Privacy Policy

1. The short version

Elicana's servers never receive your documents, your queries, or your compiled notes. The model provider you configure does, at your direction, on your own key, unless you run models locally, in which case that text never leaves your machine.

That claim has three edges worth stating:

• No request Elicana sends to us carries document, query, or corpus content. Not the license check, not telemetry, not the update check, not the cohort call. Your corpus, your compiled notes, your embeddings, and your local database stay on your disk. The single exception is a support bundle, which is user-initiated and described in §2(g).
• Your documents do go to the model provider you choose. Elicana is bring-your-own-key. Compiling a document means a language model reads it; if you configure Anthropic, OpenAI, or any other cloud provider, the document text and your questions are sent from your machine straight to that provider under your API key, governed by their terms and your account with them. We do not proxy it, meter it, resell it, or keep a copy. If you configure Ollama running on your own computer instead, that text never leaves your machine. Embeddings are computed locally by default in both cases. The field-by-field account is on what leaves your machine, and the contractual account is in Terms §9.
• Elicana does reach the network. It checks your license, it uploads usage counts, and it downloads updates. We will not describe it as offline or air-gapped, because it is neither. If your environment requires that, talk to us before buying.

We are MRNA Inc., a Georgia (USA) S-corporation doing business as Elicana. For the data described here, we are the controller. Because your documents never reach us, we are not a processor of your document content: there is nothing of yours for us to process. Where you send your documents to a model provider, that provider is your processor under your agreement with them, not a subprocessor of ours.

2. What we actually collect

(a) Registration and lead data

When you register on /get, we store what you type into the form:

• Email address (required)
• Name, role, company size, how you heard about us, and a free-text use case (all optional)
• UTM attribution, utm_source, utm_medium, utm_campaign, captured from the link you arrived on

Every registration is stored as a lead whether or not you go on to pay, and is used to understand who is interested in Elicana and where they came from. We also store a hashed email-verification token so we can confirm you own the address before a payment page is ever created for it, only the SHA-256 hash is stored, never the token itself.

(b) Account and billing

We store, for each subscriber: your email address, your Stripe customer and subscription identifiers, your Elicana license key, your subscription status, and your paid-through and grace dates.

Card details never touch our servers. Payment information goes from your browser straight to Stripe. Stripe is the merchant of record for your purchase and holds the payment data; we hold only the identifiers that let us look your subscription up.

Signing in to /account uses a one-time email link. Both the link token and the session token it mints are stored as SHA-256 hashes only, we cannot reconstruct either from our database.

(c) The license check

Three requests make up the entire entitlement conversation. These are the exact contents of each request:

Request	Fields sent
Activate POST /api/v1/license/activate once per machine	Your license key, the hashed machine ID, the hashed hostname, your operating system, and the app version
Check POST /api/v1/license/check on startup if the last check is over 24h old, then on a 24h timer, roughly daily in practice, at minimum monthly	Your license key, the hashed machine ID, and the app version. That is the complete payload, nothing else
Deactivate POST /api/v1/license/deactivate when you free a machine slot	Your license key and the hashed machine ID

The machine ID is a SHA-256 hash of a stable platform machine identifier (/etc/machine-id on Linux, the IOPlatformUUID on macOS, the MachineGuid on Windows), computed on your device before anything is sent. We receive the hash, never the underlying identifier.

The hostname hash is a SHA-256 hash of your computer's hostname, also computed on your device, and sent only at activation so the account page can show you a recognisable label for each machine. Your raw hostname is never transmitted and we never see it.

Our server keeps, per activated machine: the hashed machine ID, the hashed hostname, the OS name, the app version, when it was activated, and when it last checked in. That is the machine list you see on your account page.

