This policy explains what data Elbuz collects, why, who receives it and how long we keep it. It is written to be verifiable: every statement below has been checked against how the system actually works.
Effective 29 August 2026. It replaces the previous version in full.
The short version
If you have no time for the whole text, the essentials fit in a few lines. This is about data we are responsible for; data inside your own account has a separate section below.
| We collect | your first and last name, e-mail, phone, your answers about your store, support correspondence, sign-in logs |
| We do not collect | card details, identity documents, health data, precise location, biometrics |
| We never sell | your data — to anyone, ever — and we do not pass it to advertising networks |
| Cookies | three strictly necessary ones. No advertising or analytics cookies. Pages with forms run Google's anti-spam check |
| Where we store it | servers and storage in Germany and Finland |
| Orders on this site | none — the site describes the system, it does not sell goods |
Who is responsible for your data
The operator is Olena Shelekhan, private entrepreneur, state registration certificate No. 10000002596192. Trading as Elbuz.
Postal address: 27B/701 Nauky Avenue, Kharkiv, Ukraine, 61072.
E-mail for any question about data: support@elbuz.com.
How we handle such requests is described under “Your rights”.
Two different roles, and the difference matters
Elbuz handles data in two distinct capacities, and this determines whom you should approach.
Data of visitors and customers of elbuz.com
Here we decide why and how the data is processed: sign-up, correspondence, support. This data is our responsibility, and every right described below is exercised through us.
Data inside your account in the system
When you work in Elbuz you create products, contacts, orders and documents of your own business. Some of them contain personal data of your customers and partners.
That data is yours, not ours. We process it solely on your instruction and only to the extent the system needs to work: we store it, show it to you, and send it wherever you have configured an exchange. We do not use it for our own purposes, do not analyse it for our products, and do not pass it to third parties beyond your own settings.
The practical consequence: if your customer asks you to delete their data, it is you who answers them. We are obliged to help you do that, and we will, on your request.
What we collect and why
Signing up for the system
The sign-up form asks for your name and e-mail. When the account is created we also store your last name and phone if you provided them, plus a few answers about your store: roughly how large your catalogue is, what you work with today, what interests you. Those answers let us set the system up for you instead of offering everything at once.
The password is stored as an irreversible fingerprint — we cannot see it and cannot tell you yours.
Legal basis — performance of our contract with you: without this data an account cannot be created.
Using the system
While you use Elbuz we keep sign-in logs and the IP addresses used, a log of operations performed in the program, and service records about background jobs. The country of sign-in is derived from the IP address so that access from an unusual place can be noticed.
Legal basis — our legitimate interest: without logs it is impossible to investigate a failure, establish who changed what, or detect someone else accessing your account.
Contacting support
Correspondence, including chat on the website, is stored together with your request for as long as your account exists.
Legal basis — performance of the contract: support cannot be provided without the correspondence it consists of.
Conversations with the AI assistant
If you use the built-in assistant, your questions and its answers are stored. There are two distinct purposes here, with two distinct bases:
- showing you the conversation history — basis: performance of the contract;
- reviewing cases where the assistant answered poorly — basis: our legitimate interest. You may object to this processing by writing to us.
The text of those conversations is processed by external language services — the assistant does not work otherwise. Do not type into the chat anything you are not prepared to share with a third party: passwords, card numbers, other people's personal data.
Rating the user guide
Each guide article ends with “was this article helpful?” and a field to explain. We store the answer, the text of the explanation, and a fingerprint of your IP address. We do not store the address itself, and the fingerprint serves exactly one purpose: to stop the same person voting twenty times. We cannot link it back to you and do not try to.
Legal basis — legitimate interest: without ratings there is no way to tell which articles fail to answer the reader's question.
Newsletter
If you subscribed, we store your e-mail and the fact of consent. Legal basis — your consent, and you can withdraw it at any moment by writing to support@elbuz.com.
