Privacy Policy

This policy explains how ELPE Circle handles personal information in its current professional community service. It replaces the investment-analysis description for this fresh Circle build; it does not authorize importing Elpe-Quant accounts, documents or activity. Reading or acknowledging this notice is not blanket consent to optional marketing or AI processing.

1. Who handles your information

ELPE Circle’s operator manages membership, the website and its records. For a privacy question or access, correction or deletion request, contact privacy@elpe.ai. The operator’s full legal identity and jurisdiction-specific details are being confirmed for general availability; this notice should not be read as a certification of compliance in every country.

2. Information you provide

• Applications: name, work email, firm, role, professional context, application status and review history. New applications record the date and versions of the terms, privacy notice and house rules acknowledged.
• Accounts: profile details, a one-way password hash, account status, role, email-ownership verification, sign-in sessions and security events. Where two-step security is enabled, administrator accounts use encrypted authenticator secrets and one-way recovery-code verifiers. Session controls show a general device label, creation time and recent activity, not a precise location. Security tokens expire and are usable only for their intended action; a password reset does not remove administrator two-step security. Administrators may assign private institutional “circle tags”.
• Optional personal recovery email: you can add and verify a separate personal address during onboarding or in Your membership. After its requested verification email, it is used only for institution transfers and membership continuity, not routine password resets, community updates, your public profile or shared contacts. It provides supporting evidence during private administrator review, not automatic approval. You can remove it in Your membership; existing delivery records and backups follow our retention practices.
• Community activity: threads, replies, personas, legacy thread-specific aliases, saved discussions, reports and moderation records. We retain private account-to-contribution links, connection records and discussion-access grants. Persona names are reserved permanently and cannot be reused after retirement. Rotation changes future attribution; existing contributions keep their original persona.
• Help requests: information you submit through the help form or send us by email, plus requested service emails, recovery-token verifiers and sending-status records.
• Optional preferences: interests you select, onboarding completion, and your community-email choice. Interests are separate from administrator-assigned circle tags and do not grant access. Community email is off by default; you can change this in Membership. We keep a dated, versioned record of these choices separately from acknowledgement of the terms and house rules. Necessary security and membership messages are not disabled by the community-email setting.

Help requests and internal response notes are available to authorized administrators. A public form submission does not prove ownership of an email address or authorize deletion. We verify identity before acting on account or data requests; marking an intake request resolved does not itself delete account records. Please do not include passwords, recovery codes, authenticator secrets, investment documents or third-party confidential information in a help request.

Fields required for membership review and account security are necessary to process an application or provide access. Optional profile text is your choice. Do not submit confidential investment materials or sensitive personal information about yourself or others.

3. Technical information and cookies

Participation and appreciation: your private Circle passport and weekly goals are calculated from your profile bio, available Circle Network and open GP forum posts, replies and saves, together with legacy named Circle activity. Inaccessible or paused new discussions do not qualify for current progress. Historical appreciation remains separate; no new reputation score or invitation reward is activated by this checklist. Backchannel activity is excluded. Members see aggregate “Useful” counts on eligible legacy named contributions, not a list of who marked them. We retain the account-to-mark relationship to enforce one mark per person, allow withdrawal and prevent abuse. Your progress and display preference are available only to you in member-facing APIs, though authorized operators can access underlying records for the purposes explained below. Hiding progress changes its display; it does not erase source activity. Goals reset by calendar week (Monday 00:00 UTC); this is not deletion of posts or marks. These features send no engagement emails and do not create public rankings or eligibility scores.

Optional contribution reputation: when the owner enables Insightful endorsements, we keep the member, contribution revision, mark time and reversible scoring ledger to prevent duplicate credit and manipulation. Points mature after seven days with repeated-peer caps. Exact points and progress are self-only in member-facing APIs; authorized operators can inspect underlying records. Optional public tier labels update weekly, are fixed per discussion, and are suppressed for small eligible audiences and uncommon tiers. This reduces—but does not eliminate— cross-thread inference. Pseudonym changes do not reset account reputation. Withdrawal, edits, visibility, blocks and eligibility changes can remove credit. Optional lifetime invitation rewards are accounted for separately. Disabling the feature pauses collection and benefits without deleting its records. No voter list, public score or leaderboard is published.