(d) Product telemetry

Beta builds report usage counts so we can understand what running Elicana costs and how it is used. Every field is a number, a timestamp, or a coarse category label. The complete list lives in one place in the app, and a test in the build captures the real bytes sent on the wire and fails if they contain anything that list does not describe. That list is republished on what leaves your machine. The automated check binds the code to that list, not the list to this website, so keeping the published page in step is a release step we perform rather than one the build enforces. Summarised by category:

Category	What it contains
Installation envelope	A random installation UUID generated on first run, the app version, the product tier, a coarse corpus-size bucket (<100, 100-500, 500-2k, 2k+), and how many questions you asked this calendar month.
Compilation events	Per note compiled: the model name and provider, whether that model was local or a bring-your-own-key cloud model, input and output token counts, how long it took, the byte size of the source text, tag and wikilink counts, the word count of the generated summary, an expansion ratio, and whether it was a first compile or a recompile.
Query events	Per question answered: the model name and provider, the model tier, the character length of the question, how many results were retrieved, their average relevance score, the word count of the answer, and the latency.
Discovery events	Which category of finding was shown in the research UI, whether it was engaged with or dismissed, its position in the session, and the latency. Keyed to a per-browser-session anonymous UUID that is not linked to the installation UUID.
BYO-key funnel	Whether you saved a paid provider key or chose a local provider during setup, and when.
Corpus composition	Aggregate percentages only: the mix of document types, the mix of file formats, counts per source connector, the number of days spanned by your documents' dates, a coarse total-word-count bucket, and cumulative byte totals for initial ingestion and for recompiles.

What is never included, in any telemetry field: document content, note content, note titles, filenames, file paths, folder names, tag names, the text of any question you ask, the text of any answer, embeddings, or your API keys. Where a field looks close to content, the character length of a query, the word count of an answer, it is the count and only the count.

Two of these can contain words you chose. The per-source counts under corpus composition are keyed by the source label you gave a document, and when you ingest a URL without naming a source, that label defaults to the site's hostname, so a hostname you ingested from can appear as a key. And the model name and provider are sent verbatim from your configuration, so a self-hosted model tag containing an internal name would be transmitted as written. Neither carries document content; neither is drawn from a closed list. We would rather flag the two soft edges than let "never content" do work it cannot support.

Telemetry is authenticated by the installation UUID alone. As implemented today it carries no license key and no email address, and our database has no link between an installation UUID and a subscriber. In practice that makes telemetry pseudonymous rather than tied to your account.

During the beta, telemetry is on and cannot be turned off. It is enabled every time the app starts. That is a deliberate beta condition, disclosed here and in the Terms of Service rather than buried in a settings screen. It is one of the things the early-bird price buys.

(e) Email delivery

We send you transactional email: the sign-in link, the email verification link, the welcome message with your license key, and payment-failure reminders. This is sent through a third-party email provider that handles your email address and the message on our behalf.

Newsletter email is separate. You are only on it if you signed up for it, and every newsletter has a one-click unsubscribe that we honour immediately. Subscribing to Elicana does not put you on the newsletter.

(f) Website analytics

We measure how the website is used. It is cookieless: it sets no cookies, does no cross-site tracking, and builds no profile of you. It reports page views, referrers, and coarse country-level geography in aggregate. Pages that can carry a sign-in or verification token in the URL are excluded from measurement entirely.

(g) Support bundles, only if you send one

If you run elicana support-bundle or submit one from the app's admin page, you upload a zip to us containing recent application logs (a bounded number of days, plus any crash files), your configuration with secret values blanked out, a diagnostic report, and note-count health statistics, plus the email address and message you type in, your app version, your platform, and your installation UUID.

That last item has a consequence worth stating: telemetry is otherwise pseudonymous (see below), but a support bundle carries the installation UUID and your email address in the same upload, so sending one links your telemetry to your identity. If that matters to you, send the zip by email instead, --no-upload writes it to disk and uploads nothing.

Be aware of what logs contain. Application logs include file paths and the text of queries you ran. Redaction is on by default: query text and file paths are stripped from the structured fields of Elicana's log lines, with paths reduced to a short hash plus the extension. You have to pass --include-queries to turn redaction off. Two limits: document titles appear in compile log lines and are not redacted, and crash files are included unredacted. Document bodies are never in the logs at all. Nothing is uploaded unless you personally trigger it, and you can inspect the zip before sending it.

