1. Scope and controller
This Privacy Policy explains how ELK Utilities collects, uses, shares, retains, and protects personal information when you visit elkutils.com, create an account, purchase or use the website-based monitoring service, connect telemetry, or contact support. ELK Utilities is not offered through the Apple App Store or Google Play, so mobile-store privacy disclosures do not apply.
The ELK Utilities operator is the controller for website, account, billing-administration, support, and product-analytics data. For personal data contained in telemetry that a customer directs us to process, the customer is generally the controller or business and ELK Utilities acts as processor or service provider. Questions and rights requests may be submitted through the contact channel on elkutils.com.
2. Information we collect
Depending on how you use the Service, we collect:
- Account and identity data: name, email address, user ID, authentication records, acceptance of terms, locale, account role, and organisation or tenant identifiers.
- Billing data: subscription, plan, payment status, invoices, Stripe customer identifiers, and limited transaction details. Stripe processes full payment-card details; ELK Utilities does not need to store them.
- Service and telemetry data: exporter configuration, tenant-scoped logs, metrics, labels, alert rules, dashboard activity, namespaces, system status, and technical identifiers from systems you connect.
- Support and AI data: chat messages, attachments or text you intentionally provide, troubleshooting context, model output, feedback, safety signals, and trace metadata.
- Website and device data: IP address, browser and device type, pages viewed, referring URLs, timestamps, cookie choices, and analytics events when optional analytics is enabled and consented to where required.
- Communications and security data: emails, renewal notices, account-deletion requests, audit events, rate-limit events, suspected fraud, and incident records.
We collect data directly from you, automatically from your browser or connected systems, from authorised account users, and from service providers such as Stripe.
There is no public customer upload bucket. Customer telemetry is tenant-scoped rather than intentionally published to other customers. Deployment credentials and application secrets are kept out of Git and managed through restricted runtime secret systems. You should not place passwords, access tokens, private keys, or unnecessary personal data in telemetry or support messages.
3. Purposes and legal bases
We process personal data for the following purposes and, where the GDPR or similar law applies, on these legal bases:
- Contract: create and secure accounts; provide dashboards, telemetry ingestion, alerts, support, billing, cancellation, renewal reminders, and requested deletion.
- Legitimate interests: maintain reliability and security, prevent abuse and fraud, troubleshoot, measure non-cookie product performance, improve support quality, enforce terms, and protect tenant isolation. We balance these interests against individual rights.
- Consent: place or read optional analytics cookies, run Google Tag Manager or Google Analytics where consent is required, and send optional marketing communications. You may refuse or withdraw consent without losing core service access.
- Legal obligation: keep tax and accounting records, respond to lawful requests, comply with consumer and privacy law, and preserve records when legally required.
- Vital interests or substantial public interest where recognised by law: take proportionate safety steps when communications indicate an immediate and serious risk. The Service is not an emergency service.
Where we ask for consent, the request is specific and separate from unnecessary processing. You may change cookie choices through available site controls. Withdrawal applies prospectively and does not invalidate earlier lawful processing.
4. Cookies and analytics
Essential cookies support sessions, authentication, security, language, and consent preferences. Optional analytics may use Google Tag Manager and Google Analytics to understand visits and product usage. Where required, those tools remain disabled until you consent. Declining analytics does not prevent account or paid-service use.
Google and tags configured through Google Tag Manager may receive online identifiers, device information, page activity, and IP-derived information. Depending on applicable law, this analytics disclosure may be treated as “sharing” for cross-context behavioural advertising even though ELK Utilities does not sell personal information for money. You may opt out by declining or withdrawing analytics consent. We do not knowingly sell personal information.
Browser deletion, blocking, and recognised preference signals may also limit cookies, although blocking essential cookies can prevent login.
5. Artificial intelligence and automated processing
ELK Utilities uses AI to assist support: it may classify a request, retrieve documentation, summarise context, draft a response, or identify a safety-related message. Support chat inputs, relevant account or tenant context, and generated outputs may be processed by third-party LLM providers. Langfuse may record traces and quality signals, and Chatwoot may store the conversation. Human personnel may review interactions for support, safety, abuse prevention, and quality.
