Privacy policy.

Draft for legal review

Draft of 19 October 2026. Not in effect yet. This draft is for review by Elnovra Studio and its lawyer. Text in square brackets is still to be confirmed.

This policy explains how Elnovra Studio LLP [To confirm: registered name and LLP identification number once incorporation is complete] (“Elnovra Studio”, “we”, “us”) handles personal information on elnovra.design, in the Elnovra waitlist, and in emails you send us. Elnovra is the presentation workspace we’re building; Elnovra Studio is the studio behind it.

[To confirm: whether this policy also covers elnovra.studio, whose privacy link leads here.]

The short version

When you join the waitlist, we keep what you type into the form and a few details about how you found us.
We use them to run the waitlist, to decide who to invite in each batch, to email you when early access is ready for you, and to decide what to build.
We don’t sell your form answers, use them for targeted advertising, or use them to train AI.
Optional Google measurement runs only after you allow it. You can decline and still join the waitlist.
You can ask to see, correct or delete your information at any time: write to hello@elnovra.studio.

What we collect when you join the waitlist

What you tell us.

Your email address (required).
Your name, your role and what you’d make first (presentations, brochures, packaging artwork or brand identity), if you give them.

How you found us. If you arrived through a link that carries them, we keep:

the campaign tags in that link (utm_source, utm_medium, utm_campaign, utm_term and utm_content);
an ad click ID, if the link came from an ad: Google’s gclid, Meta’s fbclid or LinkedIn’s li_fat_id. These IDs are created by the ad platform. We don’t send them back to it;
the page you first landed on.

We also keep:

the website that sent you to us (the referrer), if your browser shares it;
a short label for where you came from: the campaign source, the referring site, or “direct”;
the page the form was on, and the site it was on (for example, https://elnovra.design).

Until you join, your browser holds the campaign tags and the referring site in its session storage, so the form can include them. They stay on your device, are cleared when you close the tab, and reach us only if you submit the form.

Your country. Cloudflare, which runs the waitlist for us, works out a two-letter country code from your IP address. We store the country code, not the IP address.

Records we keep with your sign-up.

When you joined, by our clock and by your device’s clock.
How many times the same email address was submitted, and when it was last submitted.
Your place in early access (waiting, invited or joined), and any notes our team adds, such as when we invited you.
A scrambled copy (a hash) of the one-time key that links your optional answers to your sign-up. The key expires after 7 days, and we never store the key itself.

The optional questions after you join

After you join, the form asks three questions. You can answer any of them or skip them all:

what you make presentations in now (PowerPoint, Google Slides, Keynote, Canva, Gamma or something else);
how often you present;
the hardest part of making a presentation today, in your own words (up to 1,000 characters);
whether you’re happy to talk for 15 minutes, or to try Elnovra early.

We keep your answers with your sign-up. If you answer more than once, we keep each set and use the latest. Please don’t include sensitive information about yourself or anyone else in the written answer.

Anonymous counts

To see how the waitlist is doing, the site counts how many times each of these happens:

a page is viewed;
the form comes into view, and someone starts filling it in;
the steps of a sign-up described in the next section, such as a sign-up being sent or failing;
the optional questions are shown or skipped.

Each count records only the day, the step, the page and the traffic source (the campaign source, the referring site or “direct”). There’s no cookie, no IP address and no visitor ID, so a count can’t be linked to you.

How we check the form works

So we can find and fix sign-ups that don’t go through, the form records the steps of each attempt to join: for example, that the button was pressed, that the bot check (below) passed, failed or needed a click, that the sign-up was sent and saved, or which kind of error it met. With each step it sends how long it took, a short error code, which version of the page and of our service was used, and whether the bot check was on. Our service adds the type of device (phone, tablet or computer) and the browser family, worked out from the browser’s user-agent, which is not stored.

The steps of one attempt are tied together by a random ID that your browser makes for that attempt and keeps only in memory: it isn’t stored in a cookie or in your browser, isn’t shared with any advertising or analytics service, and is forgotten when the attempt ends. These records never include what you type, your email address or name, your IP address, the bot check’s token or the full web address of the page. If you join, the steps of that attempt are stored next to the same day’s sign-up, so while we keep them they could be matched to it; that is why we don’t call them anonymous. We delete them after 7 days and keep only the daily counts described above.

To leave out visits from search engines and other automated tools, the waitlist service checks the browser’s user-agent (the browser name it sends with every request). The user-agent is not stored.