(h) Server-side technical data

Our server uses your IP address transiently, in memory, to rate-limit abusive traffic. IP addresses are not written to our database. Our infrastructure providers keep their own short-lived operational logs, as any host does.

3. Why we collect it, and the legal basis

Data	Purpose	GDPR legal basis
Account, billing, license check	Selling you a subscription, issuing your license key, enforcing the 2-machine limit, letting you sign in and manage billing	Performance of a contract (Art. 6(1)(b))
Email verification	Proving you own the address before a payment page is created for it, this closes a real account-takeover route	Contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in preventing fraud
Transactional email	Sending your license key, sign-in links, and payment reminders	Performance of a contract (Art. 6(1)(b))
Registration and lead data	Understanding who Elicana is for and where demand comes from	Legitimate interests (Art. 6(1)(f)) in developing and marketing the product
Product telemetry	Understanding how customers use the product so we can improve it continuously	Legitimate interests (Art. 6(1)(f))
Rate limiting and abuse prevention	Keeping the service available and blocking attacks	Legitimate interests (Art. 6(1)(f))
Newsletter	Sending product news you asked for	Consent (Art. 6(1)(a)), withdrawable at any time
Website analytics	Knowing which pages are read	Legitimate interests (Art. 6(1)(f)); no cookies are set, so no consent banner applies

You can object to any processing based on legitimate interests, see §7. Note that telemetry cannot be switched off in a beta build, so honouring an objection to it means ending your beta subscription; we will refund the unused period if that is what you want.

We do not use your data to train models. We could not if we wanted to: we have no content. This is a statement about us, and it is worth being clear about what it does not cover: if you configure a cloud model provider, your document text reaches that provider under your own account, and their training and retention policy for that account governs it, not ours. Check the policy of the provider you choose. See Terms §9.

4. How long we keep it

Written honestly, including where the honest answer is "we have not set a limit yet".

Data	Retention
Sign-in links and session tokens	Deleted automatically once expired or used. Sign-in links live 15 minutes; sessions 24 hours. A background job purges them.
Email verification tokens	24 hours from issue. Only the hash is ever stored, and a new token replaces the old one.
Checkout session records	Purged automatically after 48 hours.
Subscriber record, machine activations	Kept for the duration of your subscription plus a reasonable period afterwards, so that resubscribing works and so we can answer billing questions. Deleted on request, see §7.
Registration and lead data	No automatic deletion is in place today. Records persist until deleted on request. We would rather say so than name a limit we do not enforce.
Product telemetry	No automatic deletion is in place today. It is retained indefinitely at present. It contains no content and, as implemented, is not linked to your account.
Support bundles	Kept while the issue is open and for a reasonable period afterwards. Ask us to delete yours and we will.
Payment records	Held by Stripe under its own retention policy and its own legal obligations. Stripe keeps transaction records even after we delete our copy of your account, tax and anti-fraud law requires it.

Setting and enforcing real retention limits for leads and telemetry is on our list. When they exist, this table will say so.

5. Who else processes your data

We use a small number of third-party providers to run the business: payment processing, transactional email, application hosting and database, website hosting and file distribution, and newsletter delivery. They handle only what that job requires, and only on our instructions.

None of them receives your documents, your queries, or your compiled notes, because we never have them. There is no advertising network, no data broker, and no third party that receives your data for its own purposes.

We will name the specific providers to anyone who asks, and we will tell you before adding one that handles your personal data. Email support@elicana.ai.

6. International transfers

All of our processing happens in the United States. Our server and database run in Chicago, and every provider we use is US-based or US-headquartered. If you are in the EU, the UK, or another region with data-transfer rules, using Elicana means your account data is processed in the US.

The practical size of that transfer is small and worth stating: it is your email address, some optional registration answers, billing identifiers, hashed machine identifiers, and usage counts. Your documents are not part of it and never cross any border, because they never leave your computer.

