Privacy policy
Last updated 5 November 2026
This policy explains what information Elora collects, why, how it is kept safe, how long it is kept, and how you can see, correct or delete it. It is written to be read in a few minutes.
1. Who we are
Elora is a marketing workspace for agencies and their clients, made and run by BlueOcean Agency ("BlueOcean", "we", "us") in New Zealand. If you have a question about your information, or want to use any of your rights, write to our privacy officer at privacy@askelora.io.
2. What this policy covers
This policy covers the Elora website at www.askelora.io and the Elora app. Elora is used by businesses. The agency or client that invites you decides which of its marketing accounts are connected to Elora. For the marketing data in those accounts, that business is in charge of the data (under the GDPR, the controller) and we process it on its behalf and on its instructions. For your own account details and how you use Elora, we are in charge of the data.
3. Information we collect
- Your account: your name, work email, your role and the workspaces you can open. Your password is stored only as a salted, one-way hash; we never see it.
- If you log in with Google or Microsoft (when offered): the basic profile they share with your permission (name, email address and an account identifier). We never receive your Google or Microsoft password.
- Your voice, if you talk to Elora: your recording is turned into words on our own server, in memory, and is never stored, logged or sent to anyone else. Elora's spoken replies are made on the same server.
- What you ask and approve: the questions you type or say, Elora's answers, and the drafts you approve or change, so the workspace keeps a record of decisions.
- Data from accounts your business connects, described in the next section.
- Security and activity records: logins, logouts, failed logins and lockouts, setting changes and approvals (an audit log), with the date, time and internet address. Technical logs never contain the content of your connected accounts, your passwords or access tokens.
4. Data from connected platforms
A workspace administrator can connect the business's own marketing accounts. Each connection is made on the platform's own login page, asks only for the access listed below, is read-only unless the table says otherwise, and can be removed at any time. We use this data only to show that business its own marketing results in Elora and to let Elora answer questions about them.
| Platform | What Elora reads | Why |
|---|---|---|
| Google Ads | Account, campaign, ad group and ad names and settings; daily performance (impressions, clicks, cost, conversions); ad click identifiers needed to match a click to a website enquiry | Show spend and results, cost per lead and which campaigns bring enquiries |
| Google Analytics | The list of properties you can choose from; daily website reports (sessions, users, engagement and key events by channel, campaign, page and device). Read-only. | Show website traffic and what turns visits into enquiries |
| Google Search Console | The list of sites; search queries, pages, clicks, impressions and positions. Read-only. | Show how people find the website in Google Search |
| Meta (Facebook and Instagram ads) | Ad account, campaign, ad set and ad names and settings; daily ad insights; the business accounts you choose | Show ad spend and results next to the other channels |
| LinkedIn ads | Ad account, campaign and creative names and settings; daily ad analytics; the Company Pages you choose: their visits, followers, posts and post results | Show LinkedIn ad spend and results |
| Microsoft Advertising | Account, campaign and ad names and settings; daily performance reports | Show Microsoft (Bing) ad spend and results |
| Microsoft Teams and SharePoint | Only the files inside the one "Elora" folder your business connects | Let Elora use the business's own briefs and brand documents |
| HubSpot | Contacts, companies, deals, pipelines and their owners | Follow leads from first enquiry to sale |
| Your website (built by BlueOcean's studio) | Leads, visits, form entries and content, through Elora's own connector | Show enquiries and content, and prepare website changes for a person to approve |
Platform access tokens are encrypted before they are stored, are never shown again, never written to logs and never sent to your browser. Elora does not post, publish, spend or change anything on a connected platform; anything Elora drafts waits for a person to approve it.
5. How we use information
Only to provide Elora to the business that invited you: to show you your own marketing results, to let Elora answer your questions about them, to keep that copy up to date, to tell you about things waiting for you, to keep Elora secure (for example, locking an account after repeated wrong passwords), and to give support when you ask.
- We do not sell any information.
- We do not use it for advertising, and we do not share it for cross-context behavioural advertising.
- We do not use it to develop, improve or train any AI or machine-learning model.
- We never show one client's information to another client.
Under the GDPR, we rely on performing our contract with the business that uses Elora, on our legitimate interest in keeping Elora secure and working, and on legal obligations where they apply.
6. Google user data and Limited Use
When you connect a Google account, Elora asks only for the access it needs: read-only access to Google Analytics (analytics.readonly) and Search Console (webmasters.readonly), Google Ads access (adwords) used only to read reports, and, if you log in with Google, your basic profile (openid, email, profile). Elora uses this data only to show your business its own results in Elora, as described in section 5. It is stored as described in section 9 and shared only as described in section 8.
Elora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- We use Google user data only to provide and improve the features you see in Elora.
- We do not transfer it to others, except as needed to provide those features, to keep Elora secure, to comply with the law, or as part of a merger or sale of the business with notice to you.
- We do not use or transfer it for serving advertisements, including retargeting, personalised or interest-based advertising.
- No person reads it unless you have given us permission for specific data, it is needed for security (such as investigating abuse), it is needed to comply with the law, or it is aggregated and anonymised for internal operations.
- We do not use Google user data to develop, improve or train generalised AI or machine-learning models.
You can remove Elora's access at any time in Elora (Settings, Connected platforms, Disconnect) or in your Google account at myaccount.google.com/permissions.
7. Elora's AI
Elora's answers and drafts are written with the help of an AI service (right now, Claude by Anthropic). Each request holds only what is needed for the question, from one workspace at a time: mostly numbers and labels, and a person's name only when your question is about that person. Under Anthropic's commercial terms, our requests are not used to train its models. The AI never decides anything on its own: a person approves every consequential step. Elora's voice (listening and speaking) runs on our own server and never leaves it.