Checking that you’re a person

To keep automated sign-ups off the waitlist, the form uses Cloudflare Turnstile. When you start filling in the form, your browser loads Turnstile from Cloudflare (challenges.cloudflare.com). It runs a few checks in the background, using details such as your IP address and your browser and device, and usually needs nothing from you. Now and then it may ask you to tick a box.

When you submit, our waitlist service asks Cloudflare to confirm the check passed, and sends your IP address with that request. Cloudflare uses this information only to tell people from bots, as itsTurnstile Privacy Addendum explains. Turnstile doesn’t see what you type into the form, and we don’t store anything it collects. [To confirm: whether Turnstile stores anything in your browser. We don’t switch on its optional clearance cookie.]

Occasionally we switch Turnstile off for a planned test of at most 24 hours, to check whether it stops real people from joining. During such a test your browser doesn’t load it, and our other protections against spam (the limits on repeated requests and the checks on what the form sends) stay on.

Your IP address

Like every website, our waitlist service receives your IP address when your browser contacts it. We use it only to keep spam out: to limit how many requests can come from one address, or one block of addresses, in a minute, and for the Turnstile check described above. We don’t store it with your sign-up or in the counts.

Cloudflare keeps technical logs of requests to the waitlist service for up to 7 days, so we can find and fix errors. [To confirm: whether these logs include IP addresses, or switch off Cloudflare’s request logs for the waitlist service.] The messages our own code writes to those logs say whether a sign-up was new or a repeat. They never include your email address, name or answers.

Cookies and analytics

On elnovra.design, optional Google Analytics 4 measurement loads only after you select “Allow measurement”. It measures page visits and completed waitlist registrations and shares conversion measurements with our linked Google Ads account to evaluate advertising. Google receives browser and device information and the page address; we do not send your name, email, form answers or verification tokens to Google. Personalised advertising and Google signals are disabled in our tag configuration.

Google’s _ga measurement cookies are configured to expire after 90 days without extending their expiry on each visit. We store your measurement choice in this browser’s local storage until you change it or clear your browser data. Select “Measurement preferences” at the bottom of the page to change your choice. Declining prevents the Google tag from loading; withdrawing permission stops it and clears its accessible first-party measurement cookies.

The waitlist and its own diagnostics work whether you accept or decline. Fonts and the film are served from our own site. Cloudflare Turnstile remains separate from optional measurement (see Checking that you’re a person). Read how Google processes information from partner sites.

How we use your information

To keep the waitlist: one entry per email address, with spam filtered out.
To email you when early access is ready for you.
If you said you’re happy to talk, to email you to arrange a short call or an early trial.
To decide who to invite first, from your role, what you’d make first and your answers.
To decide what to build first, from what people would make first, their roles and their answers.
To see which campaigns, websites and pages bring people to the waitlist, and from which countries.
To reply when you write to us.

We don’t sell or rent your information, we don’t share it with advertisers, and we don’t use it to train or fine-tune AI models.

Emails from us

We don’t send a confirmation email when you join, and we don’t send newsletters or marketing emails. You’ll hear from us when early access is ready for you and, only if you said you’re happy to talk, to arrange that. [To confirm: the service that sends these emails.]

If that changes, for example with a sign-up confirmation or product news, we’ll update this policy first, and every marketing email will tell you how to stop receiving them.

Why we’re allowed to use it

You choose to join the waitlist and to answer the questions, and we rely on that consent to keep your sign-up and your answers. You can withdraw it at any time by asking us to remove you. Withdrawing doesn’t affect what we did before you asked.

If you’re in the European Economic Area or the United Kingdom: we use the campaign details, the country code and your IP address (for the spam limit and the Turnstile check) on the basis of our legitimate interests, which are understanding how people find Elnovra and keeping the waitlist free of spam. You can object to this, as explained under “Your rights”.

[To confirm with the lawyer: the basis for each use under India’s Digital Personal Data Protection Act, 2023, in particular whether the campaign details and country code are covered by the consent given at sign-up.]