We do not currently have Standard Contractual Clauses or a formal data processing agreement to offer. If you need one for a compliance review, email us and we will tell you honestly where we are rather than send you a document we have not stood behind.

7. Your rights, and how to actually use them

Wherever you live, you can ask us to:

• Access, get a copy of the personal data we hold about you;
• Rectify, correct anything wrong;
• Erase, delete your account and associated data;
• Port, receive your data in a machine-readable format;
• Object, stop processing based on legitimate interests, including telemetry;
• Restrict, pause processing while a dispute is resolved;
• Withdraw consent, unsubscribe from the newsletter, at any time.

The mechanism is one email: support@elicana.ai. Say what you want. We will reply within 30 days and usually much sooner. There is no form, no portal, and no charge.

We will ask you to confirm control of the email address on the account before acting on an access or erasure request, that is a protection for you, not an obstacle.

On erasure: we delete your subscriber record, machine activations, lead records, tokens, and any support bundles. Stripe retains its own transaction records under its legal obligations, and anonymous telemetry that cannot be linked to you may remain in aggregate. We will tell you exactly what was deleted and what could not be.

If you are in the EU or UK and think we have got something wrong, you can complain to your local data protection authority. We would rather you told us first.

8. California residents (CCPA / CPRA)

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We never have, and there is no revenue model here that depends on it.

California residents have rights to know, delete, correct, and opt out of sale or sharing, and not to be discriminated against for exercising them. There is nothing to opt out of, and the same email address in §7 covers the rest. The categories we collect are identifiers (email, name), commercial information (subscription and transaction records), internet activity (page views, usage counts), and professional information (role, company size). We collect them for the purposes in §3 and disclose them only to the subprocessors in §5.

9. Children

Elicana is a professional tool and is not directed to anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us data, email us and we will delete it.

10. Security

Stated plainly, without inflation:

• All traffic to elicana.ai and our API is over HTTPS, forced at the edge.
• We never handle card data. It goes browser-to-Stripe and never reaches our servers.
• Sign-in tokens, session tokens, and email verification tokens are stored as SHA-256 hashes only. A database leak would not yield a usable token.
• Machine identifiers and hostnames are hashed on your device before transmission. We never receive the raw values.
• Your license key is never written in full to a log, locally or on the server, only its short prefix appears.
• Your LLM API keys stay on your machine and are stripped from support bundles.
• Download links are signed and expire in one hour, and are re-checked against your live subscription when redeemed.
• Every write endpoint is rate-limited, and Stripe webhooks are signature-verified and replay-protected.
• Admin access to production is limited to the company's principal, over scoped credentials.

What we are not claiming: we hold no SOC 2, no ISO 27001, and no third-party penetration test report. Elicana is a small company in beta. The strongest security property here is architectural rather than procedural, the sensitive material never reaches us in the first place. No certification substitutes for that, and it is why we keep it that way.

11. If there is a breach

If personal data we hold is breached in a way likely to put you at risk, we will notify affected customers by email and the relevant supervisory authority within 72 hours of becoming aware, describing what happened, what data was involved, and what to do about it.

Worth knowing what such a breach could and could not expose: our database holds email addresses, billing identifiers, license keys, hashed machine identifiers, and usage counts. It holds none of your documents, no note content, no queries, and no API keys, because those were never sent to us.

12. Changes to this policy

If we change this policy in a way that materially affects you, we will email you at least 30 days before it takes effect and update the date at the top. Smaller clarifications take effect when posted. If a change ever widened what leaves your machine, we update that page as part of shipping it. To be exact about how that is enforced: the app's own build test guarantees the code matches its internal field catalogue, and updating the published page from that catalogue is a release step we perform, not one a build gate enforces. We are working on closing that gap; until it is closed, we are not going to describe the page as self-generating.

13. Contact

MRNA Inc. d/b/a Elicana, Georgia, USA.
Privacy questions and rights requests: support@elicana.ai

Related reading: Terms of Service · What leaves your machine, the same commitments at the level of individual fields.