Your Data, Your Controls

1. What this site processes (elysea.app)

The site serves public pages and a connected portal (accounts, applications, keys, consents, memory, logs), closed by default by the PORTAIL_OPEN server switch. Data processed:

• — Name, email, message: retained 12 months after the last exchange, solely to respond to your request.
• — Server access logs: generated automatically by the hosting provider (Vercel, region not proven — outside the EU possible) — IP address, timestamp. Not accessed by the publisher on a daily basis; period set at the provider, record to be attached.
• — Portal account (if the portal is open): email, password (hashed); kept until the account is deleted.
• — Audience measurement and browser error reports (PostHog, Sentry): only after you click “Accept”; withdrawal via the “Manage cookies” link in the footer. Details: cookie policy.

This site asks for no health data. Without your consent, it sets no analytics cookie; no advertising pixels. Full list of processing operations and their periods: privacy policy.

2. Exercising your rights over this site's data

Under the GDPR (Articles 15–22), you may at any time:

• — Access: obtain a copy of the data we hold about you (Art. 15).
• — Rectify: correct inaccurate information (Art. 16).
• — Erase: request deletion of your data (Art. 17).
• — Restrict: suspend processing without erasure (Art. 18).
• — Object: stop processing based on legitimate interest (Art. 21).
• — Portability: receive your data in a machine-readable format (Art. 20).

To exercise any of these rights: contact@elysea.app. Response within one month (Art. 12 GDPR). In case of persistent difficulty, you may lodge a complaint with your national data protection authority (e.g. CNIL in France).

3. Your data in ELYSÉA applications

If you use an ELYSÉA application (e.g. ELYSÉA Academy), your data — including consented memory — lives in that application, not on this showcase.

Cross-app memory model

ELYSÉA memory works on a two-level model:

• — Per application (default): your memory in Academy stays in Academy; it is not accessible to other ELYSÉA applications.
• — Cross-app (explicit link): if you choose to link your applications, part of your memory may be shared between them. This sharing never happens without your explicit action.

Controls available today

In ELYSÉA Academy, a dedicated screen allows you to:

• — View your active memory
• — Revoke your memory consent (Manage consent →)
• — Delete your account and data (Art. 17 GDPR)

Data export (GDPR art. 20 / portability) will be available when it opens, from My space → My data. For any request by email: contact@elysea.app.

My Space portal

A centralised portal provides unified management of all your ELYSÉA data (memory, account, consents, export) from a single point. Go to My Space →

Conversation protection

When the brain confirms a vital danger, it records the “vital risk confirmed” state in your session state and in its session handoff; it writes a human escalation notification to the application's builder (hashed user identifier, no message text); it writes an alert to the recipient the builder chose at installation — no choice, no alert. Emergency numbers are served to you in every case. The retention period of these records is not yet set by the brain.

4. Where is your data hosted?

This site: hosted by Vercel (region not proven — outside the EU possible). Contact form messages transit via Brevo (region not proven — outside the EU possible).

ELYSÉA applications: Supabase database (eu-central-1 (Francfort) (EU)), Firestore database (europe-west9 (EU)), Core orchestrator Cloud Run (europe-west1 (EU)); model through Amazon Web Services (Bedrock) (eu-west-3 (EU)) or Google Cloud (Vertex AI) (eu (EU)). The code also accepts paths outside the EU possible (direct model access, other providers): full list in the privacy policy.

The sub-processors handling your data for ELYSÉA applications are listed in the privacy policy of each application.