Privacy Policy
Eldem — operated by Petruskevich Web & AI Solutions
Effective date: 2026-06-18
Last updated: 2026-09-01 (DRAFT — sections 2.5 and 9 require legal review before publishing)
1. Who we are
Petruskevich Web & AI Solutions ("we", "us", "our") provides the Eldem platform — a SaaS tool for freelancers and small agencies to manage clients, invoices, contracts, and projects.
Data controller:
Petruskevich Web & AI Solutions
Israel
Contact: contact@eldem.io
2. What data we collect
2.1 Account and workspace data
- Name, email address, and password (hashed) when you sign up
- Workspace name and configuration settings
- Billing information (processed by our payment provider; we do not store raw card numbers)
2.2 Client and business data you enter
- Client names, contact details, and company information
- Invoice line items, amounts, and payment status
- Contract text and uploaded PDF files
- Project notes, tasks, and file attachments
- Vendor bills and expense receipts you upload
2.3 Usage and technical data
- Log files: IP address, browser type, pages visited, timestamps
- Error reports and performance data
- Session tokens (stored in httpOnly cookies)
- Device and browser metadata
2.4 Data processed by AI features
When you use AI-powered features (e.g. OCR on uploaded receipts), the document image or text is sent to our AI processing provider. We do not use your documents to train AI models. Processed results are stored only in your workspace.
2.5 Accessibility request data
> DRAFT — requires legal review before publishing
When you contact us with an accessibility enquiry or complaint via contact@eldem.io, we collect your name and email address. This data is used solely to respond to your enquiry and is not shared with third parties. It is retained for 12 months.
3. How we use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing and operating the Eldem service | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (invoice delivery, account notifications) | Contract performance (Art. 6(1)(b)) |
| Improving reliability and debugging errors | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations (tax, anti-fraud) | Legal obligation (Art. 6(1)(c)) |
| Sending product updates and feature announcements | Legitimate interests (Art. 6(1)(f)) — you can opt out at any time |
We do not sell your data. We do not use your data for advertising.
4. Who we share data with
We share data only with the following categories of third-party processors, under data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting, serverless functions, file storage (Vercel Blob) | EU region (Frankfurt) |
| Neon Inc. | PostgreSQL database | EU region |
| Resend / email provider | Transactional email delivery | EU/US |
| Anthropic / AI model providers | OCR and AI features | US (data minimised; no training) |
| Paddle.com Market Limited | Payment processing (Merchant of Record) | EU/US |
| Sentry (if enabled) | Error tracking | EU region |
We require all processors to maintain adequate data protection measures. For processors outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
5. International data transfers
Our primary infrastructure runs in the EU (Frankfurt region) via Vercel and Neon. Some processors (e.g. AI model APIs) may transfer data to the United States. Where this occurs, the transfer is covered by SCCs or the processor's participation in a recognised adequacy framework.
As a company based in Israel, we note that the European Commission has recognised Israel as providing an adequate level of data protection for personal data transfers from the EU (Commission Decision 2011/61/EU, as updated).
6. How long we keep data
| Data type | Retention period |
|---|---|
| Active workspace data | For the life of your subscription + 30 days after cancellation |
| Deleted workspace data | Purged within 30 days of deletion request |
| Server logs | 90 days rolling |
| Backups | Up to 7 days (point-in-time recovery) |
| Legal/financial records | 7 years (statutory requirement) |
You can request deletion of your account and all associated data at any time (see Section 8).
7. Cookies and tracking
We use the following cookies:
| Cookie | Type | Purpose |
|---|---|---|
| `session` / auth cookie | Essential | Keeps you logged in. httpOnly, Secure. |
| CSRF token | Essential | Protects form submissions. |
| Preference cookies | Functional | Language, UI settings. |
We do not use advertising cookies or third-party tracking pixels. If we add analytics, we will update this policy and, where required, ask for your consent.
8. Your rights under GDPR
If you are located in the EU/EEA or the UK, you have the following rights:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure ("right to be forgotten") — request deletion of your data
- Restriction — ask us to limit how we process your data
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
To exercise any of these rights, email contact@eldem.io. We will respond within 30 days. We may need to verify your identity before acting on a request.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority. For EU residents, the relevant supervisory authority is the one in your country of residence. For Israeli residents, the Privacy Protection Authority (Reshut HaGanat HaPratiyut).
9. Your rights under Israeli privacy law (Amendment No. 13)
> DRAFT — requires legal review before publishing
Israel’s Privacy Protection Law (5741–1981), as amended by Amendment No. 13 (effective August 2025), grants the following rights to data subjects in Israel:
- Right of access — request a copy of personal data we hold about you
- Right of correction — request correction of inaccurate or incomplete data
- Right of deletion — request deletion of data we are not legally required to retain
- Right of portability — receive your data in a structured, machine-readable format
- Right to object — object to processing for direct marketing purposes
- Right to be notified — be notified of a data breach that may cause you harm
To exercise these rights, email contact@eldem.io. We will respond within 30 days as required by Israeli law. We may need to verify your identity before acting on a request.
> Note for Lora (legal review required): Amendment No. 13 may require registration of certain databases with the Privacy Protection Authority and/or appointment of a Data Protection Officer, depending on the volume and sensitivity of data processed. Please confirm with your legal advisor whether database registration under the Privacy Protection Regulations (Data Security) 5777–2017 applies to Eldem’s current scale of operations, and whether a formal DPO designation is required.
10. Security
We take reasonable technical and organisational measures to protect your data:
- All data in transit is encrypted with TLS 1.2+
- Passwords are hashed with bcrypt
- Database access is restricted and uses encrypted connections
- File storage keys are validated; direct URL access requires authentication
- Webhook payloads are verified with HMAC-SHA256 signatures
- We perform regular security reviews
No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it to contact@eldem.io before public disclosure.
11. Children's privacy
Eldem is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us at contact@eldem.io and we will delete it promptly.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will notify you by email and by posting the updated policy here with a new effective date. Continued use of Eldem after the effective date constitutes acceptance of the updated policy.
13. Contact
Petruskevich Web & AI Solutions
Israel
Email: contact@eldem.io
For general support: contact@eldem.io
Website: https://eldem.io
This Privacy Policy was last reviewed on 2026-06-18.