ElysianPrimus Privacy Policy

Version 1.0 · Effective October 19, 2026 · Plain text of this version

1. Who We Are and What This Policy Covers

Effective date: October 19, 2026 · Version: 1.0

1.1 Who we are. This Privacy Policy explains how Elysian Intelligence Consultants LLC, an Oregon limited liability company ("Elysian", "we", "us" or "our"), collects, uses, shares and protects Personal Data in connection with the ElysianPrimus APIs, the customer portal and the website at elysianintelligence.com (together, the "Services").

1.2 Scope. This policy covers Personal Data about: (a) account holders and their authorized users ("you"); (b) visitors to our website; and (c) individuals whose information appears in the Data we provide through the Services, as described in Section 7.

1.3 Relationship to the Terms. This policy forms part of the ElysianPrimus API Terms of Service (the "Terms"). Capitalized terms not defined here, including "Account", "API Key", "Call", "Customer Data", "Data", "Personal Data" and "Source", have the meanings given in the Terms.

1.4 Business service. The Services are offered only to businesses and to individuals acting for business or professional purposes. We collect Personal Data about you mainly in your capacity as a business contact.

2. Information We Collect

2.1 Information about account holders. We collect only the information we need to issue API Keys, meter usage and bill for the Services:

2.2 Payment card information. Stripe, Inc. ("Stripe") collects and stores your payment card details and billing address. We never receive or store full payment card numbers.

2.3 Network information. Cloudflare, Inc. ("Cloudflare") operates the APIs and the website and processes each request, including your IP address. The APIs use IP addresses to apply rate limits. To enforce a daily sign-up limit, we keep a keyed cryptographic hash of the network address used to sign up and delete it within two (2) days.

2.4 Bot protection. Our sign-up forms use Cloudflare Turnstile to distinguish people from automated traffic. Turnstile is operated by Cloudflare under its own privacy policy.

2.5 Information about individuals in the Data. The Data contains information from public Sources, some of which relates to individuals. Section 7 describes that information.

3. How We Use Information

3.1 Purposes. We use the information described in Section 2 to:

1. 1. create and administer your Account and API Keys;
2. 2. authenticate Calls, enforce rate limits and quotas, and count prepaid Calls;
3. 3. process payments, issue receipts and maintain financial and tax records;
4. 4. send service communications, such as key, billing, security and policy notices;
5. 5. respond to support requests;
6. 6. detect, prevent and investigate fraud, abuse, security incidents and breaches of the Terms;
7. 7. maintain and improve the Services using aggregated or de-identified usage information; and
8. 8. comply with legal obligations and enforce our rights.

3.2 No advertising or sale. We do not sell Personal Data about account holders or website visitors, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not send marketing email unless you ask us to.

3.3 No automated decisions. We do not use your Personal Data to make decisions that produce legal or similarly significant effects about you.

4. Cookies and Similar Technologies

4.1 No cookies of our own. Our website sets no cookies of its own, stores nothing in your browser, and loads no analytics or advertising trackers.

4.2 Third-party script. The only third-party script on our website is Cloudflare Turnstile, which runs on the sign-up forms to detect automated traffic. Cloudflare may process information about your browser and device to perform that check, under Cloudflare's privacy policy.

4.3 Browser signals. Because we do not track you across websites or sell Personal Data, we do not change our practices in response to "Do Not Track" or Global Privacy Control signals.

5. How We Share Information

5.1 Service providers. We share Personal Data only with service providers that process it on our behalf to run the Services:

5.2 Legal and safety. We may disclose Personal Data if we believe in good faith that disclosure is required by law, subpoena or other legal process, or is necessary to protect the rights, property or safety of Elysian, our customers or others, including to investigate fraud, abuse or breaches of the Terms.

5.3 Business transfers. If Elysian is involved in a merger, acquisition, financing, reorganization or sale of all or part of its business or assets, Personal Data may be transferred as part of that transaction, subject to this policy or a policy that is at least as protective.

5.4 With your consent. We may share Personal Data for other purposes with your consent or at your direction.

5.5 No sale. We do not sell Personal Data about account holders or website visitors, and do not share it with third parties for their own marketing or advertising. Information about individuals that appears in the Data is provided to customers as described in Section 7.

6. Retention and Security

6.1 Retention. We keep Personal Data only as long as needed for the purposes in Section 3, then delete or de-identify it:

We may keep information longer where required by law, to resolve disputes, or to enforce the Terms.

