Privacy Policy
Last updated: September 19, 2026
1. Introduction
This Privacy Policy explains how ExplosionAI GmbH (“Explosion”, “we”, “us”, “our”) collects, uses, and protects your information when you use the Ellf platform (“the Service”). We are committed to protecting your privacy and handling your data transparently.
2. Data Controller
Explosion is the data controller for the personal data processed through the Service. For contact details, see Section 11.
3. Data We Collect
Account Data
When you create an account, we collect:
- Name and email address
- Organization name (if applicable)
- Billing information (processed by our payment provider)
Usage Data
We collect anonymized usage telemetry to improve the Service, including:
- Feature usage patterns and session duration
- Error reports and performance metrics
- API request metadata (endpoints called, response times)
Customer Data
Customer Data refers to any data you upload, submit, or process through the Service. We process Customer Data solely to provide the Service to you. If you connect your own self-hosted cluster, your Customer Data stored on the cluster never passes through our servers. See Section 5 for more details.
4. How We Use Your Data
We use your data to:
- Provide, maintain, and improve the Service
- Process payments and manage your account
- Send service-related communications
- Send emails based on how you use the Service, such as help with getting started or with next steps, which you can unsubscribe from at any time
- Respond to support requests
- Comply with legal obligations
5. Data Processing and Storage
Cluster Architecture
Ellf implements a hybrid dual-cloud architecture, consisting of a web application and servers hosted by us, and a data processing cluster hosted by you, either locally or in your own cloud account. Your Customer Data is only stored and processed on your cluster and does not pass through our servers. Our servers never make inbound requests to your cluster.
Project Plans Data Before Migration
When you start using Ellf, your project plan documents are stored in our database. This allows you to get started with project planning immediately and before setting up and installing your cluster. Once your cluster is running, you can migrate this data to your cluster, after which all new project plans data is stored on your cluster instead of our servers.
6. Subprocessors
We use the following subprocessors to provide the Service. Customer Data is only shared with subprocessors to the extent necessary to deliver the specific functionality described.
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Cloud | Infrastructure and hosting | Account data, usage telemetry | United States |
| Stripe | Payment processing | Billing and payment information | United States |
| Mandrill | Transactional email delivery | Email addresses, message content | United States |
| Mailchimp | User journey emails | Names, email addresses, sign-up dates, message content | United States |
We will notify registered users at least 30 days in advance of any changes to this list.
7. Data Retention
- Account Data: retained for the duration of your account, plus 30 days after deletion
- Usage Data: retained in anonymized form for up to 12 months
- Customer Data: retained for the duration of your account, plus 30 days after deletion
- Billing Records: retained as required by applicable tax and accounting regulations
- Project Plans Data: stored on our servers only until your cluster is set up and the data is migrated; deleted from our database upon migration
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent
To exercise any of these rights, contact us at contact@explosion.ai.
9. Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encryption in transit (TLS) and at rest
- Access controls and authentication
- Regular security reviews
- Incident response procedures
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before they take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
11. Contact
For questions about this Privacy Policy or to exercise your data rights, contact us at contact@explosion.ai.