Privacy Policy

1. Scope of this Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored and shared when you use the Eliyo mobile application, website, account, support features and paid services. Eliyo is intended to be available internationally where the app and relevant providers are supported. Features, subscriptions and integrations may vary by country, platform, vehicle and region.

2. Account and profile information

When you create or use an Eliyo account, we may process your email address, display name, language and locale, profile image, authentication identifiers, account timestamps, confirmation that you are at least 18 and the confirmation timestamp, and security information. Authentication may use email and password, Google Sign-In or Sign in with Apple. OAuth providers may share limited profile information after you authorize the connection. Eliyo does not receive your Google or Apple password.

3. Vehicle information

When you add or manage a vehicle, we may process its make, model, year, nickname, VIN, specifications, mileage, photographs, maintenance schedules, service history, expenses, ownership-related dates, reminders and other information you associate with it. VIN and vehicle details may be sent to vehicle-information services when needed to identify or describe the vehicle.

4. Maintenance, mileage and history

Eliyo may process mileage updates, maintenance intervals, completed services, inspection, insurance or registration dates, expenses, notes and reminders. We use this information to organize the vehicle history and show items that may require attention.

5. Documents, images and uploaded files

You may choose to upload service records, receipts, invoices, insurance documents, registration or inspection records, odometer photographs, vehicle photographs and other vehicle-related files. Documents are optional, and Eliyo can be used without uploading them.

Uploaded files may contain personal information about you or other people. Upload only information you are entitled to use and that is reasonably necessary for the relevant feature. Private documents are stored using restricted storage and controlled access. Eliyo is not designed as an end-to-end encrypted document vault. PDFs are rendered inside the app without sending private document URLs to Google Docs Viewer.

6. Scanning, OCR and extraction

If you use scanning or extraction features, Eliyo may process images or documents to identify odometer values, service dates, maintenance work, costs, vehicle details and document categories. Extracted information may be presented for review before it is saved. Automated extraction may be inaccurate, and you remain responsible for confirming important information.

7. Eliyo Assistant and AI features

When you use an AI-supported feature, we may process your prompt, relevant selected-vehicle information, mileage, maintenance and service history, files you choose to include, conversation context, generated responses and technical information needed to operate and secure the feature. Eliyo may provide selected vehicle context automatically so the Assistant can answer questions about your car.

Depending on the feature and processing path, data may be processed by Google Gemini, Groq or Cloudflare AI. Google Gemini is used for Assistant, vision, search grounding and speech generation. Groq is used for Assistant and vision fallback and speech recognition. Cloudflare AI may convert a PDF to text when document processing follows the Groq path. Not every provider receives every request. Information is sent only to the provider used for the relevant feature. Provider-side processing, operational retention and secondary use are governed by the applicable production configuration and contractual terms.

Before Eliyo sends personal data to a third-party AI provider, the app presents an AI data disclosure and asks for your explicit permission. You can decline AI processing and continue using Eliyo’s non-AI core features. You can later withdraw this permission through the AI & privacy controls in Eliyo settings. Withdrawing permission prevents future AI processing but does not affect processing that occurred lawfully before withdrawal.

AI results may be cached briefly for reliability, duplicate prevention and usage management. Eliyo does not use AI to make decisions that produce legal or similarly significant effects about you.

8. Voice features

If you use voice functionality, audio may be processed for speech recognition, transcription, generating a response or text-to-speech output. Audio or transcribed text may be sent to the provider used for that request. Microphone access is requested only when needed and remains subject to your device permissions.

9. Local app data

Some information may remain on your device, including recent conversations, cached interface data, AI attachments, preferences, consent and session information. Local Eliyo conversation data and indexed AI attachments associated with the account are cleaned as part of account deletion. Device-level data may also be removed by uninstalling the app or clearing its storage.

10. Subscriptions and purchases

Subscriptions are processed through the Apple App Store or Google Play. Eliyo may receive subscription status, product or entitlement identifiers, renewal and expiration information and an app-specific subscriber identifier from RevenueCat and the applicable store. Eliyo does not receive or store your full payment card details. Apple and Google process purchases under their own terms and privacy policies.

11. Support and feedback

If you contact support or send feedback, we may process your email, message, optional screenshots, app version, platform, operating system, device model, locale, optional vehicle identifier and relevant diagnostic details. Support is handled directly by Eliyo, and in-app support records are stored using Eliyo’s backend services.

12. Operational and security information

Eliyo and its infrastructure providers may process limited technical and operational information such as IP address, request timestamps, browser or device headers, request status, error details, operation duration, backend and security logs, AI usage and quota information, subscription events and authentication events. We use this information to operate, secure and troubleshoot the service. Eliyo does not use an advertising SDK or build advertising profiles from app activity.

13. Website information and analytics

Vercel hosts and delivers the Eliyo website and may process standard technical information such as IP address, browser and device type, requested pages, approximate region and security logs.

Microsoft Clarity starts only after you accept analytics cookies. If accepted, Clarity may collect page activity, device information, clicks and scrolling behavior. Advertising storage is disabled in Eliyo’s consent configuration. Your choice is stored on your device and can be changed or withdrawn through Cookie settings. Declining analytics does not prevent use of the website.

