Authentication
Multi-factor authentication (email or authenticator app) required after signup
- Privileged platform roles (super admin, agency admin) must use MFA
- Password reset and session management via Supabase Auth
Trust Centre
Security and privacy you can verify
Elevale is committed to GDPR, UK GDPR, and global privacy standards. This section explains how we protect your data and where to find our legal documents.
GDPR, data retention, privacy rights, security, audit logging, and legal document links.
What you can expect from Elevale
Plain-language outcomes from our platform documentation: encryption, access control, audit logging, data rights, and retention, without implementation jargon.
Encryption
In transit: TLS 1.2+ for all connections
- At rest: Supabase encrypted storage; OAuth tokens encrypted server-side
- Secrets: API keys stored as hashes; no client-side token encryption
Access control
Row Level Security (RLS) on all tenant data
- Role-based access: system, organisation, and workspace levels
- Custom workspace roles with granular permissions
Your data rights
Under GDPR, UK GDPR, and many US state laws you have rights over your personal data.
- Access: Know what data we hold about you
- Portability: Download your data (JSON export)
- Rectification: Correct inaccurate data in Profile settings
- Erasure: Delete your account or request erasure
Audit logging
Elevale maintains an immutable audit trail for compliance and security accountability.
- Workspace data changes (OKRs, KPIs, tasks, wiki, business brief, process map)
- User and role changes
- Permission and custom role modifications
- Admin actions (user deletion, workspace management)
Retention and deletion
Retention timelines are consistent across billing, automated jobs, and this documentation.
- Grace period: Until end of current billing period; full access continues
- Access ends: At grace period end; account closed; deletion schedule begins
- 60 days after access ends: Personal data anonymised (soft delete)
- 90 days after access ends: Permanent deletion (hard delete)
Clear deletion timelines
Retention periods are consistent across billing, automated jobs, and platform documentation.
View retention policy →Cancelled workspaces
- 1 Grace period
Until end of current billing period; full access continues
- 2 Access ends
At grace period end; account closed; deletion schedule begins
- 3 60 days after access ends
Personal data anonymised (soft delete)
- 4 90 days after access ends
Permanent deletion (hard delete)
Other data categories
- Audit logs Retained 2 years, then purged automatically
- Cookie consent records 1 year
- Privacy requests 3 years after completion (compliance evidence)
- Billing records Retained as required by tax law (typically 6–7 years)
- Backups Supabase encrypted PITR; rolling schedule independent of application lifecycle
- Marketing contact data Until you unsubscribe or request deletion, plus a short suppression record
- Backups Supabase encrypted point-in-time recovery; rolling schedule independent of application lifecycle
Reviews
Help other directors find Elevale
If Elevale is working for your leadership team, a review on G2 or Capterra helps other business directors discover strategic execution software that fits SMEs and growing teams.
Trusted partners behind the platform
Elevale uses trusted subprocessors to deliver the platform. The authoritative list is published at elevale.app/legal/subprocessors. We provide 30 days notice before adding subprocessors that process personal data.
| Provider | Purpose |
|---|
Legal and compliance library
All content is published from Elevale platform documentation in Supabase.
Legal documents
Legal
Privacy Policy
How we collect, use, and protect personal data (agreed at signup)
Open document → LegalTerms & Conditions
Contractual terms for using Elevale (agreed at signup)
Open document → LegalCookie Policy
Cookies and similar technologies on the platform and marketing site
Open document → LegalData Processing Agreement (DPA)
Controller and processor obligations for business customers
Open document → LegalSubprocessor list
Third parties that process personal data on our behalf
Open document →Compliance guides
Privacy Policy
Last updated: 7 July 2026. This Privacy Policy explains how Elevale (operated by Saint Financial Group Limited ) collects, uses, stores, shares, and protects personal data when you use our platform, marketing website, and related services. It also describes your privacy rights and how to contact us.
Read guide →Data Processing Agreement
Last updated: 7 July 2026.
Read guide →Acceptable Use Policy
Last updated: 7 July 2026.
Read guide →Cookie Policy
Last updated: 20 July 2026. This Cookie Policy explains how Elevale (operated by Saint Financial Group Limited ) uses cookies and similar technologies when you use our platform and marketing website.
Read guide →Data retention and deletion
Retention timelines are consistent across billing, automated deletion jobs, backups, and this documentation. This page explains what we keep, for how long, and how you can delete data yourself.
Read guide →Terms & Conditions
Last updated: 30 June 2026. These Terms & Conditions ("Terms") govern your access to and use of Elevale , operated by Saint Financial Group Limited ("we", "us", "our"). By creating an account, clicking to accept, or using Elevale, you agree to these Terms, our Privacy Policy , and (where applicable) our Data Processing Agreement .
Read guide →Subprocessors and integrations
Last updated: 20 July 2026.
Read guide →Security and data protection
Elevale protects your data with layered authentication, encryption, access controls, and operational safeguards. This page summarises the technical and organisational measures we apply across the platform.
Read guide →Audit logging
Elevale maintains an immutable audit trail for compliance, accountability, and security investigations. This page describes what we log, who can see it, and how long records are kept.
Read guide →Agency and reseller data responsibilities
Agencies using Elevale white-label branding have specific data protection responsibilities.
Read guide →Incident response and data breaches
Elevale maintains an incident response process to contain threats, protect users, and meet regulatory notification obligations. This page describes our commitments and your role.
Read guide →Accessibility commitment
Last updated: 20 July 2026. Saint Financial Group Limited is committed to making Elevale accessible to people with disabilities. This page explains our approach, the standards we meet, and how to report barriers you encounter.
Read guide → Need help?
Questions about security or privacy?
Reach our privacy and security teams directly. Data rights requests are handled within our documented 30-day SLA.