Privacy Policy
Last updated November 3, 2026
This policy explains how Elucidate (“we”, “us”) collects, uses, shares and protects personal information when you visit www.elucidate.ai, contact us, subscribe to our updates, or work with us. We work with clients in South Africa, the United States and elsewhere, and we handle personal information in line with the privacy laws that apply where our clients and visitors are, including South Africa’s Protection of Personal Information Act (POPIA), US state privacy laws, and the EU and UK General Data Protection Regulation (GDPR) where they apply.
Who we are
The site is run by Elucidate Artificial Intelligence (Pty) Ltd and its affiliates, a data and AI consultancy with teams in South Africa and the United States. We are responsible for the personal information described in this policy (the “responsible party” under POPIA and the “controller” under the GDPR).
- Email: hello@elucidate.ai
- Privacy questions and requests: informationofficer@elucidate.ai
- Registered office: 6 Benmore Road, Sandton, Johannesburg, 2196, South Africa
What we collect
Information you give us
- When you contact us: your name, email address and message, and anything else you choose to include.
- When you subscribe to updates: your email address.
- When you apply for a job: your CV and the details in your application, sent by email.
- When you or your company work with us: business contact details (name, job title, company, email, phone) and the information needed to deliver and invoice the work.
Information collected automatically when you visit the site
- Usage information: the pages you visit, how long you stay, the site that referred you, and your browser, device and approximate location (derived from your IP address).
- Session recordings: a record of how you move through the site (scrolling, clicks and mouse movement), which we replay to see where the site is confusing. Anything you type into a form is masked and never recorded.
- Business visitor identification: the company you are likely visiting from, and in some cases your professional profile, matched from your IP address and similar signals (see “Tools we use”).
- Cookies and similar technologies: small files and identifiers that let these tools recognise repeat visits.
We do not knowingly collect sensitive personal information (such as health or biometric information) through the site. The site is meant for business users and is not aimed at children under 16.
How we use it
We use personal information to:
- reply to your enquiry and talk to you about our services;
- send you updates you have asked for, such as our newsletter or the Elucidate Digest (each email has an unsubscribe link);
- consider job applications;
- deliver work to clients, manage the relationship and invoice for it;
- understand how the site is used and improve it;
- understand which companies are interested in our services, so we can follow up where appropriate;
- keep the site and our forms secure and prevent spam and abuse; and
- meet our legal, tax and accounting obligations.
Where the law requires a legal basis for processing (as POPIA and the GDPR do), we rely on your consent, on the need to take steps towards or perform a contract with you, on a legal obligation, or on our legitimate interests in running and improving our business and website, where those interests are not overridden by yours.
Marketing. We only send marketing emails to people who have agreed to receive them, or to existing clients about similar services where the law allows. You can opt out at any time by using the unsubscribe link or emailing us.
Tools we use
We use these service providers. They process personal information on our behalf and under their own security measures:
| Provider | What it does | Where data is processed |
|---|---|---|
| Vercel | Hosts the website and runs its forms | United States and other regions |
| Resend | Delivers the messages sent through our contact and subscribe forms to our inbox | European Union (Ireland) and United States |
| Google Analytics | Measures how the site is used | United States and other regions |
| PostHog | Measures how the site is used and records sessions (with form entries masked) | United States |
| RB2B | Identifies the companies (and, for some visitors, the professional profiles) visiting the site | United States |
| Google reCAPTCHA (when enabled) | Protects our forms from spam | United States and other regions |
| YouTube | Plays our videos. Nothing loads from YouTube until you press play; after that, YouTube’s own privacy policy applies | United States and other regions |
| Microsoft 365 | Our email | United States and other regions |
We also link to our pages on LinkedIn, X, Instagram, Facebook, YouTube, TikTok and Spotify. When you visit those sites, their own privacy policies apply.
Sharing your information
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only:
- with the service providers above, so they can provide their services to us;
- between Elucidate’s own companies, to deliver our services;
- with professional advisers (such as auditors and lawyers) under a duty of confidentiality;
- where the law requires it, or to protect our rights, property or safety; and
- with a buyer or successor if our business, or part of it, is sold or restructured.
International transfers
We operate in more than one country, and our service providers store information mainly in the United States and Europe. When personal information moves between countries, we use providers bound by data protection laws, binding agreements (such as standard contractual clauses) or corporate rules that protect it to the standard the law of the country it comes from requires, including section 72 of POPIA and Chapter V of the GDPR.
Cookies
The site uses cookies and similar technologies for analytics and business visitor identification. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google’s browser add-on (tools.google.com/dlpage/gaoptout). Blocking cookies does not stop the site from working. We honour Global Privacy Control signals where the law requires it.
How long we keep it
We keep personal information only for as long as we need it for the purposes above, or as long as the law requires:
- enquiries that don’t lead to work: up to two years after our last contact;
- client and invoicing records: as long as tax and company law require (generally five to seven years after the work ends);
- job applications: up to one year, unless you ask us to delete yours sooner;
- newsletter subscriptions: until you unsubscribe; and
- analytics data: according to each tool’s retention settings.
After that we delete it, or anonymise it so it no longer identifies you.
How we protect it
We use reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access, including encrypted connections (HTTPS), access controls and reputable service providers. No system is completely secure; if a breach affects your personal information, we will notify you and the relevant authorities where the law requires.
Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you, and get a copy of it;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete your information;
- object to, or ask us to restrict, how we use it, including for marketing;
- withdraw your consent where we rely on it;
- receive your information in a portable format; and
- complain to a data protection authority.
To use any of these rights, email informationofficer@elucidate.ai. We may need to confirm your identity first, and we will respond within the time the law allows (generally 30 to 45 days). We will not treat you differently for using your rights. You can also ask someone to make a request on your behalf, with your written permission.
South Africa. Our Information Officer handles requests under POPIA, and requests for access to records under our PAIA manual, which you can request from the same address. You can complain to the Information Regulator (www.inforegulator.org.za).
United States. If you live in a state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Texas), the rights above apply as that law provides, including the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those laws define it. If we decline a request, you can appeal by replying to our decision.
EU and UK. You can complain to the data protection authority where you live or work.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. Significant changes will be shown on this page.
Contact us
Questions about this policy or your personal information: informationofficer@elucidate.ai.