> For the complete documentation index, see [llms.txt](https://docs.eliapp.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.eliapp.io/confidentialite-et-securite-en/data-privacy/what-data-we-handle.md).

# What data we handle

## Executive Summary

Eli processes personal data necessary for employee engagement platform functionality through a **two-tier account system**: portable user accounts that persist across organizations, and business accounts that contain organization-specific data. We follow data minimization principles, collecting only what's required for service delivery and platform security.

## Account Architecture

**Portable User Accounts**

* Individual employee profiles that can participate across multiple organizations
* Persist independently of any single business relationship
* User-controlled with deletion rights at any time

**Business Accounts (Organizations)**

* Company workspaces containing campaigns, challenges, and organizational content
* Tied to business contracts and subscriptions
* Deleted when business relationship ends

All data processing operates under **Contract**, **Legitimate Interest**, and **Consent** legal bases as detailed below.

## Personal Data Categories

#### User Identity Data

**Purpose:** Portable account management and cross-organizational service delivery\
**Legal Basis:** Contract + Consent (for account portability)

| Data Type           | Description                       | Source                          | Retention                   |
| ------------------- | --------------------------------- | ------------------------------- | --------------------------- |
| Email address       | Primary account identifier        | Admin-provided or User provided | Until user deletion request |
| First name          | User identification               | Admin-provided or User provided | Until user deletion request |
| Last name           | User identification               | Admin-provided or User provided | Until user deletion request |
| Profile picture     | Optional user personalization     | User provided                   | Until user deletion request |
| Language preference | Interface localization            | User provided                   | Until user deletion request |
| Timezone            | Activity scheduling and reporting | User provided                   | Until user deletion request |

#### Employee Engagement Data (User Level)

**Purpose:** Cross-organizational engagement tracking and portable user achievements\
**Legal Basis:** Contract + Consent (for portability)

| Data Type              | Description                            | Source                         | Retention                   |
| ---------------------- | -------------------------------------- | ------------------------------ | --------------------------- |
| Engagement scores      | Calculated from activity participation | System generated               | Until user deletion request |
| Activity participation | Actions completed, challenges joined   | User actions                   | Until user deletion request |
| Team associations      | Department/team membership             | Admin-provided or User actions | Until user deletion request |
| Challenge performance  | Competition results and standings      | User participation             | Until user deletion request |
| Goal completions       | Daily/weekly objective tracking        | User actions                   | Until user deletion request |
| Trust scores           | Individual fraud prevention scores     | System generated               | Until user deletion request |

#### Organizational Engagement Data

**Purpose:** Organization-specific engagement tracking and analytics\
**Legal Basis:** Contract

| Data Type              | Description                          | Source                         | Retention                      |
| ---------------------- | ------------------------------------ | ------------------------------ | ------------------------------ |
| Activity participation | Actions completed, challenges joined | User actions                   | Until business account closure |
| Team associations      | Department/team membership           | Admin-provided or User actions | Until business account closure |
| Challenge performance  | Competition results and standings    | User participation             | Until business account closure |
| Goal completions       | Daily/weekly objective tracking      | User actions                   | Until business account closure |
| Organization analytics | Aggregated engagement metrics        | System generated               | Until business account closure |

#### Social Interaction Data

**Purpose:** Community features and engagement\
**Legal Basis:** Contract

| Data Type         | Description                   | Source      | Retention                   |
| ----------------- | ----------------------------- | ----------- | --------------------------- |
| Posts and content | User-generated social content | User action | Until user deletion request |
| Reactions         | Emoji responses to posts      | User action | Until user deletion request |
| Comments          | Social interactions           | User action | Until user deletion request |

#### Technical & Security Data

**Purpose:** Accounts and platform security, service improvement\
**Legal Basis:** Contract + Legitimate Interest

| Data Type          | Description                                                    | Source           | Retention                   |
| ------------------ | -------------------------------------------------------------- | ---------------- | --------------------------- |
| Device information | Device name, type, OS, browser for logged-in device management | System collected | Until user deletion request |
| IP addresses       | Account security                                               | System collected | Until user deletion request |

#### Communication Preferences

**Purpose:** Service notifications and updates\
**Legal Basis:** Contract

| Data Type                | Description                 | Source        | Retention                   |
| ------------------------ | --------------------------- | ------------- | --------------------------- |
| Notification preferences | User communication settings | User provided | Until user deletion request |
| Push notification tokens | Mobile app notifications    | System issued | Until user deletion request |

***

**For data processing questions or data subject rights requests, contact:** <dpo@eliapp.io>

**Last Updated:** March 2026