# What data we handle

## Executive Summary

Eli processes personal data necessary for employee engagement platform functionality through a **two-tier account system**: portable user accounts that persist across organizations, and business accounts that contain organization-specific data. We follow data minimization principles, collecting only what's required for service delivery and platform security.

## Account Architecture

**Portable User Accounts**

* Individual employee profiles that can participate across multiple organizations
* Persist independently of any single business relationship
* User-controlled with deletion rights at any time

**Business Accounts (Organizations)**

* Company workspaces containing campaigns, challenges, and organizational content
* Tied to business contracts and subscriptions
* Deleted when business relationship ends

All data processing operates under **Contract**, **Legitimate Interest**, and **Consent** legal bases as detailed below.

## Personal Data Categories

#### User Identity Data

**Purpose:** Portable account management and cross-organizational service delivery\
**Legal Basis:** Contract + Consent (for account portability)

| Data Type           | Description                       | Source                          | Retention                   |
| ------------------- | --------------------------------- | ------------------------------- | --------------------------- |
| Email address       | Primary account identifier        | Admin-provided or User provided | Until user deletion request |
| First name          | User identification               | Admin-provided or User provided | Until user deletion request |
| Last name           | User identification               | Admin-provided or User provided | Until user deletion request |
| Profile picture     | Optional user personalization     | User provided                   | Until user deletion request |
| Language preference | Interface localization            | User provided                   | Until user deletion request |
| Timezone            | Activity scheduling and reporting | User provided                   | Until user deletion request |

#### Employee Engagement Data (User Level)

**Purpose:** Cross-organizational engagement tracking and portable user achievements\
**Legal Basis:** Contract + Consent (for portability)

| Data Type              | Description                            | Source                         | Retention                   |
| ---------------------- | -------------------------------------- | ------------------------------ | --------------------------- |
| Engagement scores      | Calculated from activity participation | System generated               | Until user deletion request |
| Activity participation | Actions completed, challenges joined   | User actions                   | Until user deletion request |
| Team associations      | Department/team membership             | Admin-provided or User actions | Until user deletion request |
| Challenge performance  | Competition results and standings      | User participation             | Until user deletion request |
| Goal completions       | Daily/weekly objective tracking        | User actions                   | Until user deletion request |
| Trust scores           | Individual fraud prevention scores     | System generated               | Until user deletion request |

#### Organizational Engagement Data

**Purpose:** Organization-specific engagement tracking and analytics\
**Legal Basis:** Contract

| Data Type              | Description                          | Source                         | Retention                      |
| ---------------------- | ------------------------------------ | ------------------------------ | ------------------------------ |
| Activity participation | Actions completed, challenges joined | User actions                   | Until business account closure |
| Team associations      | Department/team membership           | Admin-provided or User actions | Until business account closure |
| Challenge performance  | Competition results and standings    | User participation             | Until business account closure |
| Goal completions       | Daily/weekly objective tracking      | User actions                   | Until business account closure |
| Organization analytics | Aggregated engagement metrics        | System generated               | Until business account closure |

#### Social Interaction Data

**Purpose:** Community features and engagement\
**Legal Basis:** Contract

| Data Type         | Description                   | Source      | Retention                   |
| ----------------- | ----------------------------- | ----------- | --------------------------- |
| Posts and content | User-generated social content | User action | Until user deletion request |
| Reactions         | Emoji responses to posts      | User action | Until user deletion request |
| Comments          | Social interactions           | User action | Until user deletion request |

#### Technical & Security Data

**Purpose:** Accounts and platform security, service improvement\
**Legal Basis:** Contract + Legitimate Interest

| Data Type          | Description                                                    | Source           | Retention                   |
| ------------------ | -------------------------------------------------------------- | ---------------- | --------------------------- |
| Device information | Device name, type, OS, browser for logged-in device management | System collected | Until user deletion request |
| IP addresses       | Account security                                               | System collected | Until user deletion request |

#### Communication Preferences

**Purpose:** Service notifications and updates\
**Legal Basis:** Contract

| Data Type                | Description                 | Source        | Retention                   |
| ------------------------ | --------------------------- | ------------- | --------------------------- |
| Notification preferences | User communication settings | User provided | Until user deletion request |
| Push notification tokens | Mobile app notifications    | System issued | Until user deletion request |

***

**For data processing questions or data subject rights requests, contact:** <dpo@eliapp.io>

**Last Updated:** March 2026


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.eliapp.io/confidentialite-et-securite-en/data-privacy/what-data-we-handle.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.