Terms of Service
1.1 Acceptance of Terms
By accessing or using the ElevAI platform (the "Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree to these Terms, you may not use the Service. These Terms constitute a legally binding agreement between you and ElevAI ("we", "us", or "our").
By creating an account, you represent that you are at least 18 years of age, have the legal capacity to enter into this agreement, and that all information you provide is accurate and truthful.
1.2 Description of Service
ElevAI is a career pivot coaching platform that uses skill-matching algorithms and structured coaching frameworks to help users explore career transition options and generate personalised action plans. The Service includes:
- A multi-step skills audit and career matching session
- AI-assisted career path recommendations across 65+ career paths
- Personalised 90-day action plans for career transitions
- A daily progress tracker to work your action plan one manageable step at a time
- Salary and training data for matched career paths
- A community space for user feedback and career pivot stories
- Account management and progress saving functionality
1.3 Account Registration
To access certain features, you must register for an account by providing your first name, last name, email address, phone number, and a username and password. You are responsible for:
- Maintaining the confidentiality of your account credentials
- All activity that occurs under your account
- Notifying us immediately of any unauthorized access at support@elevai360.com
- Ensuring your account information remains accurate and up to date
We reserve the right to terminate accounts that contain false information, violate these Terms, or remain inactive for more than 24 consecutive months.
1.4 Acceptable Use
You agree not to use the Service to:
- Provide false personal information or impersonate any person or entity
- Attempt to reverse-engineer, scrape, or extract data from the platform in bulk
- Interfere with or disrupt the integrity or performance of the Service
- Submit content that is defamatory, harassing, obscene, or unlawful
- Use automated bots, scrapers, or tools to access the Service
- Resell, sublicense, or commercially exploit the Service without written permission
- Attempt to gain unauthorized access to our systems or other users' accounts
1.5 Intellectual Property
All content, software, algorithms, career path data, training recommendations, and materials on the Service are owned by or licensed to ElevAI and are protected by applicable intellectual property laws. You are granted a limited, non-exclusive, non-transferable, revocable license to access and use the Service for your personal, non-commercial use only.
Your personal data, career session results, and action plans belong to you. You retain ownership of any content you submit (feedback, stories). By submitting content, you grant us a non-exclusive, royalty-free license to display it on the platform.
1.6 Disclaimers
The Service is provided "as is" and "as available" without warranties of any kind. We do not guarantee that career matches are accurate, complete, or suitable for your specific circumstances. Salary data is based on publicly available market research and may not reflect actual compensation in your location or for your level of experience.
1.7 Limitation of Liability
To the fullest extent permitted by applicable law, ElevAI shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of or inability to use the Service, including but not limited to loss of income, employment outcomes, or data loss. Our total liability shall not exceed the amount you paid us in the twelve months preceding the claim.
1.8 Changes to Terms
We may update these Terms periodically. We will notify registered users by email at least 14 days before material changes take effect. Continued use of the Service after changes constitutes acceptance of the updated Terms.
Privacy Policy
2.1 Information We Collect
We collect the following categories of personal information:
| Category | Data Collected | Purpose |
|---|---|---|
| Account Information | First name, last name, email address, phone number, username | Account creation, login, and communication |
| Authentication Data | Password hash and cryptographic salt (never the raw password) | Secure account access |
| Career Session Data | Skills selected, priorities, work preferences, career matches, task progress | Generating career recommendations and saving your progress |
| Daily Progress & Reflections | Your daily plan settings, activity dates and streaks, and any free-text check-in notes you write in the daily tracker | Powering your daily momentum tracker and saving your progress — these notes are private to you and are never shown to other users |
| Attribution Data | How you found us — referring URL and campaign parameters (UTM source, medium, campaign, term, content) | Understanding which channels bring people to ElevAI |
| Community Content | Feedback submissions, career stories you choose to share | Improving the platform and building community |
| Usage & Analytics Data | Session timestamps, current step, last activity date, and first-party product-analytics events (steps viewed, features used) associated with your account | Understanding how features are used, improving the product, and preventing abuse |
| Technical Data | Browser type, device type (collected via standard server logs) | Security monitoring and compatibility |
2.2 How We Use Your Information
We use collected information exclusively to:
- Create and manage your account and authenticate your identity
- Generate personalised career matches and 90-day action plans
- Save and restore your progress across sessions
- Display community feedback and stories (using only your first name)
- Send you product updates and important service notifications (you can opt out)
- Analyse first-party usage and analytics data associated with your account to understand how features are used and improve the product — we do not use this for advertising and we do not sell it
- Comply with legal obligations and enforce our Terms of Service
- Investigate and prevent security incidents and fraudulent activity
2.3 What We Do Not Do
2.4 Legal Basis for Processing (GDPR)
For users in the European Economic Area and United Kingdom, we process personal data under the following legal bases:
- Contract — Processing your account and session data is necessary to provide the Service you have requested
- Legitimate Interests — Security monitoring, fraud prevention, and product improvement where your interests do not override ours
- Consent — For optional communications such as newsletters or product announcements
- Legal Obligation — When required by applicable law or legal process
2.5 Data Retention
| Data Type | Retention Period |
|---|---|
| Account and profile data | Until account deletion or 24 months of inactivity |
| Career session data | Until account deletion |
| Community posts (feedback, stories) | Until deletion request; anonymised after account deletion |
| Security and access logs | 90 days |
| Backup copies | Deleted within 30 days of the primary record deletion |
2.6 Third-Party Services
We use the following sub-processors to operate the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase Inc. | Database hosting and authentication | All account and session data, stored encrypted at rest |
| Vercel Inc. | Application hosting and deployment | Server access logs only; no personal data stored |
| Stripe Inc. (if payments enabled) | Payment processing | Email address and payment details; we never see card numbers |
All sub-processors are contractually required to process data only as instructed and to maintain appropriate security standards. Supabase and Vercel are SOC 2 Type II certified.
