy of everything stored about your account in Account, Your data. It asks for your two-factor code.
- Ask for your account to be deleted in Account, Your data, confirmed with your two-factor code. Once the Elyv team approves it, the account is erased with your searches, cases, watchlist and API keys. Remaining plan time is not reimbursed.
- Export single results as PDF, CSV, JSON or text, and History as CSV.
- Remove your profile photo and sign out other devices from Account.
- For any other request, contact support from your account name. The GDPR sets one month to answer.
- If you are not satisfied, you can complain to your data protection authority, the CNIL in France.
If you are the person searched
Elyv shows what public sources and published breach catalogues already say, and does not keep its own copy of that data. To have something removed, ask the site that publishes it. For misuse of Elyv against you, contact support and read Responsible use.
How your data is protected
- Every page is served over HTTPS with strict transport security.
- Passwords and sessions are stored as hashes, never in clear.
- A strict content security policy limits what can run on the site.
- Admins never create sessions on user accounts.
Where to go next
Still stuck? Contact support with your username and what happened.