8. Who we share it with
Only with the services that run Elora for us, each bound by contract to protect it and to use it only for us:
| Sub-processor | What for | Where |
|---|---|---|
| BlueOcean Agency (our own servers) | Hosting Elora's app, database, voice and email relay | Run and administered by BlueOcean |
| Anthropic, PBC | The AI service behind Elora's answers and drafts | United States |
| Google, Microsoft | Logging you in, only when you choose them | As set by each provider |
The platforms you connect (section 4) send data to Elora; we do not send them your information beyond what is needed to connect. We may disclose information if the law requires it. We never share it with other Elora customers. If we add or change a sub-processor, we update this list first.
9. Storage, encryption and security
- Elora's information is kept in a SQL Server database on servers run by BlueOcean, with access limited to named BlueOcean staff.
- Everything travels encrypted with HTTPS (TLS 1.2 or later), between your browser and Elora and between Elora and every platform.
- Platform access tokens and keys are encrypted by the application before they are stored. Passwords are stored only as salted hashes. Login cookies are encrypted, marked secure and not readable by scripts.
- Each client's data is kept apart, and Elora's AI only ever receives one workspace's data at a time.
- Only invited people with the right role can open a workspace. Accounts lock for 15 minutes after five wrong passwords, and logins are recorded in an audit log.
If we learn of a breach that affects your information, we will contain it, tell the businesses affected without delay, and notify the New Zealand Privacy Commissioner, and other regulators where their laws require (within 72 hours under the GDPR).
10. How long we keep it
| Information | Kept for |
|---|---|
| Marketing data synced from connected accounts | Up to 25 months, then deleted automatically (reports compare 24 full months) |
| LinkedIn Company Page posts (their first 300 characters and results) | Up to 25 months from the day they were published, then deleted automatically; a post deleted on LinkedIn within 12 months of publishing is deleted from Elora at the next sync |
| Raw copies of each fetch from a platform | 90 days |
| Platform access tokens | Until the account is disconnected, then deleted at once |
| Audit log (logins, settings, approvals) | 25 months, also after an account is deleted (who did what: an id, the internet address and sometimes a name) |
| Your account details | While you have access, then 90 days (at most 120 when we postpone it) |
| Voice recordings | Never stored |
| Backups | Up to 35 days, then overwritten |
11. Data deletion instructions
You can have your information deleted at any time, in any of these ways:
- Disconnect a platform in Elora: Settings, Connected platforms, choose the platform, Disconnect. Its access token is deleted at once (and revoked at the platform where it allows), and the data synced from it is deleted from Elora within 24 hours.
- Remove Elora at the platform:
- Google: myaccount.google.com/permissions, choose Elora, Remove access.
- Facebook and Instagram: Facebook Settings and privacy, Settings, Apps and websites (Business integrations for business accounts), choose Elora, Remove.
- LinkedIn: Settings, Data privacy, Permitted services, choose Elora, Remove.
- Microsoft: myapps.microsoft.com or account.live.com/consent/Manage, choose Elora, Remove.
- Ask us: email privacy@askelora.io with the subject "Delete my data", from the email address you use with Elora (or the email of the Facebook, Google, LinkedIn or Microsoft account you connected), saying what you want deleted. We confirm we have it within 5 working days and confirm the deletion within 30 days. We may ask you to confirm it is you first.
When a workspace is deleted, all of its data, tokens and keys are deleted. Data in backups is overwritten within 35 days. We keep only what the law requires us to keep, and we tell you if that applies.
12. Your rights
- New Zealand (Privacy Act 2020): you can ask to see the personal information we hold about you and to have it corrected. You can complain to the Privacy Commissioner at privacy.org.nz.
- European Economic Area and United Kingdom (GDPR and UK GDPR): you can ask for access, correction, deletion, restriction, a copy in a portable format, and you can object to our processing. You can complain to your local data protection authority.
- California (CCPA, as amended by the CPRA): you can ask to know what personal information we collect, use and disclose, and ask us to delete or correct it. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of, and we will never treat you differently for using your rights.
- Australia (Privacy Act 1988): you can ask to see and correct your information, and complain to the OAIC.
To use any of these rights, write to privacy@askelora.io. If your information came to Elora through a business that uses it (section 2), we will pass your request to that business and help it answer.
13. Data outside New Zealand
Elora's servers are run by BlueOcean. The AI service is in the United States. Before information leaves New Zealand we make sure it will be protected to a standard comparable to the New Zealand Privacy Act 2020 (Information Privacy Principle 12) and, for personal data from Europe or the United Kingdom, we rely on the European Commission's standard contractual clauses or another lawful transfer mechanism.
14. Cookies
Elora uses only the cookies it needs to work. There are no analytics, advertising or third-party cookies, and the public pages load no outside scripts or fonts.
| Cookie | What for | Lasts |
|---|---|---|
Elora.Auth | Keeps you logged in (encrypted, secure, not readable by scripts) | Until you log out or close the browser; ends after 8 hours without use |
Elora.Af | Protects the login and logout forms from forged requests | Until you close the browser |
15. Children
Elora is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect information about children.
16. Changes to this policy
We will post any change here with its date, and tell the businesses using Elora before a change that affects them.
17. Contact us
Privacy officer, BlueOcean Agency, New Zealand. Email privacy@askelora.io.
Draft for legal review.