Privacy policy — ELK MemoGard
DRAFT — to be reviewed by a lawyer before publication. Items in square brackets [ ] must be completed.
Last updated: [publication date]
1. Who we are
ELK MemoGard ("MemoGard") is published by ELK Consulting LTD, a company registered in Mauritius, [BRN registration number], [registered address]. ELK Consulting LTD is the controller of your personal data.
Contact for any question about your data: [dedicated e-mail, e.g. privacy@elkconsultingltd.com].
2. Data we process
- Account: e-mail address, sign-in identifier, language, time zone, country if you provide it.
- Your obligations and reminders: titles, dates, amounts, currencies, payees, references, priorities, statuses, action history.
- Documents you choose to attach (invoices, receipts, proofs).
- Devices: device type, app version, notification token, permission status (notifications, alarms), last sync date.
- Organisations: members, roles, approvals and audit log if you use a family or business space.
- In-app purchases: product identifier, transaction identifier and status sent by Google Play or the App Store. We never receive your payment card details.
- Advertising (free tier only): the device advertising identifier and technical data processed by our ad provider, according to your consent.
We only request the permissions needed for the features you use.
3. Why we process it
| Purpose | Legal basis |
|---|---|
| Provide the service: deadline computation, reminders, sync | Performance of contract |
| Safety net: notification and e-mail when a critical alarm is not confirmed; alerting a backup person you chose | Performance of contract |
| Verify purchases and grant entitlements | Performance of contract; legal and accounting obligations |
| Security, fraud prevention, audit log | Legitimate interest |
| Show ads in the free tier | Consent where required by law, otherwise legitimate interest |
| Answer support requests | Performance of contract; legitimate interest |
No advertising is targeted using the content of your reminders, amounts, documents or tax information. This data is never sent to an ad provider.
4. Artificial intelligence features
AI modules (document reading, assistant) are optional and off by default. When offered, a document will only be sent to an AI provider after your explicit action, with the safeguards described when you turn the feature on. You can turn these features off at any time.
5. Who we share data with
Only with service providers needed to run the service, bound by contract:
- hosting and database: [provider, hosting region];
- document storage: [provider];
- reminder and alert e-mails: [provider];
- authentication (sign-in with e-mail, Google or Apple): Google (Firebase Authentication) — e-mail address, sign-in identifier, sign-in IP address;
- notifications: Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service);
- purchases: Google Play and Apple App Store;
- advertising (free tier): [provider, e.g. Google AdMob].
Members of an organisation you join see that organisation's obligations according to their role. ELK Consulting LTD administrators do not freely access your documents: any exceptional support access requires your authorisation, is time-limited and logged.
We do not sell your data.
6. Transfers outside Mauritius
Some providers may process data outside Mauritius or the European Union. These transfers rely on appropriate safeguards: [standard contractual clauses, adequacy decisions — to be specified per provider].
7. Retention
- Account and obligations: while you use the service, then deleted within [30] days after account closure, unless the law requires otherwise.
- Documents: until you delete them or close your account.
- Organisation audit log: [period], to keep proof of actions.
- Purchase records: as required by applicable accounting rules ([period]). After account deletion they are attached to an anonymous identifier (no e-mail, no name) and cannot be moved to a new account.
- Account deletion from the app or the website: your personal space (obligations, history, documents) is erased immediately; shared organisations keep their own data.
8. Security
Encrypted transport (TLS) and encrypted storage, strict isolation between organisations, role-based access control, logging, encrypted backups. Documents are never reachable through a permanent public address.
9. Your rights
Under the Mauritius Data Protection Act 2017 and, where it applies, the EU General Data Protection Regulation (GDPR), you have the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent. You can export or delete your account from the app or write to [address].
You may lodge a complaint with the Data Protection Office of Mauritius or the data protection authority of your country of residence.
10. Children
MemoGard is intended for adults and organisations. It is not directed at people under [16].
11. Changes
We will inform you in the app of any significant change to this policy.