Privacy Policy
Last updated 14 August 2026
This policy explains what Proposal by Elivate collects, why, who else sees it, and how to get it removed. It is written to be read, not to be survived.
The short version. We store your email, the job posts and notes you paste, the proposals we generate for you, and a record of what you paid. We do not sell any of it, and we do not use your proposals to train AI models. You can export or delete everything at any time by emailing code@bokoisaac.pro.
Who we are
Proposal by Elivate is operated by Elivate, a sole proprietorship trading in Nigeria, acting as the data controller for the information described here. For any privacy question, correction, or deletion request, write to code@bokoisaac.pro.
This policy is written with the Nigeria Data Protection Act 2023 (NDPA) in mind. If you are in the UK or the European Economic Area, the UK GDPR and EU GDPR give you equivalent rights, which we honour on the same terms.
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Email address and name | To create your account, sign you in, and contact you about your account. | Performance of a contract |
| Job posts, project notes, and portfolio text you paste | To generate your cover letter and proposal. This is the service itself. | Performance of a contract |
| Generated proposals and cover letters | Saved to your history so you can reopen, reuse, and share them. | Performance of a contract |
| Portfolio image links and descriptions | So proposals can reference your real work. | Performance of a contract |
| Credit balance, payment records, and subscription status | To run billing, apply your plan, and answer billing questions. | Performance of a contract; legal obligation for records |
| Team name, membership, and invitations you send | Only if you use a team plan, to manage shared access. | Performance of a contract |
| Technical logs: token counts, model used, duration, cost, and whether a generation succeeded | To keep the service reliable, price it honestly, and detect abuse. | Legitimate interests |
We do not ask for and do not want government identity numbers, health information, or any other special category data. Please do not paste it into a job post or note.
Payment card details
We never see or store your card number. Payment is handled entirely by Paystack on their own pages. We receive only a payment reference, the amount, the status, and a customer code, which is what lets us add credits to the right account.
How your content is used with AI
To generate a proposal, the job post, your notes, and your portfolio text are sent to OpenAI, which returns the written result. This is unavoidable: it is how the product works.
Two things worth stating plainly:
- We do not use your content to train any AI model, and we do not permit our providers to do so. OpenAI's API terms state that data submitted through the API is not used to train their models by default.
- We do not read your proposals except when you explicitly ask us to help with a specific problem, or in the rare case where we must investigate abuse or a technical fault.
Who else processes your data
We keep this list short on purpose. Each of these is a processor acting on our instructions, not an independent recipient.
| Who | What they handle | Where |
|---|---|---|
| Supabase | Database, authentication, and file storage | United States |
| Vercel | Hosting and server functions | United States |
| OpenAI | Text and image generation | United States |
| Paystack | Payments and subscriptions | Nigeria |
| Cloudinary | Hosting generated diagram images | United States |
| Mailgun | Account and invitation emails | United States |
| Sign-in, only if you choose Google sign-in | United States |
We do not sell your data, and we do not share it for advertising. There is no advertising network, analytics tracker, or data broker in this list, and we do not intend to add one.
International transfers
Most of the services above are in the United States, so your data leaves Nigeria when you use the product. Under the NDPA and GDPR this requires a legal basis, and we rely on the standard contractual terms offered by each provider, together with your use of a service that inherently requires those transfers.
Cookies and local storage
We use no advertising cookies, no analytics cookies, and no third-party trackers. There is no cookie banner because there is nothing to consent to beyond what is strictly necessary.
What we do store in your browser:
- A session token, so you stay signed in. Removing it signs you out.
- Your theme choice, your saved portfolio text, and your last-used settings, so the app looks and behaves the way you left it. This never leaves your device.
How long we keep things
- Your account and proposals: until you delete them or close your account.
- Payment records: up to six years after the transaction, because tax and accounting rules require it. This is the one category we cannot delete on request.
- Technical logs: about 90 days.
- Unaccepted team invitations: 14 days, then they expire.
When you delete your account, your proposals, portfolio, and profile are removed from the live database promptly. Encrypted backups may retain a copy for up to 30 days before rotating out.
Your rights
You can ask us to:
- Give you a copy of your data
- Correct anything wrong
- Delete your account and content
- Stop a particular use you object to
- Send your data to another service where technically possible
Email code@bokoisaac.pro and we will respond within 30 days. There is no charge. We may ask you to confirm you control the account email before acting, because handing data to the wrong person is the worse failure.
If you are unhappy with how we have handled a request, you can complain to the Nigeria Data Protection Commission, or to your local supervisory authority if you are in the UK or EEA.
Security
Every table is protected by row-level security, so one account cannot read another's rows even if the application has a bug. Traffic is encrypted in transit. Payment card details never reach our servers. Access to the production database is limited to the operator.
No system is perfect. If we discover a breach affecting your personal data, we will notify the Nigeria Data Protection Commission within 72 hours where required, and tell you directly if there is a real risk to you.
Children
This service is for working professionals and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.
Shared proposal links
If you create a share link for a proposal, anyone with that link can read it without signing in. That is the point of the feature, but it means a link you circulate is effectively public. You can disable a share link at any time.
Changes to this policy
If we change anything that materially affects you, we will email you before it takes effect. Smaller corrections will simply appear here with a new date at the top.
Questions about any of this: code@bokoisaac.pro.