YouTube API Services
Elbuz uses YouTube API Services: if you connect your channel, the system uploads video guides to it and manages the title, description and visibility of the uploaded videos. To do so, the system asks you to sign in to your Google account and grant permission — a separate action you take deliberately. By using this feature you agree to the YouTube Terms of Service; how Google handles your data is described in the Google Privacy Policy.
Which permissions we request and why:
| Scope | What it is for |
|---|---|
youtube.upload | upload a video to your channel |
youtube | manage what was uploaded: title, description, visibility; read the channel's ID and name |
We request no other permissions.
What data we receive and store:
- access and refresh tokens for your channel and their expiry — so that you are not asked to sign in on every upload;
- the channel's ID and name, and the list of permissions granted;
- for each video we uploaded: its YouTube ID, the upload status, and the title, description and tags the system generated itself.
We neither receive nor store your Google password, your mail, contacts, subscriber list, channel statistics, your comments, or videos not uploaded through Elbuz.
How we use, process and share it. This data is used solely for one function — uploading your video to your channel and managing it. Tokens are stored on Elbuz servers in the European Union, transmitted over encrypted connections, and sent only to YouTube itself when calling its API. We do not pass them to anyone else — not to partners, advertising networks or other users — do not sell them, do not use them for advertising and do not analyse them for our own products. Elbuz staff see them only while troubleshooting at your request.
How long we keep it. Tokens — for as long as the channel stays connected. When you disconnect the channel, we immediately revoke the access on Google's side and erase the tokens on ours. The channel's ID and name remain in your account as part of its settings until you remove the connection. Data about uploaded videos is kept for as long as the guide record exists in your account. When your Elbuz account is deleted, all of the above is deleted with it.
How to revoke access: with the "Disconnect channel" button in the system settings, or at myaccount.google.com/permissions. Once revoked on Google's side, the system can no longer reach the channel and the tokens we hold stop working.
Limited Use. Elbuz's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Legal basis — performance of the contract on your explicit instruction.
Cookies
The site sets three cookies, all of them strictly necessary.
| Cookie | Purpose | Lifetime |
|---|---|---|
JUMPERSESSID_… | keeps your session so you do not re-enter the password on every page | the session |
language | which language the site is shown in | 30 days |
currency | which currency prices are shown in | 30 days |
There are no advertising or analytics cookies on this site. We run no visitor counters, no advertising pixels, and we pass nothing about your browsing to advertising networks.
One exception — pages with forms. They run Google reCAPTCHA, which tells a human from a robot and sets its own cookie. Without it the contact forms drown in spam within a week. Basis — our legitimate interest in protecting the service; this data is not used for advertising.
More detail is in the cookie policy.
Who receives the data
To run the site and the system
- Hosting and file storage — the companies whose servers run the system. They act under contract as processors and may not use the data for their own purposes.
- Mail service — delivers our letters to you; it sees the address and the text of the letter.
- Google — reCAPTCHA on pages with forms (IP and behavioural signals), the tag manager, and YouTube if you connected the video upload.
- Language and speech services — process the texts you send to the assistant, as well as product card and letter texts in the features you have enabled.
On your instruction
When you connect an exchange with a marketplace, a delivery service, a payment provider or telephony, data goes where you configured it to go. That is your decision and your settings; we only carry out the exchange.
When the law requires it
If a lawful demand arrives from a state authority, we are obliged to comply. We will inform you about such a demand unless the law forbids it.
Where the data lives and where it travels
| What | Where |
|---|---|
| account databases, the system itself | Germany, Finland |
| files, images, documents | Germany |
The bulk of the data is stored in Europe. Some of the services listed above, however, operate outside it — primarily in the United States: Google (reCAPTCHA, tag manager, YouTube) and the language services. Transfers to them rely on the Standard Contractual Clauses approved by the European Commission, or on the recipient's participation in the Data Privacy Framework. A copy of the relevant safeguards can be requested at support@elbuz.com.