2.7 International Data Transfers
Our infrastructure may process data in the United States and other jurisdictions. For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the transfer mechanism.
Data & Storage Policy
3.1 Where Your Data Lives
All personal information and career session data is stored in a secure managed cloud database (see our sub-processors in Section 2.6). Data is encrypted at rest and in transit using industry-standard encryption.
3.2 Client-Side Storage
ElevAI uses the following browser storage mechanisms:
| Storage Type | What We Store | Duration |
|---|---|---|
| sessionStorage | Your current login session token, username, and display name, plus a first-party analytics identifier for the visit | Cleared automatically when you close your browser tab |
| localStorage | Attribution data (how you found us) and, if applicable, your waitlist email | Persists until manually cleared or you clear browser data |
| No Tracking Cookies | We do not set advertising, analytics, or tracking cookies | N/A |
3.3 Your Data Rights
Depending on your location, you have the following rights regarding your personal data:
- Access: Request a copy of all personal data we hold about you
- Rectification: Correct inaccurate or incomplete personal data
- Erasure ("Right to be Forgotten"): Request deletion of your account and all associated data
- Portability: Receive your career data in a machine-readable format (JSON or CSV)
- Restriction: Request that we limit processing of your data in certain circumstances
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Where processing is based on consent, withdraw it at any time
To exercise any of these rights, email support@elevai360.com. We will respond within 30 days (and within 72 hours for urgent security matters).
3.4 California Residents (CCPA)
If you are a California resident, you have the right to know what personal information we collect, the right to delete your information, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your privacy rights.
3.5 Children's Privacy
ElevAI is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such data, we will delete it immediately. If you believe a child under 13 has created an account, please contact us at support@elevai360.com.
AI Disclosure
5.1 How the Matching System Works
The "AI" in ElevAI refers to our structured matching and scoring system. Here is exactly how it works:
- You select skills from a curated list of 100 skills across 9 categories
- You rank 7 career priorities (income, growth, balance, autonomy, etc.)
- Our algorithm calculates a skill overlap score between your selected skills and the required skills for each of 65+ career paths
- A priority boost is applied to career paths that align with your ranked priorities
- A location boost is applied if you prefer remote or freelance work and the career supports it
- Careers are ranked by the combined score and filtered by sector
This is a deterministic mathematical process. Given the same inputs, you will always receive the same outputs. There is no black box, no machine learning model making predictions about you as an individual.
5.2 What the System Cannot Do
- Cannot verify that your self-reported skills are accurate or how deeply you hold them
- Cannot account for local job market conditions, employer preferences, or industry cycles
- Cannot predict whether you will enjoy a career based on our data alone
- Cannot replace the judgement of a qualified career counsellor, therapist, or financial advisor
- Cannot guarantee employment outcomes, salary attainment, or career satisfaction
- Does not account for discrimination, structural barriers, or factors beyond skill alignment
5.3 Salary and Market Data
Salary data displayed on the platform is sourced from publicly available labour market research including the U.S. Bureau of Labor Statistics, LinkedIn Salary Insights, Glassdoor market reports, and industry salary surveys. Data represents approximate median compensation ranges for the United States market and is updated periodically. Actual compensation varies significantly based on:
- Geographic location and local cost of living
- Years of experience and depth of skill
- Company size, funding stage, and industry vertical
- Educational credentials and certifications held
- Negotiation outcomes and timing of offers
5.4 Training Recommendations
Certification and training recommendations are curated by our team based on widely recognised industry standards. We do not have commercial relationships with any training provider listed on the platform. We do not receive commissions, referral fees, or any compensation for recommending specific courses or certifications. Recommendations reflect our assessment of what the market recognises — not what pays us.