14. How we obtain and use information

We obtain information directly from you, from your use of Eliyo, from authentication providers, from vehicle-information services after you submit vehicle details, from subscription providers and app stores, from your device when you grant permission, and from service providers operating on our behalf.

• Create and secure your account.
• Provide the app, website and requested features.
• Store and organize vehicle information, records and reminders.
• Provide Assistant, OCR and voice features.
• Manage subscriptions and feature access.
• Provide support, prevent abuse and diagnose technical problems.
• Comply with legal obligations and protect legal rights.
• Provide website analytics where you have consented.

15. Legal bases

Where the GDPR, UK GDPR or similar law applies, we rely on performance of a contract to provide Eliyo and manage your account; legitimate interests to secure, support and improve service reliability; consent where required, including for third-party AI processing, optional website analytics and relevant device permissions; and legal obligations where processing or retention is required by law.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

16. Service providers and recipients

Providers receive only information reasonably necessary for their function. Third parties that receive user data must provide the same or equivalent protection described in this Privacy Policy and required by applicable platform rules. Where a provider processes personal data on Eliyo’s behalf, we require it to use the data only for the purpose for which it was provided and in accordance with applicable data-protection law. Information may also be disclosed as part of a merger, acquisition, restructuring or transfer of the Eliyo product, subject to applicable law and appropriate notice.

• Supabase for authentication, database, private file storage and backend functions.
• Google and Apple for authentication and app distribution.
• RevenueCat for subscription entitlement and purchase-status management.
• Google Gemini, Groq and Cloudflare AI for Assistant, vision, document or speech processing, depending on the feature and processing path.
• NHTSA vPIC for VIN and vehicle-information lookup.
• Vercel for website hosting and delivery.
• Microsoft Clarity for consent-based website analytics.
• Resend for authentication and transactional email delivery.
• Professional advisers, authorities or other recipients where required by law or necessary to protect legal rights.

17. International transfers

Eliyo is operated from Poland, but some providers may process information in other countries. Where required, transfers are supported by adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum or another recognized mechanism. Protections in a destination country may differ from those in your country.

18. Retention

We retain personal data only as long as necessary to provide Eliyo, maintain security, resolve disputes and meet legal obligations. Account and vehicle data is generally retained while your account is active. Documents and vehicle records remain until you delete them or the account. Support, operational and security records are retained only as long as reasonably necessary for their purpose.

Subscription and analytics records are also subject to provider retention. Deleted information may remain temporarily in provider backups or recovery systems and is removed or anonymized through the applicable backup process. Limited information may be retained for legal, security, fraud-prevention, tax or dispute-resolution purposes.

19. Exporting and deleting your data

Eliyo provides account data export and account deletion. An export may include structured account, vehicle and activity information, but may not contain every raw file in its original format.

Account deletion removes or schedules removal of profile data, vehicles and related records, stored documents and images, cloud files, local Eliyo conversation data and indexed attachments, RevenueCat subscriber data where supported, and connected authentication credentials and tokens. Some information may remain where required by law or necessary for security, fraud prevention or legal claims.

Deleting your Eliyo account does not cancel an Apple App Store or Google Play subscription. Cancel any active subscription separately through the store account used to purchase it. If you cannot access the app, use the external account-deletion page below.

Open the Eliyo account-deletion page

20. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent and complain to a data-protection authority. In Poland, you may contact the President of the Personal Data Protection Office, UODO. You may also contact the authority where you live or work. Requests can be sent to eliyo.app@gmail.com. We may need to verify your identity, and rights may be limited where an exemption applies.

21. Security

We use reasonable measures such as authenticated access, restricted database and storage permissions, private file storage, controlled file access, secure network transport and provider access controls. No service can guarantee absolute security. Eliyo is not an end-to-end encrypted storage service, and authorized systems and providers may process information where necessary to provide a requested feature. Report suspected compromise to eliyo.app@gmail.com.

22. Children

You must be at least 18 years old to create or use an Eliyo account. Eliyo is not directed to anyone under 18. If we learn that an account was created or used by someone under 18, we may suspend or delete the account and associated information.

23. Sale of data and advertising

Eliyo does not sell personal data. Eliyo does not use personal data for third-party behavioral advertising and does not use an advertising SDK in the mobile application.

24. Device permissions

Depending on the feature you use, Eliyo may request access to the camera to photograph a VIN, odometer, vehicle or document; photos and files to select vehicle images, documents or support attachments that you choose to upload; the microphone to record a voice request; and notifications to schedule maintenance and important-date reminders.

Permissions are requested in context and can be changed in your device settings. The current release does not use precise or background location, Bluetooth tracking or continuous trip tracking. Reminder notifications are scheduled locally, and Eliyo does not currently collect a remote push-notification token.

25. Changes and contact

We may update this Privacy Policy when Eliyo, its providers or applicable requirements change. The updated version will show a revised date, and we will provide additional notice or request consent where required. Privacy, legal, support and data requests may be sent to Artem Naumenko, operator of Eliyo, Poland, at eliyo.app@gmail.com. Postal address: Boguslawskiego 6, m. 11., Radom 26-600, Poland.