Privacy Notice

Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.

This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use our Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.

Customer Content

“Customer Content” means the data, files, and records that a customer or its authorized users submit to, upload to, or connect to the Services, or that we retrieve from a customer’s systems or third-party sources at the customer’s direction — for example, loan and portfolio data, fund administrator and general ledger extracts, borrower and obligor files, investor and limited partner records, supporting documents, and the reports, reconciliations, and other outputs we generate from them. Customer Content may contain personal data. We process Customer Content as a processor (or service provider) on behalf of the relevant customer, in accordance with our agreement with that customer, and not for our own independent purposes. Where this Privacy Notice describes rights or choices, those rights and choices apply to personal data we process as a controller; for personal data contained in Customer Content, see “Personal Data We Process for Our Customers” below.

The categories of personal data we collect depend on how you interact with us and our Services. In the course of doing business, providing the Services, and operating our Websites, we collect personal data in different ways and from different sources, as described below. Information we collect from one source may be combined with information we collect from another.

Information you provide directly

Account Information

When you or your employer creates an account with us, and throughout the time you or your employer uses the Services, we collect information associated with your account, including your name, business email address, job title and role, employer, telephone number, language and notification preferences, account credentials and multi-factor authentication details, billing and payment contact information, and your transaction history with us (collectively, “Account Information”).

Communication Information

If you communicate with us, for example when you contact us about the Services, complete a survey, attend an event we host or sponsor, participate in a design partner or pilot program, or request support, we collect your name, business contact details, information about your role and firm, survey and feedback responses, how you interact with our communications, and the contents of any messages you send us (collectively, “Communication Information”).

Meeting and Call Information

With notice and, where required, your consent, we may record or transcribe onboarding sessions, implementation working sessions, support calls, and product feedback calls in order to produce notes, capture requirements, and improve the Services. Recordings and transcripts, and the notes derived from them, are “Meeting Information.”

Social Media Information

We maintain pages on services such as LinkedIn and X. When you interact with our pages, or with our personnel through those services, we collect the personal data you choose to provide, such as contact details and the contents of your messages, posts, or profile. Third parties may also provide us with aggregate analytics about activity on those pages (collectively, “Social Media Information”).

Applicant Information

If you apply for a role at Ellis, we collect your resume or CV, contact details, work history, education, portfolio or code samples, interview notes and scorecards, screening assessments, references, and, where you choose to provide it, information about your work authorization (collectively, “Applicant Information”). We use Applicant Information to evaluate your application, communicate with you, and administer our hiring process.

Demo and Inquiry Information

When you request a demo or otherwise submit a form on our Websites, we collect the information you enter — such as your name, business email address, firm, and role — together with the page you submitted it from, the website that referred you, and any campaign parameters contained in the link you followed.

Information we collect automatically

Log Data

Information your browser or device sends automatically when you use the Services or visit our Websites, including your IP address, browser type and settings, the date and time of your request, referring page, and how you interact with pages and features (collectively, “Log Data”).

Usage Data

When you interact with the Services, metadata is generated that provides context about your use of them. This includes your account identifier and email address, how often you sign in, which features and modules you use, time spent in the Services, the volume and type of operations you run, and how those operations performed (collectively, “Usage Data”). Usage Data does not include Customer Content.

Cookies and Similar Technologies

Our Websites do not use advertising cookies, pixels, tags, or cross-site tracking technologies, and we do not permit advertising networks to collect information through them.

We do use a privacy-preserving analytics service, provided to us by our hosting provider, to understand how our Websites are used. It records page views and the actions people take on a page — for example, which page was viewed, which website referred a visitor to us, any campaign parameters in the link that was followed, the general category of device and browser used, the country the request came from, and whether a visitor clicked a call to action, began filling in a form, or submitted one. This service does not set cookies, does not create a persistent identifier for you, and does not follow you across other websites. To estimate how many distinct people visited on a given day, it derives a non-reversible value from your IP address and browser type; your IP address is not retained. The information recorded about clicks and form interactions describes the page and the action, not you: it does not include your name, email address, employer, or anything else you typed into a form. Our provider processes this information on our behalf as our service provider, under a contract that prohibits it from using the information for its own purposes, and we do not use it for advertising.

Your browser may also store a small amount of data locally to remember interface preferences — for example, that you dismissed a notice — and that data remains on your device. Where we present a security challenge before accepting a form submission, that challenge is provided by our bot-mitigation vendor and is strictly necessary to prevent automated abuse. The authenticated Services use cookies and similar technologies that are strictly necessary to keep you signed in, maintain session integrity, and enforce access controls. If we begin using advertising technologies or non-essential cookies, we will update this Privacy Notice and, where required by applicable law, obtain your consent first.

Device Information

Device and connection information collected when you access the Services, including device type and name, operating system, device identifiers, and browser (collectively, “Device Information”).

For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the “Your Privacy Choices” section below.