Personal invitations: an inviting member supplies your work email and a brief professional relationship note, which we use to associate an invitation with your application and prioritize review. We ask members to get your permission first. Your invitation shows the inviter’s name and firm; administrators see the inviter, recipient email, relationship note and referral history. The inviter sees whether an application was received, but not private review notes. We do not automatically email invitees or publish invitations in a directory. Invitation records, including unused or withdrawn invitations, are retained for quota accounting, abuse prevention and membership administration under the retention approach below; expiry disables a link but is not record deletion. Links use random tokens, hashed for lookup and encrypted while available for the inviter to retrieve. Tokens are removed from the retrievable record on submission or withdrawal.

New personal invitations include a mutual contact exchange. When a new applicant joins through one, both people’s names, work email addresses and companies or institutions are saved into each other’s private Contact Lists after email verification and membership approval. No separate contact-exchange confirmation is required. Receiving that card therefore confirms that the newcomer has joined. Applying without an invitation does not trigger this exchange. Earlier invitations and existing applications are not retroactively enrolled in it.

Member directory: appearing in the directory is optional and off by default. Listing shows your current professional name. You choose which other supported profile fields, expertise topics and interests to share, and whether you are open to introductions. We do not automatically publish your existing private preferences or administrator-assigned circle tags. Directory entries are available only to eligible signed-in members, subject to your visibility choices and relationship blocks; email addresses are not directory fields. Directory searches are not stored as a member search history.

Member-to-member introductions: we store the request, professional reason, participants, consent decisions, expiry and status so members can choose whether to connect. Sending a request requires your explicit permission to share your verified work email if the other member separately accepts the same contact-sharing choice. Neither member receives the other’s email through this feature until both have agreed and the request is still eligible. These are in-site requests, not an open messaging service, and this release sends no introduction emails or email nudges.

You can withdraw contact-sharing permission or block further introductions. Changes to eligibility, visibility or consent can make a request unavailable; restoring those settings or unblocking does not revive an old grant. Withdrawal removes access through the service but cannot recall information already seen, copied or used outside it. Expired, declined or withdrawn request records and blocks are retained for request limits, abuse prevention and dispute handling under the retention approach below, not published as relationship analytics.

Relationship reports: submitting a report shares the stated complaint and the request evidence identified in the reporting form with authorized moderators. The ordinary administrator interface does not provide a general introduction inbox or access to unreported requests. Reports and resolution records are retained for safety and dispute handling. Authorized system operators can access underlying records where necessary for the purposes described in this notice; introductions are not end-to-end encrypted.

One-to-one messages: messaging has its own availability choice, which is on by default for approved members and separate from directory listing or sharing an email through introductions. You can turn it off in Messaging settings; existing opt-outs are preserved. When on, your current professional name and member ID are visible to other messaging-enabled members. We store conversation participants, messages, contact requests and decisions, timestamps, private unread state, mute/archive choices and safety reports. Accepting a first-contact request enables replies; it does not share a verified email address. A first-contact request still requires the recipient’s acceptance before further messages can be sent.

Conversations are available through the service only to their authorized participants. There is no administrator inbox viewer or unrestricted message export. Messages are not end-to-end encrypted: authorized infrastructure or database operators can access stored content, including backup copies. This release does not include message content in email, global community search, analytics or AI features, and it sends no messaging emails.

Contact cards and Contact Lists: within an accepted conversation, you can review your own name, work email and company or institution, choose which fields to include, and explicitly share that card with the other participant. The card is saved automatically into their private Contact List. Shared cards are snapshots of the details shared at the time, not a live subscription to later profile changes. Sharing a card does not list you in the directory or grant new messaging permissions. There is no administrator Contact List viewer; the privileged system-access and backup limitations described above still apply. Do not forward or republish another member’s contact details without permission.

Administrator engagement analytics: authorized administrators can view aggregate counts and rates calculated from current surviving application, membership, personal-invitation and published Circle Network, GP forum and legacy named Circle contribution records. These are aggregates across the community, not a list of authors, personas, private conversations or relationship paths. Discussion titles, bodies and GP-specific breakdowns are not included. Hidden content and ineligible new-discussion authors are excluded; historical totals can therefore change. Legacy question triage is labelled separately because newer discussions do not have that question/resolution classification. The dashboard excludes administrators and records explicitly classified as staff or test, but unmarked test records may remain. It does not inspect private messages, Contact Lists, saved or read state, or Backchannel identities, and it introduces no new behavioral tracking or event archive.

