Privacy Policy
Last updated: 13 August 2026
Your privacy matters to us, and ElliottOS holds some of the most personal information there is. This policy explains, in plain English, what personal data we collect, why, how we use and protect it, who we share it with, and the rights you have under UK data protection law.
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is responsible for your data
The controller of your personal data is Jonathan Elliott, a sole trader trading as Jonny Elliott Consulting and ElliottOS, of Ground Floor Rear Barn, The Brookdale Centre, Knutsford, Cheshire, WA16 0SR. Jonathan Elliott is the data controller responsible for your personal data under the UK GDPR.
For any question about this policy or your personal data, or to exercise your rights, contact us at support@elliottos.co.uk.
2. A note on the sensitive nature of ElliottOS
ElliottOS is designed to hold your whole-life information in one place. That includes special category data about your health and body, and detailed financial data. Your journal, mood entries and notes may also contain sensitive or special category information. We treat all of this with a high level of care, we only process it for the purposes set out here, and for health and other special category data we ask for your explicit consent first.
3. The personal data we collect
We collect the following categories of personal data, most of which you provide directly by using the app.
Account and identity data
Your name, email address, and date of birth (which we use to confirm you are 18 or over). Your preferences and settings, including consent choices.
Health and body data (special category)
Information you choose to record or connect, such as bloodwork and biomarkers, body metrics, sleep, vitality measures, supplements and medication. This is special category data under Article 9 of the UK GDPR and receives extra protection.
Financial data
Bank balances and transactions (from connections you make or statements you upload), net worth, budgets and related money information.
Relationships and contacts
Details of people you choose to record, such as names, key dates and notes about your relationships.
Journal, mood and notes
Your journal entries, mood logs and free-text notes. These are private to you and may themselves contain sensitive or special category information.
Tasks, plans and goals
The tasks, plans, goals and projects you create and track.
Usage, device and log data
Technical information generated when you use the app, such as log data, device and browser information, and records of actions taken in your account. We use this to keep the service secure and working.
Payment data
Subscription and payment records. Card payments are handled by Stripe. We do not store your full card details; we receive limited confirmation and billing information from Stripe.
Data from connected services
If you choose to connect an external service (for example your bank, your health data or your calendar), we receive data from that service as needed to provide the feature. You control these connections and can disconnect them at any time.
4. Why we use your data, and our lawful bases
Under UK GDPR we must have a lawful basis for using your personal data. The table below maps what we do to why, and to the lawful basis we rely on.
| What we do | Lawful basis |
|---|---|
| Provide the service. Run your account, store and display your information, let Alfred help you, and deliver the features you use. | Performance of a contract with you. |
| Process your health and other special category data. Store and work with your bloodwork, body metrics and other health information, and any sensitive content in your journal, mood and notes. | Your explicit consent (Article 9(2)(a) UK GDPR), which you give in the app and can withdraw at any time. |
| Optional connectors and features. Connect your bank, enable spoken replies, or connect your own AI account. | Your consent, given per feature in the app. |
| Take payment. Charge your subscription and keep billing records. | Performance of a contract, and legal obligation for accounting records. |
| Keep the service secure and improve it. Protect against fraud and abuse, diagnose problems, and make the service better. | Our legitimate interests in running a secure, reliable service, balanced against your rights. |
| Send you marketing. Only where you have opted in. | Your consent. |
| Meet legal duties. Keep tax and accounting records and respond to lawful requests. | Legal obligation. |
5. Explicit consent for health and special category data, and how to withdraw it
Before we store or process any health or special category data, we ask for your explicit consent in the app. We explain what the data is and what we will do with it. Giving this consent is your choice, and you do not have to use the health features to use ElliottOS.
You can withdraw your consent at any time in Settings. Withdrawing consent stops future processing of that data and, where you choose, lets you delete the data already held. Withdrawing consent does not affect processing we lawfully carried out before you withdrew it.
6. How Alfred (AI) uses your data, and our no-training promise
Alfred, our AI life assistant, processes the information you share with it so that it can answer you, plan with you, summarise your data and take the actions you ask for. To do this, relevant parts of your information are sent to our AI providers to generate a response, and voice features send audio to our voice providers.