Information we collect from third parties

We also receive information about you from:

• security and infrastructure partners, who may provide information such as compromised credential alerts and threat intelligence, to protect against fraud, abuse, and security threats;
• sales and marketing data providers, who provide business contact details such as name, business email address, telephone number, employer, job title, and information about professional affiliations, for the purpose of identifying and contacting potential customers;
• event organizers, industry associations, and market research firms (for example, private credit and SBIC industry conferences we attend or sponsor), who may provide business contact details and information about your firm and role;
• your employer or the organization you represent, where you interact with us in connection with your employment — for example, we may receive your contact information from your employer so that we can communicate with you about your employer’s customer relationship with us; and

(Collectively, “Information Collected From Third Parties.”)

Publicly available information

We collect publicly available business information, including information published on professional networking sites, firm websites, and public regulatory filings and registers, such as Form ADV filings, SBA licensee lists, and fund registration records, about our customers and prospective customers, in order to identify, offer, and provide our Services (“Publicly Available Information”).

In addition to the primary purposes for using personal data described above, we may also use personal data we collect to:

• Fulfill or meet the reason the information was provided, such as to fulfill our contractual obligations, to facilitate payment for our Services, or to deliver the services requested;
• Communicate with you, including via email, text message, chat, social media, and/or telephone calls;
• Facilitate the relationship we have with you and, where applicable, the company you represent;
• Request you provide us feedback about our product and service offerings;
• Address inquiries or complaints made by or about an individual in connection with our Services;
• Create and maintain accounts for our users;
• Market our Services to you, including through email, phone, text message, and social media;
• Administer, improve, and personalize our Services, including by recognizing you and remembering your information when you return to our Services;
• Develop, operate, improve, maintain, protect, and provide the features and functionality of our Services;
• Identify and analyze how you use our Services;
• Create aggregated or deidentified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice;
• Improve and customize our Services to address the needs and interests of our user base and other individuals we interact with;
• Test, enhance, update, and monitor the Services, or diagnose or fix technology problems;
• Help maintain and enhance the safety, security, and integrity of our property, Services, technology, assets, and business;
• Defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Service), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties;
• Detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Ellis and others;
• Facilitate business transactions and reorganizations impacting the structure of our business;
• Comply with contractual and legal obligations and requirements; and
• Fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.

We disclose or otherwise make available personal data in the following ways:

To Service Providers and Processors

We disclose personal data to third parties that perform services for us or on our behalf, and we permit them to use that personal data only to provide those services to us. These include providers of: cloud hosting, storage, and infrastructure; website hosting, content delivery, and website analytics; security, bot mitigation, and fraud prevention; error monitoring, logging, and software development tooling; artificial intelligence and machine learning infrastructure used to provide features of the Services; customer relationship management, marketing, and email delivery; scheduling, communications, and video conferencing, including recording and transcription; billing, invoicing, and payment processing; recruiting and applicant tracking; and professional advisors, such as our auditors, accountants, insurers, bankers, and lawyers. We enter into contracts with our service providers that require them to protect personal data and to process it only for the purposes we specify.

To Our Customers and Their Administrators

If you use the Services through an account established by your employer or another organization, we may disclose personal data about your use of the Services — such as Account Information and Usage Data — to that organization and to the administrators it designates.

In Connection with a Business Transaction or Reorganization

We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.

To Facilitate Legal Obligations and Rights

We may disclose personal data to third parties, such as legal advisors and law enforcement:

• in connection with the establishment, exercise, or defense of legal claims;
• to comply with laws or to respond to lawful requests and legal process;
• to protect our rights and property and the rights and property of our agents, customers, and others, including to enforce our agreements, policies, and terms of use;
• to detect, suppress, or prevent fraud;
• to reduce credit risk and collect debts owed to us;
• to protect the health and safety of us, our customers, or any person; or
• as otherwise required by applicable law.

With Your Consent or Direction

We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our Websites.

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising or targeted advertising, as those terms are defined under applicable state privacy laws. We do not use or disclose Customer Content to train shared or third-party foundation models.

We retain personal data for as long as necessary to fulfill the purposes described in this Privacy Notice, unless a longer retention period is required or permitted by law. No single retention period applies to all personal data. In determining how long to retain personal data, we consider:

• how long we need the data to provide the Services and operate our business, including establishing, maintaining, and administering accounts;
• whether we have an ongoing relationship with you or with the organization you represent;
• the nature, volume, and sensitivity of the data, and the potential risk of harm from unauthorized use or disclosure;
• whether we are subject to a legal, regulatory, tax, accounting, audit, or contractual obligation to retain the data, including obligations we owe to our customers;
• whether retention is necessary to establish, exercise, or defend legal claims, to resolve disputes, to enforce our agreements, or to comply with a legal hold; and
• whether we can achieve our purposes by aggregating or deidentifying the data rather than retaining it in identifiable form.

