Privacy Policy

MomentumEQ Labs, Inc. ("MomentumEQ," "we," "us," or "our") operates the Elevation platform at getelevation.io (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and organization affiliation. If you sign in via a third-party OAuth provider (Google, Microsoft, or WebEx), we receive your name, email, and profile photo from that provider.

Assessment Data

When you use the platform, we store the data you provide including building profiles, assessment responses, domain scores, target scores, uploaded documents, and calculator inputs. This data is associated with your account and organization.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, browser type, IP address, and timestamps. We use this data to improve the Service and diagnose issues.

Cookies

We use essential cookies to maintain your authentication session. We do not use advertising or tracking cookies.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Process your assessments and generate maturity scores, gap analyses, and recommendations
• Generate exports (PDF, PPTX, CSV, JSON) that you request
• Send administrative communications (account approval, password reset)
• Improve and develop new features
• Enforce our Terms of Service and protect against misuse

3. AI and Large Language Models

Elevation uses third-party large language model (LLM) providers via OpenRouter to generate assessment questions, strategic recommendations, and document analysis. When these features are invoked, relevant assessment data (such as domain scores, building profiles, and uploaded document content) is sent to the LLM provider to generate responses.

We do not use your data to train AI models. The LLM providers we use are contractually prohibited from using your data for model training purposes.

4. How We Share Your Information

We do not sell your personal information. We may share information in these circumstances:

• Within your organization: Other members of your organization may see assessments, buildings, and portfolios belonging to the organization. You may also explicitly share assessments with specific users.
• Service providers: We use third-party services to operate the platform, including Supabase (database and authentication), Vercel (hosting), OpenRouter (LLM), Resend (email), and Cloudflare (DNS and security). These providers process data on our behalf under contractual obligations.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS/SSL) and at rest
• Row-level security (RLS) in our database ensuring users can only access authorized data
• Role-based access control (RBAC) with per-request authorization checks
• OAuth 2.0 with PKCE for third-party authentication
• HTTP-only session cookies

No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Data Retention

We retain your account information and assessment data for as long as your account is active or as needed to provide the Service. If you request account deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance purposes.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Export your assessment data (via our built-in export features)
• Object to or restrict certain processing

To exercise these rights, contact us at privacy@getelevation.io.

8. International Data Transfers

Our Service is hosted in the United States. If you access the Service from outside the United States, your data may be transferred to and processed in the United States. By using the Service, you consent to this transfer.

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at:

MomentumEQ Labs, Inc.
privacy@getelevation.io