How long we keep the data
Below are the periods the system enforces automatically. Where no period is given, the data lives as long as your account does and is deleted together with it.
Our own data as the operator
| Data | Retention |
|---|---|
| Sign-in IP addresses | 12 months |
| Sign-in log | 12 months |
| User guide ratings | 24 months |
| Support correspondence, assistant conversations | as long as the account exists |
| Accounting documents | 3 years after settlement — required by Ukrainian tax law |
Data inside your account
Here the system sets defaults, but the data is yours to manage:
| Data | Retention |
|---|---|
| Work log in the program | 14 days |
| Operations log | 90 days |
| Database backups | the seven latest automatic ones; manual ones until you delete them |
What happens when an account is deleted
The account is switched off first, and for 14 days it can still be restored — this is protection against accidental deletion. After that the account database is deleted.
Database backups taken before the deletion remain in storage for up to 90 days and are then destroyed. We say this plainly because it matters: “deleted” does not mean “gone from everywhere the same minute”.
Your rights and how to use them
You may ask for:
- access — what data of yours we hold;
- correction — if the data is inaccurate;
- deletion — except what we are legally required to keep;
- restriction — while a dispute about accuracy is being resolved;
- portability — an export of your data in a machine-readable form;
- withdrawal of consent — wherever consent was the basis.
Step-by-step instructions for deleting your data yourself — including data received through Facebook, Instagram and WhatsApp messengers — are on a separate page: deleting your data.
Separately, the right to object. Where we process data on the basis of legitimate interest — sign-in logs, article ratings, review of assistant answers — you have the right to object. Write to us, and we will either stop that processing or explain why we consider our grounds to override.
We take no automated decisions about you. The system contains no mechanism that would make decisions with legal effects for you without a human involved.
How we respond
Write to support@elbuz.com. A substantive answer follows within 30 calendar days, free of charge. If the request is complex the period may be extended by two further months, but we will tell you within those first 30 days and explain why. A refusal is also an answer: with a reason, not with silence.
How we check that it is really you
Data goes only to its owner. A request from the address linked to the account is enough. From any other address we will ask you to prove control: a letter with a code to the account address, or an action inside the account.
We do not ask for passport scans or other identity documents. Those would be extra personal data collected for the sake of a check — and extra data is what we avoid collecting.
If you are a customer of a store running on Elbuz
Your data belongs to the store owner, not to us — we only store it on their instruction. Write to us and within 5 working days we will pass your request to the store owner and tell you who is responsible for your data.
The right to complain
You may at any time, and without approaching us first, lodge a complaint with a supervisory authority. In Ukraine this is the Ukrainian Parliament Commissioner for Human Rights. If you live in the European Union — with the supervisory authority of your country of residence, your place of work, or the place where the alleged infringement occurred.
How we protect the data
- all connections to the site and the system are encrypted;
- passwords are stored as irreversible fingerprints and we cannot see them;
- sign-in is protected against brute force: attempts are recorded and access is temporarily blocked after several failures;
- two-factor sign-in verification is available;
- database backups are taken daily; the seven latest are kept.
If a breach occurs that threatens your rights, we will notify you without undue delay and explain what happened and what to do.
Children
The system is built for business and is not intended for children. We do not knowingly collect data of anyone under 16. If such data reaches us, we delete it.
Changes to this policy
If the policy changes materially — new data, new recipients or new retention periods — we will announce it on the site and notify registered users by e-mail no later than 14 days before it takes effect. Minor wording fixes are reflected in the date at the top.
Other documents
- Cookie policy — what exactly the site sets and how to control it
- Deleting your data — step-by-step instructions
- Terms of use of the website
- License agreement — the terms of using the Elbuz system itself
Contact
Olena Shelekhan, private entrepreneur (Elbuz)
27B/701 Nauky Avenue, Kharkiv, Ukraine, 61072
support@elbuz.com