5.5 AI Ethics Commitments
We commit to the following principles in the design and operation of our matching system:
- Transparency: We explain exactly how scores are calculated and what data influences results
- No discrimination: The algorithm does not use age, gender, race, nationality, or any protected characteristic as inputs
- Human agency: All career decisions remain with you; the tool provides information, not directives
- No dark patterns: We do not manipulate results to push paid plans or partner products
- Explainability: Every career match shows the specific skills that drove the score
- Right to contest: You can retake the session with different inputs at any time and receive different results
5.6 Future Use of Generative AI
If we integrate large language models (such as GPT-4, Claude, or similar) into the platform in future, we will update this disclosure to explain what data is sent to those models, how outputs are used, and what controls you have. We commit to never sending your personally identifiable information to external AI APIs without explicit disclosure and your informed consent.
Security Statement
6.1 Password Security
Your password is never stored in plaintext. We store only a salted cryptographic hash, generated with a strong, industry-standard key-derivation function and a unique random salt for each user. Because only the hash is retained, passwords cannot be recovered or reversed — even in the unlikely event our database were compromised. We review our hashing approach periodically against current security best practice.
6.2 Transport Security
- All connections to ElevAI are encrypted using TLS 1.2 or TLS 1.3
- HTTP Strict Transport Security (HSTS) is enforced — browsers are instructed to only connect over HTTPS
- SSL/TLS certificates are managed automatically via Vercel and renew before expiry
- All API calls between the application and database use encrypted connections
6.3 Database Security
- All data is encrypted at rest and in transit
- Access controls isolate each account's data, so users cannot access other users' information
- Application credentials are held securely on the server side and are never exposed in the browser or client source code
- Backups are encrypted, and direct database access is restricted to authorised personnel only
6.4 Application Security
- Industry-standard security headers are applied to all responses to guard against common web attacks
- All requests validate input and return generic error messages — internal system details are never exposed to the client
- Third-party libraries are served from our own domain to reduce third-party tracking and supply-chain risk
- Input validation is performed on both the client and the server for all form submissions
6.5 Infrastructure Security
ElevAI's infrastructure is built on two enterprise-grade platforms:
| Provider | Certifications | Role |
|---|---|---|
| Vercel Inc. | SOC 2 Type II, GDPR compliant | Application hosting, CDN, serverless functions |
| Supabase Inc. | SOC 2 Type II, GDPR compliant, HIPAA capable | Database hosting, encrypted storage, authentication |
6.6 Vulnerability Disclosure
If you discover a security vulnerability in ElevAI, we ask that you disclose it responsibly:
- Email support@elevai360.com with a description of the vulnerability
- Do not access, modify, or delete user data during your research
- Allow us reasonable time to investigate and remediate before public disclosure
- We commit to acknowledging your report within 48 hours and providing a timeline for resolution
We do not currently operate a bug bounty programme but we genuinely appreciate responsible security research and will acknowledge contributors by name (with permission) in our security changelog.
6.7 Security Incident Response
In the event of a data breach or security incident affecting personal data:
- We will notify affected users by email within 72 hours of becoming aware of the incident
- We will notify the appropriate supervisory authority within 72 hours where required by GDPR
- Notifications will include the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed
- We will provide guidance on steps users can take to protect themselves
Contact & Your Rights
For all privacy, data, legal, and security enquiries, please use the appropriate contact below. We aim to respond to all requests within 30 days (5 business days for security matters).
Privacy & Data Requests
For data access requests, deletion requests, data portability, corrections, or questions about how we use your personal information.
Subject line: "Data Request — [Your Username]"
Security Vulnerabilities
For responsible disclosure of security vulnerabilities or to report a suspected breach.
Please do not report security issues via public channels.
General & Legal Enquiries
For terms of service questions, content removal requests, or general legal enquiries.
Right to Complain
If you are in the European Economic Area or United Kingdom and believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In Ireland, this is the Data Protection Commission at dataprotection.ie.
We would, however, appreciate the opportunity to address your concerns before you approach a regulator. Please contact us first and we will do our best to resolve the matter promptly.
These policies were last updated on 1 January 2025 and apply to all users of the ElevAI platform globally. Previous versions are available on request. ElevAI reserves the right to update these policies at any time. Material changes will be communicated to registered users by email with at least 14 days' notice. Continued use of the Service following notice of changes constitutes acceptance of the updated terms.
© 2025 ElevAI. Elevate Human Potential with AI.