Privacy Policy

Last updated October 13, 2026

In short: your files and results are stored encrypted in Ella’s own database and used only to provide Ella to you. We never sell them, never use them to train AI models, and the AI that reads your statements keeps nothing. Delete a project or your whole account at any time, and it is gone.

1. Who we are

This Privacy Policy explains what Ella (“Ella,” “we,” “us”), of Cambridge, Massachusetts, collects when you visit askella.work or use the Ella application (the “Service”), what we do with it, who receives it, how long we keep it, and the choices you have. It sits alongside our Terms of Service, and uses the terms defined there, such as “Customer Content” for the documents and data you upload.

Questions and requests about your information go through the contact form.

2. What we collect

Your account: Your email address. If you set a password, we store only a one-way bcrypt hash of it, never the password itself. If you sign in with Google, we ask Google for your email address and nothing else; Google tells us the address, whether Google has verified it, and, for a Google Workspace account, your organization’s domain. We keep only the address. We do not receive your name, photo, contacts or anything else from your Google account.
Customer Content: The files you upload (PDFs and Excel workbooks) and their file names; the property and project names you enter; and what Ella produces from them: the statement’s lines and figures, where each line was placed, notes and checks, and your review edits. When you confirm where a line belongs, Ella remembers it so it can suggest the same next time, as a one-way fingerprint of the line’s wording that cannot be turned back into the text. Statements can contain information about other people, such as names in payroll lines; it is handled as Customer Content like everything else in the file.
Records of agreement: Each time you accept the Terms of Service, or the acknowledgement shown before each new project, we record which version and exact wording you accepted, when, your IP address and your browser’s user-agent string, as evidence of what was agreed.
Billing: If you subscribe, Stripe collects your card details on its own pages; card numbers never reach Ella. We keep Stripe’s identifiers for your customer record and subscription, your plan and its status and dates, and how many P&Ls you processed in each billing period. We also count the free P&Ls you have used.
Messages: What you send through the contact form (your name, email address, company if you give it, and message) is emailed to our team and is not stored in Ella’s database. If you are signed in, your account’s email address and ID are included so we can find your account.
Product updates: The email address you leave in a product-updates form on our website, and which form it came from.
Abuse prevention: To limit repeated attempts at signing in, signing up, resetting a password, sending messages, joining the updates list and uploading, Ella keeps short-lived counters keyed by IP address, by the email address entered, or by account ID.
Server logs: Our host records the application’s logs: technical events with account and upload IDs, and error messages. When processing fails, an error message can occasionally include a fragment of the data being processed.

We do not use analytics, advertising or tracking tools, and load no third-party scripts in your browser. We do not buy information about you, and receive none from anyone else beyond what Google and Stripe tell us as described here.

3. How we use it

To provide the Service: Reading and mapping your statements, showing and saving results and your edits, and exports.
To run your account: Signing in, confirming your email address, resetting your password, and billing.
To keep it secure: Preventing abuse and unauthorized access, and investigating security problems.
To talk to you: Account emails (confirming your address, resetting your password, telling you that an address already has an account), and replies to your messages. Product updates only if you asked for them.
To meet legal duties: Complying with the law, enforcing our Terms, and keeping records of what was agreed.

Customer Content is used only to provide the Service to you. We do not use it to train AI models, to develop products for anyone else, for advertising, or for any purpose of our own. Our team does not open your Customer Content except when you ask us to, for example to help with a problem; when needed to investigate a security incident or abuse; or when the law requires it.

We do not sell personal information or Customer Content, and we do not share either for targeted or cross-context behavioral advertising.

4. How Ella’s AI sees your statements

To map a statement, Ella sends its lines to an AI model. For each line it sends the line’s wording, one figure from it, whether it is a total, the headings and sheet-tab names it sits under (which can include a property or outlet name), a department tag and any account code printed with it. For lines that need a second look, it also sends the wording of up to three lines on either side and where Ella placed them. It never sends the file itself, the file name, the property name you typed, or anything identifying you, such as your name, email address or account.

The model is Anthropic’s Claude, run on Amazon Bedrock and reached through OpenRouter, on a route that requires zero data retention: the providers process each request to answer it, and neither keep its content nor use it to train models. In production, Ella’s code refuses to send statement lines anywhere else.

Ella also runs a small model of its own, entirely on our servers. It was trained only on synthetic statements and published reference material, never on customer statements.

5. Who receives information

We share information only with the service providers that run parts of Ella for us, and only what each needs:

Railway: Hosts the application and its database, in the United States, and keeps its logs.
OpenRouter and Amazon Web Services: Process statement lines for classification as described in section 4, with zero data retention.
Stripe: Payments and subscriptions: receives your email address and Ella account ID, and collects your card details directly.
Resend: Delivers Ella’s emails: the recipient’s address and the email’s contents.
Our email provider: Messages you send through the contact form arrive in our team’s inbox, which our email provider hosts.
Google: Only if you choose “Continue with Google”: Google confirms your email address to us, and, under its own privacy policy, knows that you signed in to Ella.