When a response is AI-assisted, you are interacting with or receiving content from an automated system. AI output can be inaccurate. ELK Utilities does not use AI to make legal, credit, employment, housing, insurance, or other similarly significant eligibility decisions about individuals, and support automation does not produce a decision with legal or comparably significant effect.
Avoid submitting sensitive personal information or secrets in chat. Where a message suggests self-harm, an automated safety process may return crisis resources instead of sending the message to an LLM. In the United States, call or text 988. International resources are available at https://www.iasp.info/suicidalthoughts/. For immediate danger, contact local emergency services.
6. Service providers and disclosures
We disclose only information reasonably needed for providers to perform services, under contractual or technical safeguards appropriate to their role. Providers and infrastructure may include:
- Stripe for checkout, recurring billing, invoices, and the self-service cancellation portal;
- Mailgun for account, support, renewal, and transactional email;
- Google Tag Manager and Google Analytics for optional website analytics;
- third-party LLM providers for AI-assisted support, without naming a provider that may change;
- Langfuse for LLM tracing, evaluation, and quality observability;
- Chatwoot for support chat and conversation management;
- Cloudflare, when enabled, for DNS, content delivery, traffic security, and edge processing;
- Grafana for tenant-scoped dashboards and visualisation; and
- Kubernetes infrastructure operated by the ELK Utilities operator for application workloads, tenant isolation, telemetry processing, and runtime secrets.
7. Retention and security
We retain personal data only as long as reasonably necessary for the purposes above, the active account or subscription, configured telemetry retention, and legal, accounting, security, fraud-prevention, backup, and dispute requirements. Retention periods vary by category and customer configuration. Data may persist briefly in encrypted backups or logs until normal rotation, with access restricted.
Security measures include tenant-scoped access, authentication, role controls, encryption in transit where supported, audit logging, restricted Kubernetes namespaces, and runtime secret management rather than committed secrets. No system is perfectly secure, and monitoring is best effort with no service-level guarantee unless a written agreement says otherwise.
8. Account deletion and right to be forgotten
You may request account deletion through available account controls or the contact channel on elkutils.com. After verifying the request, we will delete or de-identify account records and tenant resources unless retention is necessary for payment, tax, fraud prevention, security, legal claims, or another lawful exception. Active subscriptions should first be cancelled in the Stripe portal; cancellation is online, no harder than signup, and does not require contacting support.
9. Your privacy rights
Depending on location, including under the GDPR, UK GDPR, CCPA/CPRA, and similar laws, you may have rights to:
- know or access the personal information we process and obtain a portable copy;
- correct inaccurate information;
- delete information or exercise the right to erasure;
- restrict or object to processing, including processing based on legitimate interests;
- withdraw consent at any time;
- opt out of sale or sharing, targeted advertising, or certain profiling;
- receive information about data categories, sources, purposes, and recipients; and
- appeal a refusal or complain to your local data-protection authority.
We will not discriminate against you for exercising privacy rights. We may verify identity and authority, and certain data may be exempt. Submit requests through elkutils.com; our response timing will follow applicable law.
10. Children
The Service is for adults aged 18 or older. We do not knowingly collect personal information from children. If you believe a person under 18 has provided personal information, contact us so we can investigate and delete it as appropriate.
11. Billing communications and choices
Service emails necessary for an account or subscription are not marketing messages. This includes security notices, receipts, operational alerts, deletion confirmations, and a renewal reminder sent 3–7 calendar days before each recurring charge. You cannot opt out of necessary transactional messages while the relevant service remains active, but you may cancel recurring billing through the Stripe customer portal without contacting support.
Optional marketing messages include an unsubscribe mechanism. Cookie consent and email preferences do not override communications required to fulfil a transaction or comply with law.
12. Changes, language, and contact
We may revise this Policy as services, providers, or law change. We will update the date above and provide additional notice when required. Material changes apply prospectively unless law permits otherwise.
English is the primary version of this Policy. Translations are provided for convenience; where permitted by law and translations conflict, the English version controls.
For privacy questions, rights requests, complaints, or information about safeguards, use the contact channel published on elkutils.com.