6.2 Security. We use administrative, technical and physical safeguards designed to protect Personal Data, including storing API Keys only as one-way hashes, encrypting data in transit, and limiting access to those who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6.3 Your responsibility. You are responsible for keeping your API Keys secret, as described in the Terms. Contact us promptly at support@elysianintelligence.com if you believe a key has been exposed.

6.4 Incidents. If we learn of a security breach affecting your Personal Data, we will notify you and any regulator as required by applicable law.

7. Individuals Whose Information Appears in the Data

7.1 Sources. The Data is compiled from public Sources. Some of it relates to individuals:

The CVE, LabelLink and HomeSignal APIs, and the wildfire activity data in the Fire API, are not designed to contain Personal Data, though Source records may occasionally name individuals.

7.2 Purpose. We provide this information to business customers for license verification, compliance monitoring, security analysis, risk assessment, government contract research and other research. The Terms prohibit customers from using it for consumer credit, insurance, employment, housing or other eligibility decisions under the Fair Credit Reporting Act, for marketing lists or solicitation, for unsolicited contact with government contracting personnel unrelated to a notice, or for spam or the sale of personal information.

7.3 Accuracy. We take the information from its Sources and do not independently verify it. The Source remains the authoritative record. To correct information at its origin, contact the issuing agency or the platform where it was published.

7.4 Requests. (a) If you believe information about you is inaccurate, incomplete, out of date, or should not be included in our Services, you may contact us as described in Section 8.

(b) We will review the request and, where appropriate or required by applicable law, investigate the accuracy, completeness, source, and legal basis for the information at issue. Based on the results of our review, we may update, correct, supplement, suppress, restrict, or remove information from our Services.

(c) Where required by law or where Elysian determines that a correction, deletion, or suppression is appropriate, we may notify customers who have received the affected information and may instruct them to correct, delete, suppress, or restrict use of that information in accordance with their obligations under Section 9.3(e) of the Terms.

(d) Notwithstanding the foregoing, Elysian may retain and continue to process information where permitted or required by law, including information obtained from public records, government records, court records, regulatory records, licensed third-party sources, fraud-prevention systems, security systems, audit records, legal compliance records, or other lawful sources. Submission of a request does not guarantee that information will be removed, corrected, or suppressed.

8. Your Rights and Choices

8.1 Account requests. Email support@elysianintelligence.com from the address on your Account to see, correct or delete the Personal Data we hold about you, or to revoke an API Key. You can also rotate or revoke API Keys in the customer portal.

8.2 State privacy rights. Where applicable law gives you these rights, including the Oregon Consumer Privacy Act and similar laws in other states, you may request to:

1. 1. confirm whether we process your Personal Data and access it;
2. 2. correct inaccurate Personal Data;
3. 3. delete Personal Data;
4. 4. receive a portable copy of Personal Data you provided to us;
5. 5. obtain a list of the specific third parties to which we have disclosed Personal Data; and
6. 6. opt out of the sale of Personal Data, targeted advertising, or profiling that produces legal or similarly significant effects.

8.3 Verification. We will verify your request before acting on it, usually by confirming it came from the email address on your Account. For requests about Data under Section 7, we may ask for information that lets us identify the relevant records. You may use an authorized agent, who must provide proof of authorization.

8.4 Response and appeals. We will respond within forty-five (45) days, or tell you if we need up to forty-five (45) more days and why. If we decline your request, we will explain why. You may appeal by replying to our decision with the subject line "Privacy appeal"; we will respond to the appeal within forty-five (45) days. If you are not satisfied with the outcome, you may contact your state attorney general, including the Oregon Department of Justice.

8.5 No discrimination. We will not deny you service or charge you different prices for exercising these rights.

8.6 Limits. We may keep information we are required to retain by law or need to complete a transaction, prevent fraud, or establish or defend legal claims. Deleting your email address closes your Account, and billing records are kept for the period in Section 6.1.

9. International Users

Elysian is based in the United States, and we and our service providers process Personal Data in the United States and other countries where they operate. If you use the Services from outside the United States, your Personal Data will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we will put appropriate safeguards in place, such as a data processing addendum under Section 9.3(g) of the Terms.

10. Children

The Services are not directed to children, and you must be at least 18 years old to create an Account. We do not knowingly collect Personal Data from anyone under 18. If we learn that we have, we will delete it.

11. Changes to This Policy

We may update this policy from time to time. We will post the updated version with a new effective date and, for material changes, notify you by email or in the customer portal at least thirty (30) days before they take effect, consistent with the Terms.

12. Contact Us

For questions or requests about this policy or your Personal Data, contact: