Elkwai Data

Data Privacy Notice

Effective and last updated: August 30, 2026 · Policy version 2026-08-30

This notice supplements the Elkwai Solutions Privacy Policy for Elkwai Data products, buyer accounts, APIs, private downloads, Snowflake listings, watchlists, and related support. Elkwai Solutions, LLC is responsible for the account and service information described here.

Information associated with a customer

• business name, authorized user name, work email, role, and contact details;
• Snowflake organization, account, request, listing, and entitlement identifiers when Snowflake is used;
• product access, subscription, billing status, release availability, and support history;
• authentication state, session and security records, credential issue and revocation metadata, and account recovery information;
• watchlist names, filter criteria, approved vendors, products, jurisdictions, topics, facilities, routes, or geographies submitted by the customer;
• API route, time, response status, product scope, download event, and other audit information needed to secure and operate the service.

Machine API keys are designed to be delivered once and stored only as one-way hashes. Raw passwords, tokens, and query strings are excluded from ordinary audit records where the service supports that control.

Data-product content

Current Elkwai Data products derive factual and analytical records primarily from identified public governmental, regulatory, scientific, and security sources. The current product line covers vulnerability action, federal regulatory change, and weather operations. It is not designed to contain consumer profiles or sensitive personal information.

Some official source material may identify public officials, authors, professional contacts, or other people acting in a public or professional capacity. When retained, those fields are limited to the product's stated purpose, source context, methodology, and permitted use. Customer-provided private watchlists are not added to public products or supplied to other customers.

Elkwai licenses these operational data products. We do not sell customer account information, private watchlists, API activity, support records, or confidential customer data. If a future product would include personal data whose licensing constitutes a sale under applicable law, that product will receive a separate review, notice, and any required opt-out process before release.

Lawful bases and how information is used

• verify buyer identity and authority;
• provision, limit, renew, suspend, and revoke product access;
• deliver entitled releases, APIs, secure views, evidence, and support;
• apply customer-requested watchlists and filters;
• process billing and maintain commercial records;
• monitor reliability, enforce rate limits, investigate misuse, and maintain an audit trail;
• comply with marketplace, contractual, legal, tax, and security obligations.

Elkwai ordinarily relies on contract or requested pre-contract steps for account creation, checkout, delivery, billing controls, requested monitoring, and support; legal obligation for required tax, accounting, privacy-rights, and incident records; and legitimate interests for service security, fraud prevention, reliability, source-rights enforcement, and establishing or defending claims. Optional marketing uses consent where applicable, and consent may be withdrawn at any time. Contract acceptance is not treated as blanket consent for unrelated processing.

Public-site privacy choices

Public pages ask whether you want optional measurement. Necessary browser storage keeps a privacy choice available; optional first-party analytics sends only a page identifier, a rotating browser session token, and the selected preference state to a protected aggregate counter. Elkwai does not receive or return the value of a browser cookie, browsing history, page contents, advertising identifier, or raw IP address through this measurement path. Analytics is off until you choose it, and the Privacy choices control remains available so you can withdraw or change that choice.

DineroHub receives a private summary of Cloudflare traffic, consented first-party measurement, and account signups. These are separate measurements: Cloudflare reports edge traffic, first-party measurement reports only opted-in events, and signups come from the account ledger. No individual visitor or cookie record is made available in DineroHub.

Snowflake Marketplace and data sharing

When you interact with Elkwai through Snowflake, Snowflake processes account, marketplace, listing, usage, payment, and service information under its own agreements and privacy notice. Elkwai receives only the information made available to a provider or needed to respond to a request, administer a listing, deliver a share, support a customer, or meet marketplace obligations.

Elkwai uses personal information supplied through Snowflake for service and product communications. We do not use Snowflake-provided personal information for unrelated marketing without the required permission.

Service providers and disclosure

Information may be processed by Snowflake for marketplace and data-sharing services, Cloudflare for website and edge security, Stripe for billing where applicable, Microsoft or another approved provider for email and support, and professional vendors needed to operate or secure the service. Providers receive only the information needed for their function and are subject to contractual confidentiality and reasonable-security requirements where applicable. We may also disclose information when required by law or necessary to protect customers, Elkwai, or the public.

