Elyum

Privacy Policy

Effective 8 September 2026. Elyum AI, Inc. (“Elyum”, “we”) operates elyum.ai. This policy explains what information we collect when you use Elyum, how we use and share it, how long we keep it, and the choices you have. Contact: [email protected].

1. Information we collect

  • Account information: your email, name and password (stored hashed), or the identifier from a sign-in provider such as Google; your sessions, API keys (stored hashed) and connected apps; and, at sign-up, your IP address, approximate location and a device identifier, which we use to keep the service secure and to prevent abuse of free credits.
  • Billing information: your plan, credit balance and transaction history. Payments are handled by our payment provider (Stripe); we never see or store full card numbers.
  • Your content: what you bring into Elyum (uploads, reference images and clips, creator photos, briefs), your prompts and settings, what you generate, and the choices you make about it (keep, kill and any reason you tag).
  • Usage and technical information: how you use the service, such as the pages and features you use, your generation history (model, settings, timing, credits, status), how you review previews, and technical data such as browser type, device, IP address, error reports and server logs.
  • Analytics and advertising information: product analytics collected through PostHog, including replays of how our interface is used so we can see where the product breaks (passwords are always masked, and card details never pass through our pages). If you arrive from an ad, advertising pixels (Meta, TikTok, Reddit) may record the visit and key conversion events; see section 6.
  • Support and communications: messages you send us through the support messenger (Intercom) or by email, and the emails we send you.
  • Earn program information: if you take part in Elyum Earn, your payout details (PayPal or Wise), tax forms, links to your channels and posts, and the records of your referrals and rewards.

2. How we use it

We use this information to:

  • provide the service: run your renders, deliver and store your outputs, meter credits, and keep your library and history available to you;
  • bill you and send receipts, and pay Earn rewards where you have earned them;
  • keep Elyum safe: authenticate you, enforce limits, detect fraud and abuse of free credits and programs, and protect our users, our providers and ourselves;
  • support you and send transactional messages (verification, password resets, receipts, notices about your account);
  • understand and improve Elyum: measure what works, fix problems, and develop and improve the service, including the systems that rank, evaluate and recommend outputs. We learn from how the service is used, including which outputs are kept, and where we can we do this with aggregated or de-identified information. You can ask us not to use your workspace’s content for improvement at any time (section 8);
  • tell you about Elyum, with your consent where the law requires it. You can unsubscribe from marketing at any time.

Where EU or UK law applies, our legal bases are the contract with you (providing and billing the service), our legitimate interests (security, fraud prevention, analytics and improvement, communications about your account), your consent (marketing, and cookies where the law requires it), and our legal obligations (tax, accounting, responding to lawful requests).

3. How we share it

We share information only as needed to run Elyum:

  • AI model providers. To generate output, your prompts and the inputs you provide are sent through our inference gateway to the third-party model providers that produce the result. Providers process inputs to fulfil the request under their own terms and may hold outputs briefly at unguessable addresses; we mirror outputs to storage we control and serve them from there.
  • Service providers that host and operate the service for us: hosting and database, our AI gateway, payments (Stripe), transactional email, support (Intercom), product analytics (PostHog), bot protection (Cloudflare) and the advertising platforms in section 6. They act on our instructions and may use the information only to provide their service to us. A current list is available at [email protected].
  • Model quality feedback. We may share aggregated or de-identified statistics with the model providers whose models we route to, such as keep rates and failure rates, so they can improve their models. This never includes your name, email, account identifiers or your files. You can ask us to exclude your workspace (section 8).
  • At your direction: when you download, share or export outputs, publish a link, or connect an agent, API key or third-party tool to your account.
  • Legal, safety and business reasons: to comply with the law or a lawful request, to protect the rights, safety and property of our users, our providers or ourselves, and in connection with a merger, acquisition, financing or sale of assets, in which case this policy continues to apply to your information.

We do not sell your personal information, and we do not share your content with advertisers.

4. How long we keep it

We keep information for as long as we need it for the purposes above. Your account information, content and generation history stay available while your account is active, so your library and history are there when you return; previews you don’t keep are never charged, and the record of your decisions is part of that history. Billing and tax records are kept as long as accounting and tax law requires, and security logs for a limited period. When you delete your account (from /account), we delete your workspace, content, history and mirrored files and stop using your content to improve the service; we keep only what the law requires, a minimal record that the deletion happened, and information that has been aggregated or de-identified so it no longer identifies you.

5. Security

We use technical and organisational measures appropriate to the information we hold: encryption in transit, hashed credentials and keys, access controls and monitoring. No online service is perfectly secure, so please keep your password and API keys safe and tell us at [email protected] if you notice anything unusual.

6. Cookies, analytics and advertising

Strictly necessary: cookies for sign-in and security. Functional: a first-party cookie that remembers who referred you for 30 days, so your friend gets credit.

Product analytics: we use PostHog to understand how Elyum is used (pages, clicks, performance, errors and replays of interactions with our interface). Analytics traffic goes through our own domain and is linked to your account while you are signed in, so we can fix what breaks for real users.

Advertising measurement: pixels from Meta, TikTok and Reddit help us see whether our ads work. They set cookies and receive limited events (a visit, a sign-up, a checkout started, a completed purchase and its amount) so the platforms can attribute conversions to their ads, and they may link this to the profile they hold about you under their own policies. We never send them your prompts, uploads or generated content. Some US state laws treat this as “sharing” for targeted advertising; you can stop it with browser tracking protection or an ad blocker without affecting the service, or by emailing [email protected].

7. International transfers

We are a US company; our servers are in the European Union, and our providers, including AI model providers, may process information in the United States and other countries. Where the law requires, we rely on recognised safeguards such as the European Commission’s standard contractual clauses for these transfers.

8. Your choices and rights

You can view and update your profile, sessions and API keys and delete your account on /account, and download your outputs from your library. Depending on where you live, you may also have the right to access, correct, port or delete your information, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority; we do not treat you differently for exercising these rights. To object to our using your workspace’s content to improve the service, or to sharing de-identified statistics about it with model providers, email [email protected] and we will exclude your workspace. We answer requests within the time the law allows and may need to verify your identity first.

9. Real people in your content

If you upload photos, videos or voices of real people (yourself, staff, creators), you are responsible for having their permission. We use those images and voices only to produce the output you request, and we do not build databases to identify people from them. House creators are synthetic.

10. Children

Elyum is for adults (18+). We do not knowingly collect information from children; if you believe a child has given us information, contact [email protected] and we will delete it.

11. Changes

We post changes here and update the effective date; for material changes we also notify you in the app or by email where practical.