Where your information is stored, and who handles it

Cloudflare hosts elnovra.design and runs the waitlist service (Cloudflare Workers), its database (Cloudflare D1) and the form’s bot check (Cloudflare Turnstile). The database is set up in Cloudflare’s Asia-Pacific region. [To confirm: the region Cloudflare reports once the production database is created.]
Cloudflare runs a global network. Your request is handled by the Cloudflare data centre nearest to you, which may be outside your country, before it reaches the database.
Cloudflare keeps automatic restore points of the database for up to 30 days. [To confirm: 30 days on Cloudflare’s Workers Paid plan, 7 on the Free plan.]
Our team sees the waitlist through a private control panel, protected by Cloudflare Access, which checks who is signing in. [To confirm: who has access, by role, including any contractor who builds or maintains the site for us.]
Our email provider holds the emails you send to hello@elnovra.studio and the emails we send you. [To confirm: the provider and where it stores email.]

We may export the list, for example to a spreadsheet to plan invitations. Exports are covered by this policy, and we delete them when they’re no longer needed.

Elnovra Studio is based in India. If you’re in the European Economic Area or the United Kingdom, your information is transferred to India and to the countries where Cloudflare processes it. [To confirm with the lawyer: the safeguard for these transfers, such as the standard contractual clauses in Cloudflare’s data processing addendum.]

How long we keep it

Your sign-up and answers: until early access opens to you, or until you ask us to remove you, whichever comes first. [To confirm: what happens to your entry once you’re invited, for example deleted when you join Elnovra, or kept for a set number of months.]
After you’re removed: your entry and answers are deleted straight away. They stay in Cloudflare’s restore points until those expire (see above). We keep a record that we removed you, with your email address partly hidden (for example, a**@example.com), so we can show we did it.
Anonymous counts: for as long as they’re useful, because they don’t identify anyone.
Records of form attempts: 7 days, then they are deleted automatically.
Cloudflare’s technical logs: up to 7 days.
Emails you send us: [To confirm: how long the mailbox keeps them.]

Your rights

Wherever you are, you can ask us what we hold about you, ask us to correct it, or ask us to remove you from the waitlist. Write to hello@elnovra.studio from the address you signed up with, so we know the request is yours. It’s free, and we’ll reply within [To confirm: 30 days].

In India, under the Digital Personal Data Protection Act, 2023, you can:

get a summary of the personal data we process about you, how we process it, and who we’ve shared it with;
have it corrected, completed, updated or erased;
withdraw your consent;
nominate someone to use these rights for you if you die or become unable to;
have a complaint dealt with by us first, and then, if you’re not satisfied, take it to the Data Protection Board of India.

[To confirm with the lawyer: which of these provisions are in force on the date this policy is published.]

In the European Economic Area or the United Kingdom, under the GDPR or the UK GDPR, you can ask for access to your information, and have it corrected or erased. You can ask us to restrict how we use it, object to uses based on our legitimate interests, and receive a copy in a common format to take elsewhere. You can withdraw consent at any time, and complain to your local data protection authority (in the UK, the Information Commissioner’s Office).

[To confirm with the lawyer: whether Elnovra Studio needs a representative in the EU or the UK.]

Some of these rights have limits set by law. If we can’t do what you ask, we’ll tell you why.

Your work in Elnovra

Elnovra isn’t open yet. When early access begins, these commitments will apply, and we’ll expand this section before then.

We don’t use your presentations, uploads, prompts or generated content to train or fine-tune AI models unless you explicitly opt in.
We process your content to provide Elnovra’s features, including through the AI providers that power them: [To confirm: each AI provider, what it processes, and where]. [To confirm: that each provider’s terms prevent it from training on your content.]
We use operational information, such as error reports and feature-usage statistics, to improve reliability and usability.

Keeping it safe

Everything travels over an encrypted connection (HTTPS). The waitlist service accepts sign-ups only from our own site, checks each one with Cloudflare Turnstile, and limits repeated requests. The control panel is behind Cloudflare Access, and the service checks every request for a valid sign-in. No system is completely secure. If a breach affects your information, we’ll tell you and the authorities as the law requires.

Children

Elnovra is for professionals, and the waitlist isn’t meant for anyone under 18. If you think someone under 18 has joined, tell us and we’ll remove them.

Changes to this policy

When we change this policy, we’ll update the date at the top. If a change affects information you’ve already given us, we’ll email you before it applies.

Contact

Elnovra Studio LLP
WeWork Olympia Cyberspace
No 21/22, Alandur Road,
Arulayiammanpet, 2nd Street,
Guindy, Chennai 600032, India
hello@elnovra.studio

[To confirm: the name or role of the person who answers privacy questions and complaints.]