Optional GP-forum launch measurement: this separate capability ships disabled and starts only after the owner explicitly approves its activity policy. It counts eligible, verified non-staff, non-test members who contribute or read an authorized discussion or research page visibly for at least 30 uninterrupted seconds on two different UTC dates within the current 28-date window. Logins, personas, private messages, invitations and background tabs do not qualify. Reading checks use short-lived signed receipts; only the member identifier and UTC date are stored as qualifications, not URLs or reading histories. Expired dates are removed during maintenance; disabling collection clears the qualification rows. Administrators see only the aggregate launch count, not a per-member reading dashboard. Privileged operators can access underlying qualification records subject to the controls below. Milestone notices and owner decisions remain private operating records, and existing backups follow their retention policy. Reaching 500 notifies the owner; it does not automatically open the forum or change anyone’s membership.

Circle Pulse: this optional survey feature is disabled for members unless the owner explicitly activates it. Eligible members may submit one immutable complete response to an open short poll. Until a poll is closed or cancelled, choices are stored alongside membership internally to enforce one response; privileged database operators could access them. This is not cryptographic anonymity or operator-proof secrecy. Administrators receive no live counts, individual choices, respondent identities, response times or raw exports through the service.

Closing a poll creates one fixed, privacy-filtered aggregate and clears stored answer arrays while retaining a choice-free submission receipt. Small samples and questions with small or complementary cells are withheld in full. Released results contain only that fixed sanitized snapshot; cancellation publishes nothing, and withdrawal hides a release permanently. Existing backups may retain earlier answers under their normal retention. Pulse data is not added to engagement analytics, search, messages, notifications or AI features.

Blocking or withdrawing messaging availability stops further contact under the messaging controls. It does not recall messages already delivered. Participants can retain access to their existing history; archiving hides a conversation from one person’s main inbox rather than deleting it for either participant or erasing backups. We retain messaging and safety records under the retention approach below; no disappearing-message or automatic erasure period is promised.

Message reports: the report form previews the selected messages and complaint that you are choosing to disclose to authorized moderators, along with both participants’ current professional names and member identifiers. Reporting does not give moderators access to the remaining conversation or other inboxes. We retain the submitted evidence and resolution record for safety and dispute handling. Do not include unrelated confidential information in a report.

The application and reverse proxy process connection information such as IP addresses, request paths, times and status codes to operate and protect the service. Rate-limit records use derived request/account identifiers. We use a necessary sign-in cookie and limited local preferences in the design preview. See our Cookie Policy.

Optional Google Analytics measures general page categories, navigation and application-received visits only after you allow analytics. Google receives browser/device and connection information. We exclude member identifiers, private content, searches and form entries. You may reject analytics or withdraw permission through Cookie settings. Analytics cookies expire after 90 days. Advertising features, session replay and automatic enhanced measurement are disabled. Resend open and click tracking were disabled when the integration was configured. We do not use a cookie banner to imply a choice over necessary sign-in cookies.

4. Why we use information

Some site and design-preview fonts are delivered by Google Fonts. Loading those font styles/files sends connection information such as your IP address to Google’s font-delivery servers; this is distinct from behavioral analytics.

We use information to review applications, manage access, show contributions to their intended audience, save your selected discussions, respond to support requests, deliver account emails, prevent abuse, moderate the community and meet applicable legal obligations.

Where applicable data-protection law requires a lawful basis, the relevant purposes may involve providing the requested service or taking steps before it, legitimate interests in security and community administration, legal obligations, or separate consent for an optional activity. The appropriate entity-specific assessment remains part of the general-availability review. We do not treat accepting terms as consent for every use of personal information.

5. What members and administrators can see

Current Circle Network and GP forum contributions show a persona rather than a real name, firm or role. A persona is consistent until rotated; it is not a fresh identity for each thread. Other members see a coarse relationship degree, not a connection path or public persona history. Ordinary members have one active persona; the service owner may have multiple. The underlying account remains the same.

