Elvaris is a sole trader based in Portugal providing real estate lead automation services to clients primarily based in the United States. As a data controller established in the European Union, Elvaris operates under the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679.
This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over it.
We collect personal data in the following contexts:
Website visitors (getelvaris.com)
We collect anonymised analytics data via Google Analytics 4, including approximate location, browser type, device type, pages visited, and time on site. This data is not linked to your identity.
Contact form submissions
When you submit a contact or enquiry form on our website (powered by Tally), we collect: your name, email address, company name, job title, CRM in use, and the content of your message.
Purchase and intake form submissions
When you purchase a package or submit an intake form, we collect: your name, email address, company name, payment information (processed by Stripe — Elvaris does not store card details), and the technical information you provide in the intake form including CRM name, lead source details, team structure, and API or webhook information needed to complete your project.
Cold outreach recipients
If you have received a cold email from Elvaris, your name and business email address were sourced from a third-party B2B data provider (Apollo.io) or from publicly available professional sources. See Section 9 for your rights regarding marketing communications.
Workflow delivery (clients only)
During the project delivery phase, we may temporarily process test lead data you provide to verify that the workflow functions correctly. This data is deleted after delivery is confirmed.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Responding to contact form enquiries | Name, email, message | Legitimate interest (pre-contractual communication) |
| Delivering purchased services | Name, email, intake form data, API credentials | Contract performance (Art. 6(1)(b)) |
| Processing payment | Name, email, payment data (via Stripe) | Contract performance (Art. 6(1)(b)) |
| Sending service-related communications | Name, email | Contract performance (Art. 6(1)(b)) |
| Cold outreach to business prospects | Name, business email, company | Legitimate interest (Art. 6(1)(f)) — B2B marketing to relevant professionals |
| Website analytics and improvement | Anonymised behavioural data | Legitimate interest (Art. 6(1)(f)) |
| Legal and financial record-keeping | Transaction records, correspondence | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data. We do not use your data for advertising on third-party platforms. We do not make automated decisions about you that produce legal or similarly significant effects.
We use the following third-party services to operate our business. Each acts as a data processor on our behalf, processing your data only to the extent necessary to provide their service.
| Service | Purpose | Data location | Privacy policy |
|---|---|---|---|
| Stripe | Payment processing | USA (EU SCCs apply) | stripe.com/privacy |
| Tally | Contact and intake forms | EU | tally.so/privacy |
| Zoho Mail | Business email (EU data centre) | EU | zoho.com/privacy |
| Google Analytics 4 | Website analytics (anonymised) | USA (EU SCCs apply) | policies.google.com/privacy |
| Anthropic (Claude API) | AI lead scoring within client workflows | USA | anthropic.com/privacy |
| Apollo.io | B2B contact data for outreach prospecting | USA | apollo.io/privacy-policy |
| Carrd | Website hosting | USA | carrd.co/privacy |
| Cloudflare | DNS and domain management | USA (adequacy) | cloudflare.com/privacypolicy |
We do not share your personal data with any other third parties except where required by law.
| Data type | Retention period |
|---|---|
| Contact form submissions (no purchase) | 12 months from last contact, then deleted |
| Client project data (intake form, credentials, correspondence) | 3 years from project completion for legal and contractual records |
| Payment records (Stripe) | 7 years (Portuguese legal requirement for financial records) |
| Test lead data used during workflow build | Deleted within 7 days of confirmed delivery |
| Cold outreach contact records | Deleted on unsubscribe request or after 24 months of no engagement, whichever is sooner |
| Website analytics | 26 months (Google Analytics 4 default, anonymised) |
Elvaris is based in Portugal (EU). Some of our third-party service providers are based in the United States. Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place:
Standard Contractual Clauses (SCCs) — used with Stripe and Google Analytics 4, providing GDPR-equivalent contractual protections for data transferred to the US.
EU-based services — Zoho Mail and Tally process data within the EU, meaning no international transfer occurs.
If you have questions about the safeguards applicable to a specific transfer, contact us at miguel@getelvaris.com.
Our website uses Google Analytics 4 to understand how visitors use the site. GA4 collects anonymised data including approximate location, device type, browser, pages viewed, and session duration. This data is not linked to any identifiable individual.
GA4 uses cookies stored in your browser. You can opt out of Google Analytics tracking by:
— Installing the Google Analytics Opt-out Browser Add-on
— Adjusting your browser's cookie settings to block analytics cookies
— Using a browser extension that blocks tracking scripts (e.g. uBlock Origin)
We do not use advertising cookies, retargeting cookies, or any cookies that track you across other websites. We do not use cookie consent banners because we do not use cookies that require consent under GDPR — analytics data is anonymised and collected under legitimate interest.
If you are based in the European Union or European Economic Area, you have the following rights under GDPR. If you are based in the United States, similar rights may apply under applicable state privacy laws (including CCPA for California residents).
To exercise any of these rights, email miguel@getelvaris.com with the subject line "Data Rights Request." We will respond within 30 days. We will not charge a fee for handling reasonable requests.
If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Portuguese data protection authority: CNPD — Comissão Nacional de Proteção de Dados.
Elvaris conducts outreach to real estate professionals whose contact information was sourced from Apollo.io, a B2B contact data provider, or from publicly available professional sources such as company websites and LinkedIn. This outreach is conducted under the legitimate interest basis (GDPR Art. 6(1)(f)) as B2B marketing to professionals in a directly relevant industry.
CAN-SPAM compliance (US recipients): All marketing emails sent by Elvaris include a clear identification of the sender, a physical mailing address, and a plain-text mechanism to opt out of future communications. Opt-out requests are honoured within 10 business days.
To opt out of future emails from Elvaris, reply to any email with the word "unsubscribe" in the subject line or body, or email miguel@getelvaris.com with the subject "Unsubscribe." Your address will be permanently suppressed and not contacted again.
Elvaris does not send unsolicited emails to personal email addresses or to individuals who are not real estate professionals.
Elvaris services are intended for business professionals only. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has submitted data to us, contact us at miguel@getelvaris.com and we will delete it promptly.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify active clients by email. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.