Privacy Policy

1. Introduction

Atoma Insights, Inc. ("Company," "we," "us") operates Elorix ("Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Service. By using Elorix, you consent to the practices described here.

2. Information We Collect

Information you provide

• Account data: email address, name, password (hashed)
• Channel data: YouTube/TikTok/Instagram channel IDs, handles, niche, subscriber counts
• Content: video metadata, scripts, thumbnails, and generated content you create through the Service
• Payment data: billing information processed by Stripe (we do not store card numbers)
• Communications: support requests, feedback, and form submissions

Information collected automatically

• Usage data: pages visited, features used, actions taken, timestamps
• Device data: browser type, operating system, IP address, screen resolution
• Performance data: video performance metrics from connected platforms (views, watch time, engagement)
• Cookies: session cookies for authentication and CSRF protection (see Section 7)

3. How We Use Your Information

• Provide the Service: generate content, analyze performance, deliver recommendations, process payments
• Improve the Service: train and improve our AI models, optimize user experience, fix bugs
• Communicate: send weekly intelligence reports, billing notifications, and service updates
• Security: detect fraud, prevent abuse, enforce our Terms of Service
• Legal compliance: respond to legal requests, enforce our rights

We do not sell your personal information to third parties. We do not use your content — your videos, scripts, titles, thumbnails, or any free text — to train AI models that serve other customers. Your channel data and generated content are used to provide and improve your own experience, with two exceptions that are on by default: anonymized, pattern-level performance signals contribute to cross-creator benchmarks, and well-performing videos you make with Elorix can be added to the shared corpus our script writer draws on when it writes for other creators (including excerpts of what is said in them). Both are described in Section 12, and you can turn both off per channel at any time.

4. Third-Party Services

We share data with the following service providers, solely to operate the Service:

Each provider is bound by their own privacy policy and data processing agreements. We select providers that meet industry-standard security practices.

5. Data Retention

• Active accounts: data is retained for the duration of your account
• Canceled accounts: we keep your account data for 90 days after your subscription ends so you can reactivate, then delete it automatically. You can delete your account at any time in Settings → Privacy, or email privacy@elorix.app and we act within 30 days. Deleting your account also removes your videos from the shared corpus (with their transcripts, frames and analyses); pausing a channel does not. Deleting your account also deletes your product-analytics person and events in PostHog.
• Presenter face and voice: if you revoke your presenter consent, new videos stop using your face and voice right away. We keep the uploaded face image and voice sample for 30 days so you can restore your consent without uploading them again, then we delete them automatically, together with the name you typed when you gave consent. We keep only a minimal record that consent was given and withdrawn (an internal consent ID, the channel, the consent wording version and the two dates), so we can show the consent behind videos already made; it holds no face, voice or name, and it is kept even after your account is deleted. Deleting your account also deletes the face and voice.
• Payment records: billing history (subscription, credit and invoice records) is retained for 7 years for tax and legal compliance, including after your account is deleted; your Stripe customer record is kept for invoices
• Usage logs: first-party usage events are deleted after 60 days; product-analytics data in PostHog is deleted when your account is deleted
• After deletion: we keep billing records (above); pseudonymous performance signals keyed to an internal ID (never your name or email) that feed aggregate benchmarks; and cached audio or image files stored without any link to your account, which we cannot attribute to you (for example a voice-over or sound-effect cache keyed by its text, or an unused take of a voice-over). A YouTube channel you connected stays in our public YouTube catalog, without your ownership or its private analytics.
• AI request logs: the prompts we send to our AI model providers while making your videos (your brief, channel details and the generated script) and the outputs they return may be kept in our private storage for up to 30 days to diagnose failures and improve quality, then deleted

You can delete your data at any time — see the Canceled accounts line above and Section 8 (Your Rights).

6. Data Security

We implement industry-standard security measures including:

• Encryption in transit (TLS 1.3) and at rest
• Row-level security on all database tables
• CSRF protection on all API endpoints
• Rate limiting to prevent abuse
• Regular security audits

No system is 100% secure. If we discover a data breach affecting your personal information, we will notify you within 72 hours as required by applicable law.