International transfers

Elkwai is established in the United States. Providers may process information in the United States and other documented locations. Where EEA, UK, or Swiss transfer rules apply, Elkwai records and relies on an applicable data-processing agreement, adequacy mechanism, standard contractual clauses, data privacy framework, or other lawful safeguard. EEA commercial targeting remains release-gated until the requirement for an EU representative under GDPR Article 27 is formally resolved.

Security and access separation

Public catalog descriptions are separated from customer records and gated product data. Private delivery uses account, entitlement, role, token, or product scope. Controls may include encrypted transport, secure session cookies, CSRF protection, password or token hashing, rate limits, audit logging, release checksums, expiration, and revocation. Crawler directives are only an additional signal; authorization is the access boundary.

We investigate suspected security incidents and provide legally required notices to affected people, customers, and authorities. When information reaches the end of its retention period, it is deleted, de-identified, or rendered unreadable and unusable using methods appropriate to the medium, subject to limited backup and legal-hold cycles.

Retention

• single-use login tokens: seven days after use or expiry;
• browser sessions: until expiry or revocation, with a configured maximum of 30 days;
• rate-limit state: one day after its enforcement window;
• privacy-request and download IP hashes: cleared after 90 days;
• processed raw Stripe webhook payloads: minimized after 30 days while retaining event identity, outcome, timestamps, and provisioning evidence;
• failed or expired checkout email without an account: replaced after 30 days with a non-personal tombstone;
• purchase, invoice, tax, entitlement, and policy-acceptance evidence: seven years after the customer relationship ends unless law requires longer;
• completed privacy-request case metadata: three years after completion, with free-text details minimized earlier where no legal hold applies; and
• non-personal product provenance: while the product or claim is supported plus the applicable source-rights and dispute period.

Customer responsibilities

Customers must submit only information they are authorized to use and should avoid placing sensitive personal information in watchlist names, support messages, or free-text fields. A customer that uploads or configures personal information for its own business purpose may be the controller of that information, with Elkwai acting as a service provider or processor under the applicable agreement.

Restricted uses

Elkwai Data products are not consumer reports and may not be used to determine an individual's eligibility for credit, employment, housing, insurance, government benefits, or another purpose governed by the Fair Credit Reporting Act. They may not be used for biometric identification, targeted advertising, unlawful surveillance, discrimination, harassment, or decisions based on protected characteristics. A customer requiring regulated personal-data processing must obtain written approval and a separate agreement before providing that data.

AI and model use

Elkwai may use automated methods to collect, normalize, match, deduplicate, score, summarize, and quality-check source records. Release controls, provenance, evidence, and review procedures remain part of the product process. Customer account information, private watchlists, credentials, and confidential customer material are not used to train a publicly available foundation model unless expressly agreed in writing.

Rights and requests

Depending on your location, you may request access, correction, deletion, restriction, portability, objection, or an appeal concerning personal information associated with your account, and may withdraw consent without affecting earlier lawful processing. Some transaction, security, and audit information may be retained where legally permitted or required. Submit a request in the signed-in customer workspace or email privacy@elkwai.com. We may verify identity, account authority, and request scope before acting.

We respond without undue delay and normally within one calendar month. A complex or numerous request may be extended by up to two additional months where allowed; the reason and extension are recorded and communicated within the original period. If a request is declined or only partly completed, we provide the reason and available complaint or court remedies. You may complain to the data-protection authority where you live, work, or believe an infringement occurred.

Changes to this notice

We may revise this notice when Elkwai Data adds a product, source category, delivery method, account feature, integration, or provider. We will update the effective date and version before materially different processing begins. A new use of customer information that is materially different from the notice in effect when it was collected will receive additional notice, consent, or another legally required choice rather than being treated as authorized solely by a posted revision.

Contact

Elkwai Solutions, LLC
Privacy: privacy@elkwai.com
Support: support@elkwai.com
Business mailing address: 360 W Schick Rd, Ste 23 #2112, Bloomingdale, IL 60108, United States
General policy: Elkwai Solutions Privacy Policy