Beyond these, we disclose information only when the law requires it or to protect the rights, property or safety of Ella, our users or others; to a successor if Ella is merged, acquired or sells its assets, under this policy’s protections; or with your consent.

6. Where it is stored

Ella’s application and database run in California, United States, on infrastructure Railway operates for us. Ella does not own the physical servers, but the database is Ella’s own: no other company’s application uses it. Our service providers may process information in the United States and other countries. If you use Ella from outside the United States, your information is transferred to and processed in the United States.

7. How we protect it

Encryption: Your files, results, and project, property and file names are encrypted in the database with AES-256-GCM, each sealed to your account. Remembered mappings are kept only as keyed one-way fingerprints. All connections to Ella use HTTPS.
Passwords: Hashed with bcrypt; never stored or logged in readable form.
Access: Every request checks that what is asked for belongs to the person asking. Sessions last 12 hours and end at once when you reset your password or delete your account.

Account and billing details, such as your email address and plan, are not encrypted in this way, since the Service needs them to work. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

8. How long we keep it

Customer Content: Until you delete it, or your account. Deleting a project deletes its files and results; deleting an analysis deletes its results and keeps the files it was made from; a file can be deleted once no analysis uses it. An upload that fails processing is deleted at once; one left unfinished for 24 hours is deleted the next time Ella’s automatic cleanup runs.
Account, mappings and records of agreement: For as long as your account exists, including after a plan ends.
Product updates list: Until you ask us to remove your address, or delete an account with the same address.
Abuse-prevention counters: Expire within an hour, and are cleared out automatically as the Service runs.
Server logs: Kept by Railway for a limited period, currently 7 days.
Backups: Ella does not currently keep backups of its database. If we start to, deleted information can remain in a backup until that backup expires, no more than 90 days after deletion.
Elsewhere: Stripe keeps payment and invoice records as the law requires, under its own policy; Resend keeps records of emails it delivered under its own policy; messages to our team stay in our inbox for as long as we need them.

Deleting your account (from the Account page) immediately and permanently deletes your account and everything in it from Ella’s database: projects, files, results, remembered mappings, records of agreement, your product-updates entry, and counters tied to your address or account. It deletes your customer record at Stripe, which ends any subscription at once, without a refund for the rest of the period.

9. Your choices and rights

See and copy: Download the files you uploaded and export your results in the app, while your trial or plan is active. For a copy of everything we hold about you, at any time, contact us.
Correct: Your email address can’t be changed in the app yet; contact us and we will change it.
Delete: Delete files, analyses and projects at any time, and your whole account from the Account page, including when your plan has ended or if you decline the Terms.
Stop updates: Ask us through the contact form to remove your address from the updates list.

Depending on where you live, for example in the European Economic Area, the United Kingdom or California, you may have the right to access, correct, delete or receive a portable copy of your personal information, to restrict or object to how it is used, and to withdraw consent. We honor these requests for everyone, wherever they live, and answer within 30 days. We will not treat you differently for making one. You may also complain to your local data protection authority.

Where the GDPR applies, we rely on: performing our contract with you (providing the Service and billing); legitimate interests (security, abuse prevention, records of agreement, and answering messages); your consent (the product updates list); and legal obligations.

California residents: we do not sell or share personal information, and do not use sensitive personal information to infer anything about you, so there is nothing to opt out of; a Global Privacy Control or Do Not Track signal changes nothing because nothing is tracked.

10. Cookies and browser storage

Ella uses only cookies needed for the Service to work, and two that remember how you like it displayed. None is for analytics or advertising, and none is set by anyone else.

authjs.session-token: Keeps you signed in; encrypted. 12 hours.
authjs.csrf-token: Protects sign-in forms against forgery. Until you close the browser.
authjs.callback-url: Where to return after signing in. Until you close the browser.
authjs.pkce.code_verifier: Secures “Continue with Google”. 15 minutes.
ella_checkout: Remembers a plan you chose before signing up. 24 hours, or until used.
ella_sidebar: Whether the menu is expanded or collapsed. 1 year.
ella-project-view: Whether projects show as a grid or a list. 1 year.

On secure connections the first four carry a “__Secure-” or “__Host-” prefix. Ella also keeps display preferences in your browser’s local storage (which review view or chart settings you last used, and which sources are switched off), plus the IDs of an upload in progress and of your account, so a reload can pick the upload up. None of it contains your statements’ contents, your name or your email address.

11. Children

Ella is for business use by people at least 18 years old. We do not knowingly collect information from anyone younger; if you believe we have, contact us and we will delete it.

12. Changes to this policy

We will post any change here with a new date. If a change is material, we will also tell you by email or in the Service.

13. Contact

For questions, requests or complaints about your information, use the contact form.