7. Cookies

We use the following cookies:

• Authentication cookies: session management via Supabase Auth (essential)
• CSRF token: double-submit cookie for API security (essential)
• Product analytics: PostHog stores a first-party identifier in a cookie and in local storage so it can tell sessions apart (see Section 11). It is not used for advertising, and you can opt out in Settings → Privacy.

We do not use advertising cookies or cross-site tracking cookies.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate data
• Deletion: request deletion of your personal data
• Portability: receive your data in a machine-readable format
• Objection: object to certain processing activities
• Restriction: request restriction of processing

To exercise any of these rights, contact us at privacy@elorix.app. We will respond within 30 days.

9. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

10. International Transfers

Your data may be processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these jurisdictions, which may have different data protection laws than your country of residence.

11. Product Analytics

We use PostHog (operated by PostHog Inc., United States) to understand how you use Elorix so we can fix bugs and improve workflows. This includes page navigation, button clicks, unhandled client errors, and anonymized session recordings. All text inputs are masked in those recordings, and your content, strategy, and brainstorm inputs are excluded from recording entirely. We do not sell this data or share it with third parties. You can opt out anytime from Settings → Privacy, or request full deletion via the “Delete my analytics data” button on the same page.

PostHog subprocessor list: posthog.com/handbook/company/security#subprocessors.

12. Cross-Creator Learning and the Shared Corpus

Elorix improves for everyone by learning from what works across creators. Both forms of cross-creator learning below are on by default, and both stop for a channel when you pause it.

Pooled benchmarks. When one of your channels publishes or generates a video, we derive a small set of anonymized, pattern-level signals from it — for example, hook archetype, dopamine prediction scores, and retention percentages, bucketed by niche, platform, and audience segment. These signals are pooled into shared benchmarks (such as the cross-product hook effectiveness benchmarks shown in Hook Ideas). A signal is only ever exposed once its bucket contains at least 10 events from at least 5 distinct accounts, so no individual creator can be singled out.

The shared corpus. This is on by default. While a channel is contributing, a video you made with Elorix and published on it can be added to the shared corpus: the library of reference videos our script writer draws on when it writes scripts for every creator, including other creators in your niche. A video is considered only if it is one of your top-scoring videos, has at least 1,000 views and, once 5 of your videos have been measured, is in the top quarter of your own videos by views. It is used as a reference only once it is at least 7 days old and its platform-reported views and retention are at or above typical for your channel and your niche.

What the corpus keeps and who sees it. For a video that is added, the corpus keeps a copy of the video file in our private storage, the words spoken in it (its transcript), still frames, and an AI-written breakdown of its hook, structure and pacing. Excerpts of that transcript and breakdown may be given to our script writer as worked examples when it writes for other creators, and a short label for the video (its niche, its structure, or a handle if one appears in the video itself) can be shown to other creators as a reference match. Other creators are never given the video file. The corpus entry does not record your account, email address or channel name, but anything said or shown in the video itself is part of what is analysed.

What is not shared. Outside the shared corpus described above, your scripts, titles, thumbnails, comments, channel and account names, and other free text are not pooled or shared with other customers. Your account details, email address and payment information are never shared with other customers.

Opting out. You can turn both off per channel at any time under Settings → Privacy, in the “Shared corpus and benchmarks” section. To turn it off, pause the channel. A paused channel’s videos are not added to the corpus, and videos already added stop being used as references, because the check runs every time the corpus is searched (the one exception is a video our team has manually reviewed into the curated set). Pausing does not delete what is already stored; deleting your account does (Settings → Privacy → Delete account, or email privacy@elorix.app). Opting out does not reduce any of your own features: your personal analytics, insights, and recommendations are built from your own data and are unaffected. (You keep receiving benchmarks derived from prior contributions.)

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice within the Service at least 30 days before the changes take effect.

14. Contact

For privacy-related inquiries, contact us at privacy@elorix.app.

Atoma Insights, Inc.
United States