Personal data contained in Customer Content is retained, returned, and deleted in accordance with our agreement with the relevant customer.

When personal data is no longer needed for the purposes described above, we delete it or deidentify it.

Communication Preferences

Email Communication Preferences

You can stop receiving promotional email communications from us by clicking on the “unsubscribe” link provided in any of our email communications. Please note you cannot opt out of service-related email communications (such as account verification, transaction confirmation, or service update emails).

Automatic Data Collection Preferences

You may be able to utilize third-party tools and features to restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our Services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies, or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.

Please note that because our website analytics does not use cookies, changing your browser’s cookie settings will not prevent it. If you would prefer that we not record your visits to our Websites at all, most content-blocking and privacy browser extensions will block our analytics script, and you may also contact us at privacy@ellis.ai and we will tell you what, if anything, we hold.

Depending on where you live, you may have some or all of the rights described below with respect to personal data we process as a controller. These rights are not absolute. In some cases we may decline a request, in whole or in part, as permitted by applicable law — for example, where granting it would adversely affect the rights and freedoms of another person, or where we are required or permitted to retain the data.

Right to know and access

You may ask us to confirm whether we process personal data about you and to provide you access to that data, together with information about the categories of personal data we have collected, the categories of sources, our purposes for collecting and disclosing it, and the categories of third parties to which we have disclosed it.

Right to a copy (portability)

You may ask us for a copy of the personal data you provided to us, in a portable and, where technically feasible, readily usable format.

Right to correct

You may ask us to correct inaccurate personal data we maintain about you, taking into account the nature of the data and the purposes of processing.

Right to delete

You may ask us to delete personal data we maintain about you.

Right to opt out of sale, sharing, and targeted advertising

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising or targeted advertising. Because we do not engage in these activities, there is nothing for you to opt out of. If this changes, we will update this Privacy Notice and provide the opt-out mechanisms applicable law requires.

Sensitive personal data

The Account Information we collect includes account credentials and multi-factor authentication details, which some laws treat as sensitive personal data. We use and disclose this data only as necessary to authenticate you, secure your account, provide the Services you have requested, and for other purposes permitted by applicable law, and not to infer characteristics about you.

Automated decision-making and profiling

We do not use personal data to engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Right to withdraw consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Right to non-discrimination

We will not discriminate against you for exercising any of these rights, including by denying you Services, charging you a different price, or providing you a different level or quality of Service.

Right to appeal

If we decline to take action on your request, you may appeal our decision by contacting us at privacy@ellis.ai with the subject line “Privacy Rights Appeal.” We will inform you in writing of the outcome of the appeal and the reasons for it, and, where applicable, of your ability to contact your state attorney general to submit a complaint.

How to exercise your rights

Submit a request by emailing privacy@ellis.ai. To protect your personal data, we will take reasonable steps to verify your identity before acting on your request, which may include asking you to confirm information already associated with your account or your relationship with us. We will respond within the timeframe required by applicable law — generally within 45 days, which we may extend where permitted, in which case we will let you know. We do not charge a fee to exercise these rights, except where applicable law permits us to do so for repetitive or excessive requests.

Authorized agents

You may use an authorized agent to submit a request on your behalf. We may ask the agent for proof that you gave them signed permission to submit the request, and we may ask you to verify your own identity directly with us or to confirm that you gave the agent permission.

Personal Data We Process for Our Customers

If your personal data is contained in Customer Content, we process it as a processor on behalf of our customer, and that customer — not Ellis — is responsible for responding to your requests. Please direct your request to the relevant customer. If you contact us instead, we will, where we are able to identify the relevant customer, refer your request to them and assist them in responding as required by our agreement and applicable law.

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, use, alteration, and destruction, including encryption of data in transit and at rest, role-based access controls, logging, and vendor security review. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Our Services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 13. If an individual is under the age of 13, they should not use our Services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 13 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of 13, we will promptly delete that personal data.

Our Websites and Services may include links to or redirect you to third-party websites, plug-ins, applications, or other services. Third-party websites and other services may also reference or link to our Websites and Services. This Privacy Notice does not apply to any personal data practices of these third-party websites, plug-ins, applications, or other services. To learn about these third parties’ personal data practices, please visit their respective privacy notices.

We may update this Privacy Notice from time to time. When we make changes, we will change the “Last Updated” date at the beginning of this Privacy Notice. If we make material changes — for example, to the categories of personal data we process, our purposes for processing, our identity, the fact that we disclose personal data to third parties, the categories of third parties we disclose it to, or the methods by which you can exercise your rights — we will notify affected individuals by email to their registered email address, by prominent posting on our Websites, or through other appropriate communication channels, and we will endeavor to do so approximately 30 days before the change takes effect. Other changes are effective from the date of publication unless otherwise provided.

If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please contact us at privacy@ellis.ai or: