Privacy Policy

Information we collect

We only collect what you choose to send us. When you submit the contact form we receive your name, email address and the message you write, and optionally your company and the service you are interested in. Our server also records the time of submission and the browser user-agent string, which we use to detect automated abuse.

This website carries the Meta Pixel, which reports your visit to Meta (Facebook and Instagram) so we can measure our advertising. It records the pages you view here and whether you submitted the contact form. It does not send Meta the contents of your enquiry.

WhatsApp Business connections

Businesses we work for can connect their own WhatsApp Business Account to us from their dashboard, from our staff’s screen, or from a one-time link we send them, either through Meta’s own signup window, which Meta runs with its own script on that page, or by entering three values generated in their own Meta account. Either way we receive the WhatsApp Business Account id, the phone number id, and an access token the business issues to us so we can answer messages on that number. We never see or store a Facebook or WhatsApp password, and the token is stored server-side only — it is never readable by any browser, including the account holder’s own, and we verify it with Meta before storing it. When a new number is set up through the signup window, its two-step verification PIN is shown to the business once and not kept by us.

When someone messages a business connected to us, their WhatsApp number, the name on their WhatsApp profile and their message reach our server. We keep the conversation so that business can read it and reply from its dashboard, together with the times its automatic replies depend on, such as when the person last wrote, so a greeting is not sent twice. For photos, voice notes and documents we keep only what kind of file was sent; the file itself stays with WhatsApp. On a number that stays in the WhatsApp Business app, what the business sends from the app on its phone is passed to us too and kept with the conversation. When such a number connects, and only if the business agrees in Meta’s window, Meta also sends us up to six months of that number’s past one-to-one chats and the names the business saved for its contacts on the phone, which we keep in the same way, so the business sees each conversation whole. Nothing is sent to anyone in answer to a past chat. Only the business that was written to can read its conversations, and Elephant Tech staff when we run the number on that business’s behalf. We do not build profiles of the people who write in and we do not use their messages for advertising. A truncated copy is also written to our server logs for troubleshooting and retained for a short period.

A business can choose to have AI answer its messages. It then connects its own account with an AI provider (Anthropic, OpenAI, Google or DeepSeek), and for each reply we send that provider the latest messages of the conversation from the past day, with what the business has written about itself, and pass the provider’s answer on as the business’s reply. The provider handles that text under its own terms with the business. The business’s key to that account is stored encrypted and never shown again, and the AI is told to answer only about that business.

A business can delete any conversation from its inbox, and can end the connection at any time by choosing Disconnect in their dashboard, which destroys the token, tells Meta to stop sending us their messages and deletes every conversation we kept for them. Access can also be withdrawn from Meta Business Integrations in their own Meta settings; the conversations are then deleted on request. Full instructions, including how someone who is not an account holder can ask us to delete their data, are on our Data Deletion page.

The 打小人 game

Our Petty Office game (/games/xiaoren) lets you open a playful “case file” and, if you choose, add a photo that is shown on a cartoon pig. When you start a case, the name, the relationship and the text you typed, the photo (shrunk to a small square in your browser first), the language you used and your browser’s user agent are sent to us and kept so that our staff can see them in our admin. Nobody else can see them. Staff can delete any case at any time, and you can ask us to delete one by emailing us. Please only upload a photo you are allowed to use.

The City Tycoon game

City Tycoon (/games/tycoon) needs no account. The first time you play online, your browser is given a random guest number, kept in a cookie, so that your seat at a table stays yours if you close the page and come back. The nickname and character you choose, and the moves you make, are kept on our servers with the table you play at, so the other players can see them. A table and everything in it is deleted automatically 30 minutes after its last move, or two hours after its game ends. Games against the computer run in your browser and send us nothing. Your nickname, character and sound settings are also remembered in your browser for next time.

How we use it

Your information is used to respond to your enquiry, to prepare a proposal if you ask for one, and to keep a record of our correspondence. We do not sell personal information, and we never pass the contents of your enquiry to a third party for marketing. The one exception to keep in mind is the Meta Pixel described above: when the contact form is submitted successfully it tells Meta that an enquiry happened, without any of the details you wrote.

Where it is stored

Enquiries, and the conversations of connected WhatsApp numbers, are stored in a managed PostgreSQL database provided by Supabase, and the website is hosted on Cloudflare. Both providers process data on our behalf under their own security and data-processing terms. Access to the enquiry dashboard is restricted to named Elephant Tech accounts, and each business can read only its own conversations (our staff can read those of the businesses whose numbers we run), both protected by authentication and database-level access policies.

How long we keep it

We keep enquiry records for as long as needed to deal with your request and to meet our legal and accounting obligations. You can ask us to delete your record earlier and we will do so unless we are required to retain it. Conversations on a connected WhatsApp number are kept until the business deletes them or disconnects its number, or until we are asked to delete them.

Cookies

The Meta Pixel sets cookies in your browser so Meta can recognise the same visitor across pages and, if you use Facebook or Instagram, connect that visit to your account there. You can stop this by blocking third-party cookies in your browser, by using a tracker blocker, or through the ad preferences in your Meta account.

The admin dashboard at /admin sets a session cookie that is strictly necessary to keep an authorised administrator signed in. It is not used for tracking.

City Tycoon sets a cookie holding a random guest number, which keeps your seat at a game table. It holds nothing about you and is not used for tracking.

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or erased, to object to or restrict our use of it, and to receive a copy in a portable format. To exercise any of these rights, email contact@elephanttechhq.com and we will respond within 30 days.

Step-by-step deletion instructions, including for a connected WhatsApp Business Account, are on our Data Deletion page.

Security

Data is encrypted in transit using TLS and at rest by our infrastructure providers. Administrative access follows least-privilege principles, secrets are held in managed environment stores rather than in source code, and dependencies are monitored for known vulnerabilities.

Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes affecting how we use information already collected will be communicated directly where we hold contact details for you.