Circle Network discussions initially reach eligible first- and second-degree connections. Replies can admit the replier’s connections and their connections to the whole thread. When new connections form, eligible members can also receive access to earlier conversations within that first- and second-degree network. Existing access survives disconnection, but blocking, membership eligibility and moderation can restrict it. GP forum discussions, when opened, are addressed to eligible verified allocator members across the site. Tagging a GP in a private discussion never converts it into a GP forum post. Neither area is public on the internet. Legacy named Circle posts still show professional profile details; legacy Backchannel uses thread-specific aliases.

Staff can review applications, account details, circle tags, moderation records and delivery failures. Saved-discussion lists are private in the member interface. Authorized operators with system access can access underlying records, including the identity behind an alias, for necessary administration, support, security, enforcement or legal obligations. This is not end-to-end encryption or absolute anonymity.

Using an employer’s email domain does not automatically give that employer administrative access to your account or private activity.

6. Service providers and disclosures

The service and database run on the existing Netcup server. Resend processes recipient addresses, account-message content and delivery information. Operators retain separate access-restricted backups, using encrypted off-device AWS S3 storage and temporary server-side export/restore staging. Routine releases do not create backups on the operator’s Mac. The retired Elpe-Quant application services, Atlas, Upstash and Qdrant are not used by this build; S3 is used for current backup recovery, not to host the website.

We may disclose information where required by law, to address a substantiated security or rights issue, or to a successor operating the service subject to applicable safeguards and notice requirements. We do not sell private community posts or member lists. We do not provide private content to an external AI service or use it to train general-purpose AI models in this release.

7. Password recovery and application emails

A password-help request receives the same public acknowledgement regardless of membership status. Approved, active members receive a single-use reset link that expires after one hour. Pending applicants instead receive an email explaining that their application is being processed. Requests do not approve membership or change passwords by themselves.

The service stores reset-token hashes. Token-bearing queued messages are encrypted and are not exposed in administrator email previews. Passwords are never included in email. Resend necessarily processes the reset link to deliver it, and email providers may retain messages. Keep reset emails private. A completed reset invalidates other reset links and signs the account out on all devices.

8. Retention and security

We retain applications while reviewing them and as needed to handle membership questions, prevent duplicate or abusive applications and address disputes. Account and contribution records support the active community. Security, moderation, service-email and backup records are retained as needed for recovery, abuse prevention, support and applicable legal obligations; the purpose, sensitivity and outstanding issues determine the appropriate period.

Deletion requests are handled manually after an appropriate identity check. No automatic account-deletion schedule is currently promised. Recovery snapshots follow a separate retention cycle; deleting live records does not immediately erase prior backups. We will explain any necessary retention and restrictions when handling a request. Removing a post from member view is not necessarily immediate erasure from moderation records or backups.

Controls include HTTPS, password hashing, protected session cookies, server-side access checks, rate limits and restricted database/backup access. The off-device S3 recovery repository is encrypted. Live databases and temporary server-side recovery exports can remain readable to authorized operators; this is not end-to-end encryption. No system or email transmission can be guaranteed secure. Retention periods for account, moderation and legal records require operator review before general availability.

9. International processing

Members may be in different countries. Hosting, email delivery and operator recovery copies can involve processing outside your country, where laws may differ. Contact us for current processing-location information. Entity-specific transfer arrangements and any required safeguards must be confirmed before a broader launch; using the website is not treated as a waiver of those requirements.

10. Your choices and rights

You can edit supported profile fields, control your saved discussions, and contact us to request access, correction, account closure or deletion. Depending on applicable law, you may also have rights to portability, restriction, withdrawal of consent and objection to processing, including processing based on legitimate interests. Contact privacy@elpe.ai to make a request. We may verify identity without asking for your password and will respond within applicable legal time limits.

You may complain to the data-protection authority responsible for your jurisdiction where that right applies. An erasure request may require balancing legal retention and other people’s rights; we will explain any limitation. Optional marketing and future AI processing require their own appropriate choices and disclosures.

11. Adults and future changes

ELPE Circle is for adults aged 18 and over. Contact us if a child has submitted information. Planned features such as surveys or AI assistance are not described as already operating. We will update this notice and provide appropriate notice and choices before introducing materially different processing.