ElliottOS does not use your data to train AI models. Our AI providers process your data only to deliver the feature to you, under their commercial terms, and they do not use your data to train their models.
7. Who we share your data with
We do not sell your personal data. We share it only with the service providers (sub-processors) we use to run ElliottOS, and only as far as needed for the purposes below. These providers act on our instructions under contracts that require them to protect your data.
| Provider | What they do for us |
|---|---|
| Anthropic | Powers Alfred, the AI assistant (the Claude API). |
| ElevenLabs | Converts text to speech for Alfred's spoken replies. |
| Deepgram | Converts your speech to text when you talk to Alfred. |
| LiveKit | Real-time transport for voice conversations. |
| Supabase | Database, authentication, file storage and server functions hosting. |
| Netlify | Hosting for the website and app. |
| Stripe | Subscription payments. ElliottOS does not store your card details. |
| Google Health data import and Google sign-in (where you use them). | |
| YNAB | Budget data, if you connect it. |
| Starling and other open-banking providers | Bank account data for the accounts you choose to connect. |
| Akiflow | Calendar and tasks, if you connect it. |
| ClickUp | Projects, if you connect it. |
| Readwise | Reading highlights, if you connect it. |
| Elastic Email | Sends transactional emails, such as account and security messages. |
We may also disclose personal data if the law requires it, to protect our rights, users or the public, or as part of a business reorganisation, in which case your data would remain protected by this policy or an equivalent one.
8. International transfers
Some of our providers are based outside the UK and the European Economic Area, for example in the United States. When your personal data is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law. Depending on the provider, this means the transfer is covered by UK "adequacy" regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with additional protections where needed. You can ask us for more detail about the safeguards that apply.
9. How long we keep your data
We keep your personal data while your account is active, and for a short period after you delete your account, to allow for recovery and orderly closure, after which it is permanently erased. Some records must be kept longer where the law requires it, for example payment and accounting records, which are typically kept for six years. When we no longer need personal data, we delete it or anonymise it.
10. How we protect your data
We take security seriously and use a range of technical and organisational measures, including:
- encryption of data in transit and at rest;
- connector tokens encrypted with per-user keys using envelope encryption;
- a private vault with end-to-end encryption, so that only you can read those entries;
- device unlock with passkeys or Face ID;
- access logging and controls limiting who and what can reach your data; and
- contracts with our providers that require them to keep your data secure.
No system can be guaranteed to be completely secure, but we work continually to protect your information and to detect and respond to risks.
11. Your rights
Under UK data protection law you have the following rights over your personal data:
- Access a copy of the personal data we hold about you.
- Rectification of data that is inaccurate or incomplete.
- Erasure of your data (the "right to be forgotten"), in certain circumstances.
- Restriction of how we process your data, in certain circumstances.
- Data portability, to receive your data in a portable format or have it transferred.
- Objection to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, where we rely on your consent, including for health data.
ElliottOS makes it easy to exercise several of these rights directly: you can carry out a full data export and delete your account from within the app. When you delete your account there is a 30-day recovery window, after which your data is permanently deleted (except records we must keep for legal reasons). You can also contact us at support@elliottos.co.uk and we will respond within the time the law allows, normally one month. Exercising your rights is free in most cases.
12. Cookies and local storage
The ElliottOS app sits behind a login and uses your browser's local storage for things like keeping you signed in, remembering your chosen theme, recording that you have seen the walkthrough, and saving interface preferences. These are strictly necessary and preference items, not tracking or advertising. Our full Cookie Policy explains this in detail and how to clear these items.
13. The service is not for under-18s
ElliottOS is designed for adults and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe someone under 18 has provided us with personal data, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time, for example if we change our providers or features, or to reflect changes in the law. If we make a significant change, we will tell you, normally by email or a notice in the app. The "Last updated" date at the top shows when the policy was last changed.
15. How to complain
If you have a concern about how we handle your personal data, please contact us first at support@elliottos.co.uk so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk.