What Data We Handle
Executive Summary
Eli processes personal data necessary for employee engagement platform functionality through a two-tier account system: portable user accounts that persist across organizations, and business accounts that contain organization-specific data. We follow data minimization principles, collecting only what's required for service delivery and platform security.
Account Architecture
Portable User Accounts
- Individual employee profiles that can participate across multiple organizations
- Persist independently of any single business relationship
- User-controlled with deletion rights at any time
Business Accounts (Organizations)
- Company workspaces containing campaigns, challenges, and organizational content
- Tied to business contracts and subscriptions
- Deleted when business relationship ends
All data processing operates under Contract, Legitimate Interest, and Consent legal bases as detailed below.
📊 Personal Data Categories
User Identity Data
Purpose: Portable account management and cross-organizational service delivery
Legal Basis: Contract + Consent (for account portability)
| Data Type | Description | Source | Retention |
|---|---|---|---|
| Email address | Primary account identifier | Admin-provided or User provided | Until user deletion request |
| First name | User identification | Admin-provided or User provided | Until user deletion request |
| Last name | User identification | Admin-provided or User provided | Until user deletion request |
| Profile picture | Optional user personalization | User provided | Until user deletion request |
| Language preference | Interface localization | User provided | Until user deletion request |
| Timezone | Activity scheduling and reporting | User provided | Until user deletion request |
Employee Engagement Data (User Level)
Purpose: Cross-organizational engagement tracking and portable user achievements
Legal Basis: Contract + Consent (for portability)
| Data Type | Description | Source | Retention |
|---|---|---|---|
| Engagement scores | Calculated from activity participation | System generated | Until user deletion request |
| Activity participation | Actions completed, challenges joined | User actions | Until user deletion request |
| Team associations | Department/team membership | Admin-provided or User actions | Until user deletion request |
| Challenge performance | Competition results and standings | User participation | Until user deletion request |
| Goal completions | Daily/weekly objective tracking | User actions | Until user deletion request |
| Trust scores | Individual fraud prevention scores | System generated | Until user deletion request |
Organizational Engagement Data
Purpose: Organization-specific engagement tracking and analytics
Legal Basis: Contract
| Data Type | Description | Source | Retention |
|---|---|---|---|
| Activity participation | Actions completed, challenges joined | User actions | Until business account closure |
| Team associations | Department/team membership | Admin-provided or User actions | Until business account closure |
| Challenge performance | Competition results and standings | User participation | Until business account closure |
| Goal completions | Daily/weekly objective tracking | User actions | Until business account closure |
| Organization analytics | Aggregated engagement metrics | System generated | Until business account closure |
Social Interaction Data
Purpose: Community features and engagement
Legal Basis: Contract
| Data Type | Description | Source | Retention |
|---|---|---|---|
| Posts and content | User-generated social content | User action | Until user deletion request |
| Reactions | Emoji responses to posts | User action | Until user deletion request |
| Comments | Social interactions | User action | Until user deletion request |
Technical & Security Data
Purpose: Accounts and platform security, service improvement
Legal Basis: Contract + Legitimate Interest
| Data Type | Description | Source | Retention |
|---|---|---|---|
| Device information | Device name, type, OS, browser for logged-in device management | System collected | Until user deletion request |
| IP addresses | Account security | System collected | Until user deletion request |
Communication Preferences
Purpose: Service notifications and updates
Legal Basis: Contract
| Data Type | Description | Source | Retention |
|---|---|---|---|
| Notification preferences | User communication settings | User provided | Until user deletion request |
| Push notification tokens | Mobile app notifications | System issued | Until user deletion request |
For data processing questions or data subject rights requests, contact: dpo@eli.app
Last Updated: August 2025